audit-ready-pr-reviewer

name	audit-ready-pr-reviewer
description	Reviews pull requests for compliance regressions. Scans code diffs for security and compliance violations, flags issues, and suggests fixes aligned with frameworks like SOC 2, ISO 27001, NIST 800-53.
allowed-tools	Bash, Read, Glob, Write, Edit

Audit-Ready PR Reviewer

Reviews GitHub/GitLab pull requests specifically for compliance regressions. Shifts compliance "left" into the developer's daily workflow.

Quick Commands

Review a PR for SOC 2 compliance:

node plugins/grc-engineer/scripts/review-pr.js myorg/infrastructure 42 SOC2

Review a PR for ISO 27001:

node plugins/grc-engineer/scripts/review-pr.js myorg/infrastructure 42 ISO27001

Review a PR with custom framework:

node plugins/grc-engineer/scripts/review-pr.js myorg/infrastructure 42 NIST80053

What It Checks

• Privilege Escalation - Detects overly permissive IAM roles/policies
• Encryption - Flags missing encryption at rest or in transit
• Tagging/Labeling - Ensures required tags/labels are present
• Network Security - Validates VPC configurations, security groups
• Access Controls - Checks authentication and authorization
• Logging - Verifies audit logging is enabled
• Backup/Recovery - Ensures backup configurations

Output Format

Posts GitHub comments with:

• ⚠️ Warning level and control reference
• 📝 Description of the issue
• ✅ Suggested fix with code example
• 🔗 Link to relevant compliance control

Example Comment

⚠️ **Compliance Warning: SOC 2 CC6.1 - Least Privilege**

This PR introduces an IAM role with `AdministratorAccess`, which violates the Least Privilege principle.

**Issue:** Line 23 in `terraform/iam.tf` assigns full administrative access.

**Suggested Fix:**
```hcl
resource "aws_iam_role" "app_role" {
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "s3:GetObject",
        "s3:PutObject"
      ]
      Resource = "arn:aws:s3:::my-bucket/*"
    }]
  })
}

Control Reference: SOC 2 CC6.1, NIST 800-53 AC-6

## Prerequisites

- GitHub repository (owner/repo format)
- PR number
- `GITHUB_TOKEN` environment variable (requires `repo` scope)
- Optional: Framework name (defaults to SOC2)