Pr Review

---
name: pr-review
version: 1.0.0
description: GitHub Actions PR review bot with Greptile parity — confidence 0-5, risk gates, checks annotations, and fix loop. Install via setup-vskills.
---

# PR Review

Polished GitHub-Actions review bot. Copy the templates into any repo with `setup-vskills` or `node standalone/pr-review/scripts/copy.mjs`.

## What it installs

- `.github/workflows/pr-review.yml` — trusted-base review, status checks, one upserted summary
- `.github/workflows/pr-fix.yml` — collaborator fix-on-comment, one commit, max 3 loops then `needs-human`
- `.vskills/review.yml` — when to review, file-change limit, strictness, status-check thresholds, auto-approve
- `.vskills/pr-review/` — prompts plus the JSON/config parsers the workflows actually run

## Triggers

- Trusted `pull_request_target: [opened, synchronize, reopened, ready_for_review]`; checks out the PR head as data and executes no PR-controlled code. Collaborators can rerun with `@vskills review`.
- `issue_comment: created` when the comment line begins with the fix command. Same-repo collaborators only. Forks cannot push.
- After a verified fix-on-comment push, the fix job dispatches this workflow because `GITHUB_TOKEN` commits do not fire `pull_request_target`.

## BYOK model

OpenRouter via `OPENROUTER_API_KEY` and `vars.REVIEW_MODEL` / `vars.REVIEW_API_BASE`. Without a key the workflow still posts a limited deterministic review (conflict detection and credential-pattern scan on added lines). It does not run PR-controlled `npm` scripts.

## CONTEXT-aware

If the consumer repo has `CONTEXT/glossary.md` or `architecture.md`, the review job injects them (8k token cap) before chunking hunks (80 lines) and running ripgrep context.

## Verification

```
node --test 'test/pr-review-*.test.js'
```

Templates carry `<!-- vskills-pr-review -->` for idempotent upserts.