Add a read-only expert pull request review skill - #69011
Open
PureWeen wants to merge 4 commits into
Open
Conversation
Adds .github/skills/review-pull-request: a read-only pull request review contract plus the ASP.NET Core domain criteria it routes to. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23284af6-fe88-4424-a958-1cd6ea24c056
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The changes are additive documentation/skill content, and the only noted issue is a minor wording clarification that doesn’t affect functionality.
Review tier: Lite
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
 |
.github/skills/review-pull-request/references/cross-cutting-reviewer.md — This reference mentions a pull-request-review workflow, but that workflow doesn't exist in this… |
What changed in this PR
Adds a new repository skill (review-pull-request) that defines a read-only, GitHub-anchored contract for performing an “expert panel” pull request review (freeze evidence → route domains → apply per-dimension checks → validate candidates → emit a structured local result), along with domain reference checklists used by the skill.
Changes:
- Adds
.github/skills/review-pull-request/SKILL.mddefining the review contract, routing rules, validation gates, and required output format. - Adds domain reference documents under
.github/skills/review-pull-request/references/for cross-cutting and major ASP.NET Core areas (servers/networking, MVC/Razor/routing, Blazor/Components, SignalR, auth/security, hosting/DI, minimal APIs/OpenAPI, gRPC, native interop).
| File | Description |
|---|---|
| .github/skills/review-pull-request/SKILL.md | Defines the skill’s end-to-end review contract (freeze evidence, route, validate, structured output). |
| .github/skills/review-pull-request/references/cross-cutting-reviewer.md | Cross-cutting checklist intended to apply to all changes, regardless of area. |
| .github/skills/review-pull-request/references/servers-networking-reviewer.md | Servers/networking checklist (Kestrel, HTTP stack, middleware, body I/O, etc.). |
| .github/skills/review-pull-request/references/mvc-razor-routing-reviewer.md | MVC/Razor/routing checklist for controller/action/binding/rendering/routing contracts. |
| .github/skills/review-pull-request/references/blazor-components-reviewer.md | Blazor/Components checklist (render modes, lifecycle, JS interop, navigation, forms). |
| .github/skills/review-pull-request/references/signalr-reviewer.md | SignalR checklist (protocol, transport, lifetime, clients, scaleout). |
| .github/skills/review-pull-request/references/auth-security-reviewer.md | Auth/security checklist (schemes, tokens, cookies, antiforgery, DP, redirects). |
| .github/skills/review-pull-request/references/hosting-di-reviewer.md | Hosting/DI checklist (builder parity, DI lifetimes, options, startup/shutdown). |
| .github/skills/review-pull-request/references/minimal-api-openapi-reviewer.md | Minimal APIs/OpenAPI checklist (binding/runtime vs generated contract fidelity). |
| .github/skills/review-pull-request/references/grpc-reviewer.md | gRPC integration checklist (registration, transcoding, metadata, tests). |
| .github/skills/review-pull-request/references/native-interop-reviewer.md | IIS/native interop checklist (ANCM, P/Invoke/marshaling, lifetimes, Helix). |
💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+5
to
+6
| This file is reference material. The `review-pull-request` skill and `pull-request-review` workflow | ||
| give each dimension below an independent, single-dimension pass. |
The skill lint enforces a 1024-character frontmatter description; this one was 1219 and failed `spec-compliance`. Condensed the routing and exclusion clauses to 1009 characters while keeping every trigger phrase and every DO NOT USE FOR case. `eng/skill-evals/run.ps1 -Action Lint` now reports 6 of 6 skills passing. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23284af6-fe88-4424-a958-1cd6ea24c056
The contract covered running the panel and falling back when subagents are unavailable, but not the case observed in practice: subagents were available and the orchestrator declined to dispatch them because the diff looked small, then still had to report the path it took. State that case explicitly. This is a disclosure rule, not an enforcement mechanism; prompt wording has twice failed to compel dispatch, so the property this contract can actually guarantee is that the review never presents collapsed analysis as panel coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23284af6-fe88-4424-a958-1cd6ea24c056
A dispatched reviewer that returns nothing usable was previously indistinguishable from one that completed with no findings, so a panel could report full coverage while some dimensions were never actually reviewed. Require a retry, disclosure as `degraded-panel`, and an explicit note when the surviving coverage no longer supports a conclusion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 23284af6-fe88-4424-a958-1cd6ea24c056
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/skills/review-pull-request: a read-only pull request review contract plus the ASP.NET Core domain criteria it routes to.This is the first of two pull requests. This one adds only the skill. #68867 is the second and adds the maintainer-invoked
/reviewgh-aw workflow that consumes it, so the skill can land and be used on its own while the workflow is iterated on separately. Until this merges, #68867's diff still shows these same files; they drop out of it once this is in.The skill is useful without the workflow — a developer can run it locally in Copilot CLI against a pull request before pushing.
What it does
It freezes the exact head SHA and treats the GitHub changed-file list, diff, pull request body, and existing reviews as authoritative, rather than inferring changed files from a stale local base. It reviews only changed files while reading unchanged callers, producers, and consumers for context.
Changed paths are routed to the domain criteria that own them — servers and networking, MVC/Razor/routing, Blazor and Components, SignalR, auth and security, hosting and DI, minimal APIs and OpenAPI, gRPC, native IIS interop — plus cross-cutting review on every change. It reviews a bounded number of areas and says which areas it did not cover instead of implying it looked at everything. Very large pull requests are declined rather than partially reviewed and presented as complete.
Every retained finding has to point at a changed line, identify a concrete trigger and material consequence, and cite source or primary-contract evidence. Style, naming, speculative refactors, duplicates, unsupported claims, and findings already posted are dropped. It also assesses whether the pull request's tests can false-pass and whether the permanent test surface matches the behavior owner, and routes public API changes to the repository's API review guidance. Output is capped at five findings, and finding nothing is a normal result.
Boundaries
This is a read-only analysis contract. It never posts, approves, requests changes, edits, commits, pushes, or otherwise mutates GitHub, and it treats pull request text, code, and comments as untrusted evidence. It returns a structured local result; whether anything is published is entirely the caller's decision.
Provenance
The domain corpus matches the
dotnet-microsoft/aspnetcore-agenticExpert Reviewer at source revision7b3f383dec612aeed9896a1e8172df1fd33e4013: 111 review dimensions and 614 CHECK items. The reference files are inert — they are loaded only when a review routes to them, so nothing here changes day-to-day Copilot behaviour for anyone who does not invoke the skill.