feat(pr-review-toolkit): add local-git-first diff collection - #58
Conversation
Assisted-by: Codex:gpt-5
Add findings from execution model exploration: merge ref approach using refs/pull/N/merge, preloaded skill with dynamic context injection, and explicitly scoped Bash commands in skill frontmatter. Update source adapters, tool access model, and Phase 3a with the resolved approach. Document 7 evaluated approaches and viability assessment in capability spike results. Assisted-by: Claude:claude-opus-4-6
Use an origin-verified local merge ref as the local-git fast path, simplify source provenance, and keep review agents on Read/Grep without shell access. Assisted-by: Codex:gpt-5
|
Warning Review limit reached
More reviews will be available in 45 minutes and 22 seconds. Learn how PR review limits work. Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file). ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits. 🚦 How do rate limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (5)
📝 WalkthroughWalkthroughThe PR-review toolkit now verifies a local PR merge checkout when possible, builds a file manifest and optional full diff from it, and carries source provenance through workflow prompts, review metadata, docs, and validation guidance. ChangesLocal-git PR review provenance
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
This PR adds a "local-git-first" diff-collection path to the pr-review-toolkit plugin. Before launching the analysis workflow, the review-pr skill now fetches GitHub's synthetic refs/pull/N/merge ref, checks it out as a detached HEAD, verifies the merge's second parent against the PR's headSha, and builds a compact file manifest (plus an optional full diff under a 200K-character cap) that it passes to the workflow via args. When local git is unavailable or verification fails, the workflow falls back to the existing GitHub MCP get_files collection. Provenance (manifest source, patch source, merge SHAs, fallback reason) is recorded in reviewMeta.sources, and specialist prompts branch on the diff source (full diff in context, manifest + Read/Grep on the merged checkout, or MCP focused patch access).
Changes:
- Skill-side preflight + manifest/diff collection using dynamically injected git env checks and scoped
Bash()permissions; results passed to the workflow. - Workflow now consumes
localGitManifest/fullDiff/sources, derives source-specific specialist instructions, and surfaces provenance inreviewMeta. - Documentation (README, WORKFLOW_REWRITE_PLAN) updated and plugin version bumped 1.6.2 → 1.7.0.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
pr-review-toolkit/skills/review-pr/SKILL.md |
Adds git-environment injection, preflight, manifest/full-diff build steps, and new workflow args/Bash() permissions. |
pr-review-toolkit/skills/review-pr/review-pr.js |
Consumes local manifest/full diff, adds patchInstructions, source-aware coverage/notes, and reviewMeta.sources. |
pr-review-toolkit/README.md |
Documents the local-git provider, MCP fallback, permissions, and validation scenarios. |
pr-review-toolkit/docs/WORKFLOW_REWRITE_PLAN.md |
Records the source-adapter design, tool-access model, and capability-spike results. |
pr-review-toolkit/.claude-plugin/plugin.json |
Version bump 1.6.2 → 1.7.0 (minor). |
The core merge-ref logic (HEAD^1 = base, HEAD^2 = PR head, git diff HEAD^1 HEAD) and the Bash() pattern coverage are correct, and helper usage (categorizePath, asNumber, signalsForFile) is consistent. Findings are limited to a few documentation/provenance accuracy nits. Note that the skill now mutates the user's working tree (detached-HEAD checkout with no auto-restore) and broadens Bash permissions, which has operational implications worth a human's attention.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pr-review-toolkit/README.md`:
- Around line 203-212: The validation guidance is too broad because the new
local-git-first flow no longer sources all GitHub data from MCP. Update the
test-matrix wording in README to separate MCP-owned validation (metadata/threads
and fallback behavior) from the local-git provenance used for manifest/full-diff
generation in the review flow, and keep the fallback checks aligned with
`reviewMeta.sources` and the `review-pr.js` path.
In `@pr-review-toolkit/skills/review-pr/review-pr.js`:
- Around line 1504-1513: The fallback note in the review summary currently
implies specialists used a merged checkout even when the manifest came from MCP.
Update the notes-building logic in review-pr.js around the
summary.scale/fullDiffIncluded handling so it branches on
sources.manifestSource: keep the merged-checkout wording only for local/git
sources, and for mcp fallback describe the paginated file manifest and parsed
file snippets instead. Ensure the lowSignal and sources.fallbackReason notes
remain unchanged.
In `@pr-review-toolkit/skills/review-pr/SKILL.md`:
- Around line 214-236: The fallback launch path in Launch Analysis Workflow is
dropping the sources metadata that review-pr.js expects. Update the invocation
so the Workflow tool still receives sources when preflight fails, with
mergeCommit/baseSha/headSha empty and fallbackReason preserved, while omitting
only localGitManifest and fullDiff. Keep the fix localized to the Launch
Analysis Workflow call site so config.sources.fallbackReason remains available
at runtime.
- Around line 163-179: The `git diff --numstat -z` parsing guidance in the
review-pr skill is incorrect for renames/copies: it should describe a four-field
NUL-delimited record rather than a `{source} => {destination}` path token.
Update the instructions around the numstat parsing so the parser for rename/copy
entries in the skill’s review output handling treats the destination as the
fourth field (with source as the third), while normal files still use the
standard three-field additions/deletions/path format.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 1c4ca3de-a20e-4706-b6a8-58cc4fa93e9f
📒 Files selected for processing (5)
pr-review-toolkit/.claude-plugin/plugin.jsonpr-review-toolkit/README.mdpr-review-toolkit/docs/WORKFLOW_REWRITE_PLAN.mdpr-review-toolkit/skills/review-pr/SKILL.mdpr-review-toolkit/skills/review-pr/review-pr.js
The root skill now attempts to check out GitHub's refs/pull/N/merge synthetic merge ref before launching the workflow, building a compact manifest from git diff and optionally passing the full merge diff when it fits a 200K character cap. If local git is unavailable or verification fails, the workflow falls back to MCP-based collection. Pre-checkout environment checks (repo detection, clean worktree, origin URL) use dynamic context injection so they run at skill preprocessing time without Bash tool calls. Post-checkout commands (fetch, checkout, rev-parse, diff) use scoped Bash permissions with exact syntax. The workflow conditionally skips MCP file pagination when a local manifest is provided, and specialist prompts branch on diff source: full diff in context, Read/Grep on merged checkout, or MCP patch access. reviewMeta.sources tracks manifest source, patch source, merge parent SHAs, and fallback reason for full provenance. Assisted-by: Claude:claude-opus-4-6
183f7fb to
bf935c8
Compare
Summary
refs/pull/N/mergesynthetic merge ref, verifies merge parents against PR metadata, builds a compact manifest fromgit diff, and optionally passes the full merge diff to the workflowBash()permissions with exact syntax (git fetch,git checkout,git rev-parse *,git diff *)reviewMeta.sourcestracks manifest source, patch source, merge parent SHAs, and fallback reason for full provenanceTest plan
/pr-review-toolkit:review-pron a PR whereoriginmatches the base repo — verifyreviewMeta.sources.manifestSourceislocal-gitand working tree is detached HEADsources.fullDiffIncludedis false and specialists use Read/Greporiginpoints to a different repo — verify fallback with reason "origin does not match PR base repository"claude plugin validate ./pr-review-toolkit— passesSummary by CodeRabbit
New Features
Documentation
Chores
1.7.0.