Systematically retrieve and address PR code review comments using make pr-comments. Use when handling code review feedback or addressing PR comments.
Code Review Workflow Skill
Context (Input)
PR has unresolved code review comments
Need systematic approach to address feedback
Ready to implement reviewer suggestions
Need to maintain quality standards during review implementation
Task (Function)
Systematically retrieve, categorize, and address all PR code review comments while maintaining quality standards and PR readiness.
Success Criteria:
Direct GitHub GraphQL review-thread query shows 0 unresolved review comments, and PR_COMMENT_EVIDENCE records SNAPSHOT_STARTED_AT=<auto-captured ISO time>, SNAPSHOT_CAPTURED_BY=code-review-skill, PR_HEAD=<sha>, plus every review-thread, top-level PR issue, and review body comment from that snapshot as COMMENT_META|url|updatedAt|body_sha256 and COMMENT|url|commit|sha, COMMENT|url|reply|url, or COMMENT|url|decline|url; reply/decline evidence comments must be posted by the PR author or a login in PR_COMMENT_TRUSTED_EVIDENCE_ACTORS and include structured EVIDENCE_SOURCE, EVIDENCE_ACTION, and decline EVIDENCE_REASON; non-evidence comments created or edited after the snapshot block completion until the snapshot and evidence are restarted, except an otherwise qualifying approval review on pushed HEAD whose body is empty or exactly FINAL_APPROVAL_NO_ACTION: true
make ci shows "✅ CI checks successfully passed!"
Final make ai-review-loop runs after make ci and reports PASS on the same commit; if it applies fixes, repeat make ci and make ai-review-loop until both pass without new changes
Local HEAD is pushed and matches gh pr view <number> --repo "$PR_REPO" --json headRefOid
Commit-scoped status/check rollup for local HEAD is queried from the base PR repository, is non-empty, non-required contexts have only allowed terminal states (SUCCESS, SKIPPED, or NEUTRAL), every trusted check name/type/source in the trusted base .github/required-pr-checks.txt or externally validated bootstrap manifest and every live base-branch protection required status/check is present with state SUCCESS on that pushed head, source-less branch-protection contexts resolve through trusted manifest type/source mappings, and GitHub Actions check URLs point at the base PR repository
Final direct GitHub GraphQL review-thread query after the pushed-head verification still shows 0 unresolved review comments
gh pr view <number> --repo "$PR_REPO" --json state,mergeStateStatus,mergeable,reviewDecision,isDraft,reviewRequests shows the PR is open, not draft, not conflicting, reviewDecision is APPROVED, reviewRequests is empty, and a direct review query shows an APPROVED review on the pushed HEAD submitted after the latest addressed comment evidence by a non-author reviewer with OWNER, MEMBER, or COLLABORATOR association
Workflow Overview
AI Review Loop → PR Comments → Categorize → Apply by Priority → Verify → Run CI → Final AI Review Loop → Push → GitHub Readiness → Done
Before addressing PR comments manually, fetch the PR base and run the autonomous review loop against that base:
set -euo pipefail
: "${PR:?Set PR to the pull request number}"case"$PR"in''|*[!0-9]*) echo"PR must be numeric" >&2; exit 1 ;;
esac
: "${PR_REPO:?Set PR_REPO=owner/repo for the base PR repository}"
PR_META="$(gh pr view "$PR" --repo "$PR_REPO" --json baseRefName,baseRefOid)"
BASE_REF="$(printf '%s\n' "$PR_META" | jq -r .baseRefName)"
BASE_OID="$(printf '%s\n' "$PR_META" | jq -r .baseRefOid)"
TRUSTED_BASE_REF="refs/remotes/pr-base/$PR"
git fetch "git@github.com:${PR_REPO}.git""$BASE_REF:$TRUSTED_BASE_REF"test"$(git rev-parse "$TRUSTED_BASE_REF")" = "$BASE_OID"
AI_REVIEW_OUTPUT="$(AI_REVIEW_BASE="$TRUSTED_BASE_REF" make ai-review-loop 2>&1)"printf'%s\n'"$AI_REVIEW_OUTPUT"
AI_REVIEW_LAST_LINE="$(printf '%s\n' | sed '/^[[:space:]]*$/d' | tail -n 1)"
=
This executes scripts/ai-review-loop.sh, which:
Runs an AI review agent against the current diff (base: AI_REVIEW_BASE, or main by default)
If issues are found (STATUS: FAIL), runs a fix agent to auto-remediate
Verifies fixes with make ci
Repeats up to AI_REVIEW_MAX_ITER times (default: 3)
The reviewer prompt in scripts/ai-review-prompts/review.md checks both FR/NFR
coverage and code health for supported local review agents. It explicitly
includes system design tradeoffs, appropriate design pattern use, code smells,
SOLID/DRY/KISS, DDD/CQRS, Hexagonal Architecture, and repository rules. Review
failures must stay concrete and scoped to changed code or directly affected
behavior.
