code-review

# Code Review Skill *Load with: base.md + [codex-review.md for OpenAI Codex] + [gemini-review.md for Google Gemini]* **Purpose:** Enforce automated code reviews as a mandatory guardrail before every commit and deployment. Choose between Claude, OpenAI Codex, Google Gemini, or multiple engines for comprehensive analysis. --- ## Review Engine Choice When running `/code-review`, users can choose their preferred review engine: ``` ┌─────────────────────────────────────────────────────────────────┐ │ CODE REVIEW - Choose Your Engine │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ ○ Claude (default) │ │ Built-in, no extra setup, full conversation context │ │ │ │ ○ OpenAI Codex CLI │ │ GPT-5.2-Codex specialized for code review, 88% detection │ │ Requires: npm install -g @openai/codex │ │ │ │ ○ Google Gemini CLI │ │ Gemini 2.5 Pro with 1M token context, free tier available │ │ Requires: npm install -g @google/gemini-cli │ │ │ │ ○ Dual Engine (any two) │ │ Run two engines, compare findings, catch more issues │ │ │ │ ○ All Three (maximum coverage) │ │ Run Claude + Codex + Gemini for critical/security code │ │ │ └─────────────────────────────────────────────────────────────────┘ ``` ### Engine Comparison | Aspect | Claude | Codex | Gemini | Multi-Engine | |--------|--------|-------|--------|--------------| | **Setup** | None | npm + OpenAI API | npm + Google Account | All setups | | **Speed** | Fast | Fast | Fast | 2-3x time | | **Context** | Conversation | Fresh per review | 1M tokens | N/A | | **Detection** | Good | 88% (best) | 63.8% SWE-Bench | Combined | | **Free Tier** | N/A | Limited | 1,000/day | Varies | | **Best for** | Quick reviews | High accuracy | Large codebases | Critical code | ### Set Default Engine ```toml # ~/.claude/settings.toml or project CLAUDE.md [code-review] default_engine = "claude" # Options: claude, codex, gemini, dual, all ``` ### Usage Examples ```bash # Use default engine /code-review # Explicitly choose engine /code-review --engine claude /code-review --engine codex /code-review --engine gemini # Dual engine (pick any two) /code-review --engine claude,codex /code-review --engine claude,gemini /code-review --engine codex,gemini # All three engines /code-review --engine all # Quick shortcuts /code-review # Uses default /code-review --codex # Use Codex /code-review --gemini # Use Gemini /code-review --all # All three engines ``` --- ## Multi-Engine Output When using multiple engines, findings are compared and deduplicated: ### Dual Engine Example ``` ┌─────────────────────────────────────────────────────────────────┐ │ CODE REVIEW RESULTS - DUAL ENGINE (Claude + Codex) │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ ✅ AGREED (Found by both): │ │ 🔴 SQL injection in auth.ts:45 │ │ 🟡 Missing error handling in api.ts:112 │ │ │ │ 🔷 CLAUDE ONLY: │ │ 🟠 Potential race condition in worker.ts:89 │ │ 🟢 Consider extracting helper function │ │ │ │ 🔶 CODEX ONLY: │ │ 🟠 Memory leak - unclosed stream in upload.ts:34 │ │ 🟡 N+1 query pattern in orders.ts:156 │ │ │ ├─────────────────────────────────────────────────────────────────┤ │ SUMMARY │ │ Agreed: 2 | Claude only: 2 | Codex only: 2 │ │ Critical: 1 | High: 2 | Medium: 2 | Low: 1 │ │ Status: ❌ BLOCKED - Fix critical/high issues │ └─────────────────────────────────────────────────────────────────┘ ``` ### Triple Engine Example (All Three) ``` ┌─────────────────────────────────────────────────────────────────┐ │ CODE REVIEW RESULTS - TRIPLE ENGINE │ ├─────────────────────────────────────────────────────────────────┤ │ │ │ ✅ UNANIMOUS (All 3 found): │ │ 🔴 SQL injection in auth.ts:45 │ │ │ │ ✅ MAJORITY (2 of 3 found): │ │ 🟠 Memory leak - unclosed stream in upload.ts:34 (Codex+Gemini)│ │ 🟡 Missing error handling in api.ts:112 (Claude+Codex) │ │ │ │ 🔷 CLAUDE ONLY: │ │ 🟠 Potential race condition