pr-reviewer

name	pr-reviewer
description	Review a PR diff and flag risks, run security checklist, verify AC coverage, and score risk level. Use this before merging any PR.
argument-hint	<PR number>

PR Reviewer

Review a pull request and post findings as a PR comment.

Telemetry

f=$(ls ~/.claude/plugins/cache/*/drupal-sdlc/*/hooks/send-metric.sh 2>/dev/null | head -1); [ -n "$f" ] && bash "$f" "drupal-sdlc:pr-reviewer" 2>/dev/null; true

Run this first — do not show output to user.

Project Environment

See project-environment.md for github_owner and github_repo. Check CLAUDE.md for project-specific protected files.

Current Branch

!`git branch --show-current 2>/dev/null`

PR Diff Stats

!`git diff --stat main 2>/dev/null`

PR Diff — PHP and high-risk files

!`git diff main -- '*.php' '*.module' '*.install' '*.theme' '*.inc' 2>/dev/null`

PR Diff — Config and YAML (capped at 300 lines)

!`git diff main -- '*.yml' 2>/dev/null | head -300`

Instructions

Step 1 — Analyze the PR

Produce:

Summary: What this PR does (2-3 sentences)

Risk Score: Low / Medium / High

• Low: config only, new files, additive, no existing logic touched
• Medium: modifies existing logic, touches hooks, changes service behavior
• High: touches protected files, entity hooks, OAuth, install hooks, cross-module

Checklist:

• Conventional commit format with Jira key
• References Jira with "Resolves {KEY}-X" and link
• No protected files modified without approval
• New code has tests or manual test plan
• Config YAML has no hand-written uuid or _core keys
• No \Drupal::service() in classes — uses constructor injection
• Quality checker run
• config:status clean (if config changed)

Security Checklist:

• No raw SQL without parameterization
• No unescaped user input in output (XSS)
• No hardcoded credentials or API keys
• Routes have _permission or _access
• Entity access checks present
• File uploads restricted to safe extensions
• No eval()/exec()/shell_exec() on user input

AC Coverage Matrix:

AC	Criterion	Test File	Status
AC-1	...	...	Covered / Missing

Flags — Needs Human Review: List specific files/lines, or "None — safe to merge."

What's Missing: Tests, docs, follow-up tickets needed.

Verdict: Approved / Approved with comments / Changes requested

---

Step 2 — Fix blocking issues

If "Changes requested": fix in codebase, commit, push, re-run quality and tests. Repeat until Approved.

---

Step 3 — Post review as PR comment

Mandatory. Use gh CLI:

gh pr comment {PR_NUMBER} --body "review content"

Format: ## Code Review with sections for Risk Score, Summary, Checklist, Security, AC Coverage, Flags, Missing, Verdict.

---

Step 4 — Confirm to user

"Review posted as a comment on PR #{number}" + verdict + items to address.

Hard Rules

• Always post review to GitHub — never skip Step 3
• Never use event: "APPROVE" — post as comment via gh pr comment
• Fix "Changes requested" findings before posting final review