Codex consumes the reviewer prompt directly. Claude keeps its built-in
/review invocation and receives the same repository review policy through the
loop's appended system prompt.
Configuration (all overridable via environment):
Variable
Default
Description
AI_REVIEW_AGENTS
codex
Agent(s) to use (codex, claude)
AI_REVIEW_BASE
main
Base branch for diff comparison
AI_REVIEW_MAX_ITER
3
Max review/fix iterations (0=∞)
AI_REVIEW_VERIFY_CMD
make ci
Verification command after each fix
AI_REVIEW_LOG_DIR
var/ai-review
Directory for review/fix logs
Examples:
# Use Claude instead of Codex
AI_REVIEW_BASE="$TRUSTED_BASE_REF" AI_REVIEW_AGENTS=claude make ai-review-loop
# Limit to 1 iteration, custom base branch
AI_REVIEW_BASE=develop AI_REVIEW_MAX_ITER=1 make ai-review-loop
# Run both agents
AI_REVIEW_BASE="$TRUSTED_BASE_REF" AI_REVIEW_AGENTS=codex,claude make ai-review-loop
Prompt templates: scripts/ai-review-prompts/review.md (reviewer) and scripts/ai-review-prompts/fix.md (fixer).
Step 1: Get PR Comments
make pr-comments # Auto-detect from current branch
make pr-comments PR=62 # Specify PR number
make pr-comments FORMAT=json # JSON output
Output: All unresolved comments with file/line, author, timestamp, URL
Step 2: Categorize Comments
Type
Identifier
Priority
Action
Committable Suggestion
Code block, "```suggestion"
Highest
Apply immediately, commit separately
LLM Prompt
"🤖 Prompt for AI Agents"
High
Execute prompt, implement changes
Architecture Concern
Class naming, file location
High
Invoke appropriate skill
Question
Ends with "?"
