// Use when you need to evaluate CodeRabbit PR comments and fix or reply
| name | coderabbit-review |
| description | Use when you need to evaluate CodeRabbit PR comments and fix or reply |
| argument-hint | ["pr-number"] |
| compatibility | Requires gh CLI. |
| allowed-tools | Bash(gh pr view:*) Bash(gh repo view:*) Bash(git remote:*) Bash(git branch:*) Bash(gh pr list:*) Bash(gh api:*) Bash(curl:*) Bash(sha256sum:*) Read Glob Grep Edit AskUserQuestion |
Fetch CodeRabbit comments from a GitHub PR, evaluate each one, and take action: apply a code fix or post a reply.
PR: $ARGUMENTS
Determine the owner, repo, and pullNumber:
$ARGUMENTS is a PR number, use it directly.gh pr view or gh pr list.gh repo view --json owner,name to get the upstream coordinates. If that fails (e.g., no default remote set), fall back to parsing git remote -v to identify the upstream GitHub repository.upstream/origin. Prefer repo coordinates from PR metadata (gh pr view --json), then gh repo view, then git remote -v. If multiple candidates remain, ask the user.Inline review comments (CodeRabbit's line-level suggestions):
gh api --paginate repos/<owner>/<repo>/pulls/<pullNumber>/comments
PR-level comments (CodeRabbit's summary/walkthrough):
gh api --paginate repos/<owner>/<repo>/issues/<pullNumber>/comments
Filter both lists to only comments where user.login equals coderabbitai[bot].
For PR-level comments, skip any comment whose body contains <!-- walkthrough_start --> or <!-- This is an auto-generated comment: review in progress — these are CodeRabbit's walkthrough/summary posts, not actionable review feedback.
For inline comments, skip any comment that belongs to a resolved review thread (check the pull_request_review_id against resolved threads, or look for the "resolved": true marker if available).
If no actionable CodeRabbit comments are found, report that and exit.
For each CodeRabbit comment, analyze it carefully by reading the relevant source file(s).
For inline comments: use the path field to read the file with the Read tool. Use line or original_line to find the exact code location. The diff_hunk field shows the surrounding context.
Evaluate:
Category: classify as one of:
bug — actual code defect or logic errorsecurity — security vulnerabilityperformance — inefficiency or resource issuestyle — formatting, naming, readabilitydocs — missing or incorrect documentation/commentsnitpick — minor preference, not a real issuequestion — CodeRabbit is asking for clarificationValidity: does the comment point to a real issue?
valid — yes, should be addresseddebatable — reasonable disagreement existsinvalid — the code is correct and CodeRabbit is wrongRecommended action:
fix — the code should be changed; generate the fixreply — explain why the code is correct, or acknowledge and deferdismiss — noise; briefly acknowledge and move onShow a summary table first:
| # | File | Line | Category | Validity | Recommended Action | Summary |
|---|---|---|---|---|---|---|
| 1 | src/foo.ts | 42 | bug | valid | fix | "Variable x may be undefined" |
| 2 | src/bar.ts | 10 | nitpick | debatable | reply | "Use const here" |
Then show the full evaluation for each comment (bugs and security first, then performance, then others):
CodeRabbit says:
[exact quote]
Context (relevant code snippet):
[code from the file at that location]
Assessment: [Your evaluation: why valid/invalid, what the actual issue is]
Proposed action: fix | reply | dismiss
[If fix: show the exact code diff to apply]
[If reply or dismiss: show the draft reply text]
After presenting ALL comments, wait for the user to respond. The user may want to:
When the user is ready to act, the available actions per comment are:
Critical rule: Never apply fixes or post replies without explicit user approval. If unsure whether the user wants to act or keep discussing, keep discussing.
For "Apply fix":
sha256sum to confirm--proto '=https' --tlsv1.2 --fail --location --max-time 15 --connect-timeout 5For "Post reply" (inline review comment):
gh api -X POST repos/<owner>/<repo>/pulls/<pullNumber>/comments/<commentId>/replies -f body="<reply text>"
For "Post reply" (PR-level comment):
gh api -X POST repos/<owner>/<repo>/issues/<pullNumber>/comments -f body="<reply text>"
For "Edit & post":
Use AskUserQuestion to ask the user to provide their edited reply text, then post it using the appropriate gh api call above.
For "Skip": Move on.
After all comments are processed, output:
gh pr view --json headRefName,headRepositoryOwner plus git remote -v and git branch -a to confirm destination before pushing.coderabbitai[bot] — filter by thisid, path, line, original_line, diff_hunk, bodyid, body, user.logincoderabbitai[bot] — using any other string (e.g., coderabbit) will silently miss all comments.<!-- walkthrough_start --> markers.Scan a Python package repository for compiled/binary files using Fromager-style detection and malcontent YARA analysis, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
Inspect recent git history of a Python package repository for suspicious commits touching supply-chain-sensitive files, then triage findings with AI reasoning to produce a structured risk report section.
Use this skill to evaluate the security of a Python package repository by orchestrating static analysis, binary scanning, and git history inspection sub-skills in parallel, then combining their results into a unified security report with a risk rating.
Run hexora static analysis on a Python package repository to detect suspicious code patterns, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
Use this skill to identify non-Red Hat RPM packages installed in container images or on the local machine. For containers, pulls images across multiple architectures and release tags; for local scans, inspects the host directly. Extracts RPM signing metadata and reports packages not signed with the Red Hat GPG key as CSV output. Use when auditing compliance, checking supply-chain provenance, or scanning for third-party RPMs in RHOAI component images.
Sync code from an upstream GitHub repository into a target fork (e.g., opendatahub-io midstream). Detects remotes from the current repo, or clones fresh if run from outside. Fetches upstream, merges into a sync branch, restores protected files, resolves conflicts, and opens a PR to the target GitHub repo. Use when asked to sync upstream, merge upstream changes, or bring a GitHub fork up to date with its upstream source.