--- model: sonnet --- # /tas-review-pr $ARGUMENTS Review a Pull Request automatically: detect platform (ADO or GitHub), fetch diff, run parallel review agents, post inline comments per finding, post summary comment, and vote. > The main session is an **orchestrator + synthesizer** — fetch the diff, fan out specialist agents, merge and post. Heavy analysis lives in those agents (each on its own model), so this command runs on `sonnet` (matching the `Model:` line in the posted summary). A PR is reviewed once and the result is posted externally, so — unlike `/tas-review` — there is **no small-diff fast-path**: the only size lever is that the database / AWS agents already gate on relevance. ## Input `$ARGUMENTS` can be: - PR ID / number: `1234` - PR URL: extract the numeric ID from the URL ## Step 0 — Detect Platform Run: `git remote get-url origin` Parse the output: - Contains `github.com` → `PLATFORM=github`, `SCRIPT=python .tas/tools/tas-github.py` - Contains `dev.azure.com` or `visualstudio.com` → `PLATFORM=ado`, `SCRIPT=python .tas/tools/tas-ado.py` - Neither → report "Cannot detect platform from git remote. Unsupported remote URL." and stop. For ADO: also read `tas.yaml`, check `ado.enabled`. If false or missing: stop. ## Step 1 — Get PR Info Run: `{SCRIPT} pr-get ` Record output fields: - `TITLE`, `SOURCE_BRANCH`, `TARGET_BRANCH`, `CREATOR`, `STATUS` - `REPO_ID` — ADO: repository GUID | GitHub: `owner/repo` - `HEAD_COMMIT` — GitHub only (used for inline comments) - `WORK_ITEMS` — ADO only ## Step 2 — Fetch Diff & Changed Files Run: `{SCRIPT} pr-diff ` Record: - `SOURCE_BRANCH`, `TARGET_BRANCH`, `FETCH_HEAD` - `CHANGED_FILES` — list with status prefix (M/A/D + path) ## Step 3 — Stack Detection Read `.tas/rules/common/stack-detection.md`. Detect stack from changed file extensions and project structure. ## Step 4 — Review Agents (launch simultaneously, non-overlapping lanes) Read each changed file with: `git show FETCH_HEAD:` Only review M (modified) and A (added) files — skip D (deleted). Each reviewer owns a distinct lane so synthesis dedupe is trivial — no two reviewers check the same criteria. **Inline review — Architecture & Correctness lane** (main session, always run): Read `.tas/rules/common/code-review.md` for the criteria priority + output format. Covers: SAD / ADR / layer-boundary conformance, logic correctness, edge cases, null handling, error handling. **Does NOT cover** language style, idioms, naming, async patterns — that is Agent 2's lane. Don't duplicate it. **Agent 1 — `security-reviewer`** (always run): > Security audit of PR #{pr-id} diff. Changed files: {changed_files_list}. > Read each file with `git show FETCH_HEAD:`. > Read `.tas/rules/common/security.md`. If stack identified, also read `.tas/rules/[stack]/security.md`. > Focus: OWASP Top 10, injection, hardcoded secrets, auth/authz, data exposure. > Format: findings by Critical / High / Medium / Low, each with file:line and remediation. **Agent 2 — Language reviewer** (per `lang_agent` from stack detection): > Language-specific review of PR #{pr-id} diff. Changed files: {changed_files_list}. > Read each file with `git show FETCH_HEAD:`. > Read `.tas/rules/[stack]/coding-style.md`, `.tas/rules/[stack]/patterns.md`, `.tas/rules/[stack]/testing.md`. > If stack has React: also read `.tas/rules/web/testing.md`, `.tas/rules/web/performance.md`. > Focus: language idioms & naming conventions, async/await patterns, type safety, stack-specific anti-patterns. Correctness/null/edge-cases are the inline lane — skip them. > Format: findings by Critical / High / Medium / Low with file:line. **Agent 3 — `database-reviewer`** (only when scope touches schema/migrations/queries): > Database review of PR #{pr-id} diff. Changed files: {changed_files_list}. > Read each file with `git show FETCH_HEAD:`. > Focus: schema correctness, migration safety, missing indexes, N+1 patterns, data integrity. (Injection/string-concat safety is the security-reviewer lane — skip.) > Format: findings by Critical / High / Medium / Low with file:line. **Agent 4 — `aws-reviewer`** (only when the diff touches IaC — `*.tf`, `cdk/**`, `**/lambda/**`, `serverless.yml`, CloudFormation/SAM templates): > AWS infrastructure review of PR #{pr-id} diff. Changed files: {changed_files_list}. > Read each file with `git show FETCH_HEAD:`. > Focus: IAM/S3/Lambda/networking security, cost traps, reliability (DLQ, retries, multi-AZ). > Format: findings by Critical / High / Medium / Low with file:line. Wait for ALL agents to complete, then synthesize. ## Step 5 — Synthesize Combine findings from main session + agents. Sort by severity. Lanes are non-overlapping by design (Step 4), so dedupe is light — only merge where a security and a language finding land on the same file:line. ``` ### Critical (must fix before merge) - `file:line` — issue — Fix: ... ### High (should fix before merge) - `file:line` — issue — Fix: ... ### Medium (consider fixing) - `file:line` — issue — Fix: ... ### Low / Info - `file:line` — issue — ... ``` ## Step 6 — Post Inline Comments For each Critical and High finding with a specific file:line: **ADO (`PLATFORM=ado`):** ``` python .tas/tools/tas-ado.py pr-inline --repo-id --file "" --line --comment "[Severity] issue — Fix: fix" ``` **GitHub (`PLATFORM=github`):** ``` python .tas/tools/tas-github.py pr-inline --file "" --line --comment "[Severity] issue — Fix: fix" ``` Rules: - File path: forward slashes, no leading slash - Skip findings without a specific line number - Skip findings on deleted (D) files ## Step 7 — Post Summary Comment Format: ```markdown ## AI Code Review — TAS Kit **PR:** #{pr-id} — {title} **Date:** {today} **Model:** Claude — sonnet orchestrator + specialist review agents **Platform:** {ADO | GitHub} > ⚠️ Tests not run — diff-only review (no local checkout) ### Critical - `file:line` — issue — Fix: ... ### High ... ### Medium ... ### Low / Info ... --- **Verdict:** APPROVED ✅ | CHANGES REQUESTED ❌ ``` Post it: ``` {SCRIPT} pr-comment --comment "" ``` ## Step 8 — Vote - Zero Critical AND zero High → `{SCRIPT} pr-vote --vote approve` - Any Critical or High found → `{SCRIPT} pr-vote --vote reject` ## Step 9 — Report to User ``` PR #{pr-id} reviewed: {title} Platform: {ADO | GitHub} Critical: N | High: N | Medium: N | Low: N Inline comments posted: N Vote: APPROVED ✅ / CHANGES REQUESTED ❌ ``` ## Principles - Review PR diff only — do not review unrelated files in repo - Each inline comment: specific, actionable, fix included - Summary always posted even if no issues ("No issues found — clean PR") - Auto-approve only when zero Critical AND zero High - Note "Tests not run — diff-only mode" in summary - Read `.tas/rules/ado-integration.md` for ADO operating rules (ADO platform only)