Medium
Answer inline or via code change
General Feedback
Discussion, recommendation
Low
Consider and improve
Resolved/Stale
Outdated or already fixed
None
Do not change code; record reason
Step 3: Verify Architecture & Organization
For code changes (suggestions, prompts, new files), invoke verification skills:
Concern Type
Skill to Invoke
Class placement/naming
code-organization
DDD patterns
implementing-ddd-architecture
Layer violations
deptrac-fixer (if deptrac fails)
Quick verification: Run make phpcsfixer && make psalm && make deptrac && make unit-tests
Step 4: Apply Changes Systematically
For Committable Suggestions
Verify the suggestion still applies to current code
Apply the suggestion exactly when it is still valid and compatible with repository rules
If the suggestion is stale, implement the current equivalent fix or record why no change is needed
Verify every finding against current code before changing files
Execute still-valid instructions
Skip stale, duplicate, or contradicted findings with a brief reason
Verify output meets requirements
Commit with reference
For Architecture/Organization Concerns
Invoke appropriate skill (code-organization or implementing-ddd-architecture)
Implement recommended changes
Verify: make phpcsfixer && make psalm && make deptrac && make unit-tests
Commit with reference
For Questions
Determine if code change or reply needed
If code: implement + commit
If reply: respond on GitHub
For General Feedback
Evaluate suggestion merit
Implement if beneficial
Document reasoning if declined
Step 5: Verify All Addressed
set -euo pipefail
: "${PR:?Set PR to the pull request number}"case"$PR"in''|*[!0-9]*) echo"PR must be numeric" >&2; exit 1 ;;
esac
: "${PR_REPO:?Set PR_REPO=owner/repo for the base PR repository}"
owner="${PR_REPO%%/*}"
repo="${PR_REPO#*/}"
query='query($owner:String!,$repo:String!,$pr:Int!,$cursor:String){repository(owner:$owner,name:$repo){pullRequest(number:$pr){reviewThreads(first:100,after:$cursor){pageInfo{hasNextPage endCursor} nodes{isResolved comments(first:1){nodes{id}}}}}}}'
total_count=0
cursor=''while :; doif [ -n "$cursor" ]; then
page_json="$(gh api graphql -f owner="$owner" -f repo="$repo" -F pr="$PR" -f cursor="$cursor" -f query="$query")"else
page_json="$(gh api graphql -f owner="$owner" -f repo="$repo" -F pr="$PR" -f query="$query")"fi
page_count=")] | length')"
total_count=$((total_count + page_count))
has_next=
[ = ] ||
cursor=
-n && !=
-eq 0
If unresolved comments remain, repeat categorization and implementation. If a remaining thread is stale, duplicate, or answer-only, respond or resolve it according to the review workflow before continuing. Run capture_review_comment_snapshot before handling comments and write SNAPSHOT_STARTED_AT=<timestamp> plus SNAPSHOT_CAPTURED_BY=code-review-skill to PR_COMMENT_EVIDENCE; do not supply or backdate the timestamp manually. Before final verification, record every review-thread comment, top-level PR issue comment, and review body comment URL from that snapshot in PR_COMMENT_EVIDENCE using PR_HEAD=<sha>, COMMENT_META|url|updatedAt|body_sha256, and COMMENT|url|commit|sha, COMMENT|url|reply|url, or COMMENT|url|decline|url; comment timing uses the later of createdAt and updatedAt, commit messages must reference the source URL, reply/decline comments must be posted by the PR author or a login in PR_COMMENT_TRUSTED_EVIDENCE_ACTORS, reply bodies must include EVIDENCE_SOURCE: <source URL> and positive EVIDENCE_ACTION: <action>, decline bodies must include EVIDENCE_SOURCE: <source URL>, no-change EVIDENCE_ACTION: <action>, and EVIDENCE_REASON: <reason>, and only reply/decline URLs validated against snapshotted source comments may be treated as evidence comments after the snapshot. Any later created or edited non-evidence PR/review comment requires restarting the snapshot and evidence ledger, except an otherwise qualifying approval review on pushed HEAD whose body is empty or exactly FINAL_APPROVAL_NO_ACTION: true.
Step 6: Run Quality Checks
MANDATORY: Run comprehensive CI checks after implementing all changes:
set -euo pipefail
command -v rg >/dev/null || { echo"rg is required" >&2; exit 1; }
CI_OUTPUT="$(make ci 2>&1)"printf'%s\n'"$CI_OUTPUT"
CI_LAST_LINE="$(printf '%s\n' "$CI_OUTPUT" | sed '/^[[:space:]]*$/d' | tail -n 1)"test"$CI_LAST_LINE" = "✅ CI checks successfully passed!"
After make ci, scan the current PR diff for forbidden suppression or ignore directives. Changes to quality-tool baselines or suppression/config files block product PR completion; isolated dedicated gate-definition PRs may include those files only when external trusted-base validation passes.