in worker.ts:89 │ │ │ │ 🔶 CODEX ONLY: │ │ 🟡 N+1 query pattern in orders.ts:156 │ │ │ │ 🟢 GEMINI ONLY: │ │ 🟡 Consider using batch API for better performance │ │ 🟢 Type could be more specific in types.ts:23 │ │ │ ├─────────────────────────────────────────────────────────────────┤ │ SUMMARY │ │ Unanimous: 1 | Majority: 2 | Single: 5 │ │ Critical: 1 | High: 2 | Medium: 3 | Low: 2 │ │ Status: ❌ BLOCKED - Fix critical/high issues │ └─────────────────────────────────────────────────────────────────┘ ``` ### When to Use Each Mode | Mode | Use When | |------|----------| | **Single (Claude)** | Quick in-flow reviews, exploration | | **Single (Codex)** | CI/CD automation, high accuracy needed | | **Single (Gemini)** | Large codebases (100+ files), free tier | | **Dual** | Important PRs, pre-merge reviews | | **Triple (All)** | Security-critical code, payment systems, auth | --- ## Core Philosophy ``` ┌─────────────────────────────────────────────────────────────────┐ │ CODE REVIEW IS NON-NEGOTIABLE │ │ ───────────────────────────────────────────────────────────── │ │ │ │ Every commit must pass code review. │ │ Every PR must be reviewed before merge. │ │ Every deployment must include review sign-off. │ │ │ │ AI catches what humans miss. Humans catch what AI misses. │ │ Together: fewer bugs, cleaner code, better security. │ ├─────────────────────────────────────────────────────────────────┤ │ INVOKE: /code-review │ │ PLUGIN: code-review@claude-plugins-official │ └─────────────────────────────────────────────────────────────────┘ ``` --- ## When to Run Code Review ### Mandatory Review Points | Trigger | Action | Command | |---------|--------|---------| | **Before commit** | Review staged changes | `/code-review` | | **Before PR** | Review all changes vs base | `/code-review` | | **Before merge** | Final review of PR | `/code-review` | | **Before deploy** | Review deployment diff | `/code-review` | ### Automatic Integration **Run code review automatically before every commit:** ``` ┌─────────────────────────────────────────────────────────────────┐ │ COMMIT WORKFLOW │ │ ───────────────────────────────────────────────────────────── │ │ │ │ 1. Write code │ │ 2. Run tests (TDD - must pass) │ │ 3. Run /code-review ← MANDATORY │ │ 4. Address critical/high issues │ │ 5. Commit │ │ 6. Push │ │ │ │ Skip step 3? ❌ NO COMMIT ALLOWED │ └─────────────────────────────────────────────────────────────────┘ ``` --- ## Using the Code Review Plugin ### Basic Usage ```bash # Review current changes /code-review # Review specific files /code-review src/auth/*.ts # Review a PR /code-review --pr 123 # Review with specific focus /code-review --focus security /code-review --focus performance /code-review --focus architecture ``` ### Review Categories The code review plugin analyzes: | Category | What It Checks | |----------|----------------| | **Security** | Vulnerabilities, injection risks, auth issues, secrets | | **Performance** | N+1 queries, memory leaks, inefficient algorithms | | **Architecture** | Design patterns, SOLID principles, coupling | | **Code Quality** | Readability, complexity, duplication | | **Best Practices** | Language idioms, framework conventions | | **Testing** | Coverage gaps, test quality, edge cases | | **Documentation** | Missing docs, outdated comments | ### Severity Levels | Level | Action Required | Can Commit? | |-------|-----------------|-------------| | 🔴 **Critical** | Must fix immediately | ❌ NO | | 🟠 **High** | Should fix before commit | ❌ NO | | 🟡 **Medium** | Fix soon, can commit | ✅ YES | | 🟢 **Low** | Nice to have | ✅ YES | | ℹ️ **Info** | Suggestions only | ✅ YES | --- ## Pre-Commit Hook Integration ### Install Pre-Commit Hook ```bash #!