Changes to CI/review gate definitions (AGENTS.md, Makefile, .claude/skills/**, .agents/skills/**, review scripts, CI workflows, architecture/quality gate configs, lint/formatter configs, external quality/check service configs, package-manager check configs, GraphQL/OpenAPI check configs, required-check manifests, AI review-loop Bats coverage, gate-specific onboarding guidance, or timestamped autonomous spec evidence whose slug exactly matches the validation-support allowlist) must be isolated in a dedicated gate-definition PR after the trusted base already has a required-check manifest. Initial gate-definition bootstrap PRs that introduce .github/required-pr-checks.txt may proceed only through the externally validated bootstrap path, and product PRs must not validate with gate definitions supplied only by that same PR.
DO NOT finish the task until make ci shows: ✅ CI checks successfully passed!
Dedicated gate-definition PRs may complete only when all of the following are true:
assert_gate_definition_change_scope reports only gate-definition files and explicitly classified validation-support files changed against TRUSTED_BASE_REF, except for the initial externally validated bootstrap PR that introduces .github/required-pr-checks.txt when the trusted base has no manifest.
Step 8 reruns make ci and final make ai-review-loop on the same clean local HEAD before push; caller-supplied BASE_OID or VERIFIED_HEAD variables are not trusted as proof.
GATE_DEFINITION_VALIDATION_EVIDENCE points to a readable ledger outside the PR worktree with PR_HEAD=<HEAD>, TRUSTED_BASE=<baseRefOid>, VALIDATION_MODE=trusted-base or VALIDATION_MODE=immutable-external, TRUSTED_BASE_GATE=PASS, TRUSTED_MANIFEST_CHECKS=PASS, and an immutable GitHub Actions run URL whose repository is the base PR repository for trusted-base mode or is listed in GATE_DEFINITION_TRUSTED_VALIDATOR_REPOS for immutable-external mode; the run must complete successfully while validating pushed HEAD from the canonical artifact, execute from the trusted base commit for trusted-base mode or from a repo|head_sha listed in GATE_DEFINITION_TRUSTED_VALIDATOR_HEAD_SHAS for immutable-external mode, come from a workflow path allowed by GATE_DEFINITION_TRUSTED_BASE_WORKFLOWS or GATE_DEFINITION_TRUSTED_VALIDATOR_WORKFLOWS, use a trusted workflow SHA from the trusted base or GATE_DEFINITION_TRUSTED_VALIDATOR_WORKFLOW_SHAS, and expose exactly one non-expired trusted-base-gate-evidence artifact file named trusted-base-gate-evidence.env with exact full-line records for the same PR_HEAD, TRUSTED_BASE, TRUSTED_BASE_GATE=PASS, TRUSTED_MANIFEST_CHECKS=PASS, exact VALIDATION_MODE, RUN_REPO, RUN_ID, WORKFLOW_PATH, and WORKFLOW_SHA.
Direct review-thread query shows zero unresolved review threads.
PR_COMMENT_EVIDENCE maps every review-thread, top-level PR issue, and review body comment URL from the auto-captured snapshot to matching metadata and to a later PR-range commit whose message references the source URL, or to a later same-PR reply/decline URL whose trusted-author body includes , , and decline ; comment ordering uses the later of and , only validated snapshotted evidence URLs may whitelist post-snapshot evidence comments, and later created or edited non-evidence comments force the snapshot/evidence loop to restart except for an otherwise qualifying approval review on pushed whose body is empty or exactly .
Step 7: Run Final AI Review Loop
After the final successful make ci, capture CI_HEAD="$(git rev-parse HEAD)" and run the autonomous review loop again before any push or ready-for-review action:
')"
test -n "$cursor" && test "$cursor" != "null"
done
}
write_comment_metadata_evidence() {
local owner repo metadata_items existing_comment_lines source_url source_time source_updated_at source_body_b64 source_body_hash tmp_file
assert_review_comment_snapshot_valid
: "${LOCAL_HEAD:?Set LOCAL_HEAD to the final local head before writing PR comment evidence metadata}"
owner="${PR_REPO%%/*}"
repo="${PR_REPO#*/}"
metadata_items="$(
{
non_thread_comment_items "$owner" "$repo" before
review_thread_comment_items "$owner" "$repo" before
} | sed '
')"
test -n "$workflow_sha"
actual_workflow_sha="$(gh api "repos/$run_repo/contents/$workflow_path?ref=$run_head_sha" --jq .sha)"
test "$actual_workflow_sha" = "$workflow_sha"
;;
esac
artifacts_json="$(gh api "repos/$run_repo/actions/runs/$run_id/artifacts")"
artifact_id="$(printf '
' "$artifacts_json" | jq -r '
select
"trusted-base-gate-evidence"
false
id
' | head -n 1)"
test -n "$artifact_id" && test "$artifact_id" != "null"
artifact_dir="$(mktemp -d)"
artifact_zip="$artifact_dir/artifact.zip"
artifact_payload_dir="$artifact_dir/payload"
gh api "repos/$run_repo/actions/artifacts/$artifact_id/zip" > "$artifact_zip"
mkdir -p "$artifact_payload_dir"
unzip -q "$artifact_zip" -d "$artifact_payload_dir"
artifact_evidence_file_count="$(find "$artifact_payload_dir" -type f -name trusted-base-gate-evidence.env | wc -l | tr -d '
')"
if [ -z "$manifest_matches" ]; then
echo "Source-less branch required check '
$branch_required_name
' has no trusted manifest type/source mapping" >&2
exit 1
fi
while IFS= read -r manifest_required_check; do
IFS='
' read -r manifest_type manifest_name manifest_source <<EOF
$manifest_required_check
EOF
test -n "$manifest_type" && test -n "$manifest_name" && test -n "$manifest_source"
printf '
' "$checks_json" | jq -e --arg type "$manifest_type" --arg name "$manifest_name" --arg source "$manifest_source" '
select
type
$type
$name
source
$source
$matches
$matches
$matches
"SUCCESS"
'
done <<< "$manifest_matches"
fi
done <<< "$branch_required_checks"
}
wait_for_pr_state() {
local attempt expected_base expected_base_ref
expected_base="${GATED_BASE_OID:-$BASE_OID}"
expected_base_ref="${GATED_BASE_REF:-$BASE_REF}"
PR_STATE='
'
for attempt in $(seq 1 30); do
PR_STATE="$(gh pr view "$PR" --repo "$PR_REPO" --json state,mergeStateStatus,mergeable,reviewDecision,isDraft,reviewRequests,headRefOid,baseRefOid,baseRefName)"
if printf '
' "$PR_STATE" | jq -e --arg head "$LOCAL_HEAD" --arg base "$expected_base" --arg base_ref "$expected_base_ref" '
$head
$base
$base_ref
"OPEN"
false
"MERGEABLE"
"CLEAN"
"HAS_HOOKS"
"APPROVED"
' >/dev/null; then
return 0
fi
sleep 10
done
echo "PR final readiness predicate did not pass after waiting" >&2
return 1
}
run_final_local_readiness_gate() {
local ci_output ci_last_line ai_review_output ai_review_last_line current_base_json
: "${PR_COMMENT_EVIDENCE:?Set PR_COMMENT_EVIDENCE to the review-comment evidence ledger path}"
: "${PR_COMMENT_EVIDENCE_READY:?Append COMMENT evidence lines for every COMMENT_META line, then set PR_COMMENT_EVIDENCE_READY=true}"
assert_gate_definition_change_scope
assert_no_forbidden_suppressions
test -z "$(git status --short)"
ci_output="$(make ci 2>&1)"
printf '
' "$ci_output"
ci_last_line="$(printf '
' "$ci_output" | sed '
' | tail -n 1)"
test "$ci_last_line" = "✅ CI checks successfully passed!"