/bin/bash # .git/hooks/pre-commit echo "🔍 Running code review..." # Run Claude code review on staged files STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(ts|tsx|js|jsx|py|go|rs)$') if [ -n "$STAGED_FILES" ]; then # Invoke code review (requires claude CLI) claude --print "/code-review $STAGED_FILES" > /tmp/code-review-result.txt 2>&1 # Check for critical/high issues if grep -q "🔴\|Critical\|🟠\|High" /tmp/code-review-result.txt; then echo "❌ Code review found critical/high issues:" cat /tmp/code-review-result.txt echo "" echo "Fix these issues before committing." exit 1 fi echo "✅ Code review passed" fi exit 0 ``` ### Make Hook Executable ```bash chmod +x .git/hooks/pre-commit ``` --- ## Codex CLI Setup (For Codex/Both Modes) If you want to use Codex or Both modes, install the Codex CLI: ```bash # Prerequisites: Node.js 22+ node --version # Must be 22+ # Install Codex CLI npm install -g @openai/codex # Authenticate (choose one): # Option 1: ChatGPT subscription (Plus, Pro, Team, Enterprise) codex # Follow prompts to sign in # Option 2: API key export OPENAI_API_KEY=sk-proj-... ``` ### Verify Installation ```bash # Check Codex is installed codex --version # Test review codex > /review ``` See `codex-review.md` skill for full Codex documentation. --- ## Gemini CLI Setup (For Gemini/Multi-Engine Modes) If you want to use Gemini or multi-engine modes, install the Gemini CLI: ```bash # Prerequisites: Node.js 20+ node --version # Must be 20+ # Install Gemini CLI npm install -g @google/gemini-cli # Or via Homebrew (macOS) brew install gemini-cli # Install Code Review extension gemini extensions install https://github.com/gemini-cli-extensions/code-review ``` ### Authenticate ```bash # Option 1: Google Account (recommended, 1000 req/day free) gemini # Follow browser login prompts # Option 2: API key (100 req/day free) export GEMINI_API_KEY="your-key-from-aistudio.google.com" ``` ### Verify Installation ```bash # Check Gemini is installed gemini --version # List extensions gemini extensions list # Test review gemini > /code-review ``` See `gemini-review.md` skill for full Gemini documentation. --- ## CI/CD Integration ### GitHub Actions - Claude Only ```yaml # .github/workflows/code-review.yml name: Code Review on: pull_request: types: [opened, synchronize, reopened] jobs: code-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Get changed files id: changed-files run: | echo "files=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | tr '\n' ' ')" >> $GITHUB_OUTPUT - name: Run Claude Code Review env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} run: | npx @anthropic-ai/claude-code --print "/code-review ${{ steps.changed-files.outputs.files }}" > review.md - name: Post Review Comment uses: actions/github-script@v7 with: script: | const fs = require('fs'); const review = fs.readFileSync('review.md', 'utf8'); github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.issue.number, body: `## 🔍 Claude Code Review\n\n${review}` }); - name: Check for Critical Issues run: | if grep -q "Critical\|🔴" review.md; then echo "❌ Critical issues found" exit 1 fi ``` ### GitHub Actions - Codex Only ```yaml # .github/workflows/codex-review.yml name: Codex Code Review on: pull_request: jobs: review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Codex Review uses: openai/codex-action@main with: openai_api_key: ${{ secrets.OPENAI_API_KEY }} model: gpt-5.2-codex safety_strategy: drop-sudo ``` ### GitHub Actions - Both Engines ```yaml # .github/workflows/dual-review.yml name: Dual Code Review on: pull_request: jobs: claude-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0 - name: Claude Review env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} run: | npx @anthropic-ai/claude-code --print "/code-review" > claude-review.md - uses: actions/upload-artifact@v4 with: name: claude-review path: claude-review.md codex-review: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 with: fetch-depth: 0