LOCAL_HEAD="$(git rev-parse HEAD)"
write_comment_metadata_evidence
VALIDATED_COMMENT_EVIDENCE_URLS='
'
assert_review_thread_comment_evidence
assert_non_thread_comment_evidence
ai_review_output="$(AI_REVIEW_BASE="$TRUSTED_BASE_REF" make ai-review-loop 2>&1)"
printf '
' "$current_base_json" | jq -r .baseRefName)"
VERIFIED_HEAD="$LOCAL_HEAD"
}
# 0. Run autonomous AI review + fix loop against the PR base
: "${PR:?Set PR to the pull request number}"
case "$PR" in
'
'|*[!0-9]*) echo "PR must be numeric" >&2; exit 1 ;;
esac
: "${PR_REPO:?Set PR_REPO=owner/repo for the base PR repository}"
PR_META="$(gh pr view "$PR" --repo "$PR_REPO" --json baseRefName,baseRefOid)"
BASE_REF="$(printf '
' | tail -n 1)"
test "$AI_REVIEW_LAST_LINE" = "AI review PASS."
# 1. Get comments
: "${PR_COMMENT_EVIDENCE:?Set PR_COMMENT_EVIDENCE to the review-comment evidence ledger path}"
capture_review_comment_snapshot
printf '
' "$REVIEW_COMMENT_SNAPSHOT_STARTED_AT" > "$PR_COMMENT_EVIDENCE"
make pr-comments PR="$PR"
# 2. Apply each suggestion/fix (one commit per comment)
git commit -m "Apply review suggestion: [description]
Ref: [comment URL]"
# 3. Verify all addressed
assert_no_unresolved_comments
# 4. Run CI
CI_OUTPUT="$(make ci 2>&1)"
printf '
' "$CI_OUTPUT"
CI_LAST_LINE="$(printf '
' "$CI_OUTPUT" | sed '
' | tail -n 1)"
test "$CI_LAST_LINE" = "✅ CI checks successfully passed!"
assert_gate_definition_change_scope
assert_no_forbidden_suppressions
CI_HEAD="$(git rev-parse HEAD)"
LOCAL_HEAD="$CI_HEAD"
write_comment_metadata_evidence
# Append one COMMENT|url|commit|sha, COMMENT|url|reply|url, or COMMENT|url|decline|url line for every COMMENT_META line before continuing.
: "${PR_COMMENT_EVIDENCE_READY:?Append COMMENT evidence lines for every COMMENT_META line, then set PR_COMMENT_EVIDENCE_READY=true}"
assert_review_thread_comment_evidence
assert_non_thread_comment_evidence
# 5. Run the mandatory final AI review loop before push/ready
AI_REVIEW_OUTPUT="$(AI_REVIEW_BASE="$TRUSTED_BASE_REF" make ai-review-loop 2>&1)"
printf '
' | tail -n 1)"
test "$AI_REVIEW_LAST_LINE" = "AI review PASS."
# If the loop applies fixes or changes HEAD, commit them, then rerun make ci,
# assert_no_forbidden_suppressions, capture CI_HEAD, and run this final
# ai-review-loop until both pass on the same commit without new changes.
test "$CI_HEAD" = "$(git rev-parse HEAD)"
test -z "$(git status --short)"
assert_gate_definition_change_scope
VERIFIED_HEAD="$CI_HEAD"
rg -q "^PR_HEAD=$VERIFIED_HEAD$" "$PR_COMMENT_EVIDENCE"
CURRENT_BASE_JSON="$(gh pr view "$PR" --repo "$PR_REPO" --json baseRefName,baseRefOid)"
test "$BASE_OID" = "$(printf '
Commit-scoped check rollup for pushed HEAD is queried from the base PR repository and passes the trusted manifest, live base-branch protection, source-less branch-protection trusted-manifest mappings, and source checks, including base-repository GitHub Actions URLs.
Direct review query shows an APPROVED review whose review commit equals pushed HEAD, whose submittedAt is later than the latest addressed comment or evidence event, and whose author is not the PR author and has OWNER, MEMBER, or COLLABORATOR association.
gh pr view shows stateOPEN, not draft, mergeable, reviewDecisionAPPROVED, no review requests, and an accepted merge state after polling the full final readiness predicate.
