claude/skills/copilot-pr-review/SKILL.md
Request a GitHub Copilot code review on the current branch's pull request, wait for Copilot to post the review, then report the issues it found and offer to fix them. Use this skill whenever the user wants a Copilot review of their PR — phrases like "get a copilot review", "have copilot review this", "ask copilot to look at the PR", "request copilot review", "run copilot on this branch", or anything else that implies they want Copilot's automated feedback on an open PR. Trigger even if the user doesn't say the word "skill".
npx skillsauth add ojongerius/dotfiles copilot-pr-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Request a Copilot review on the current branch's PR, wait for it to land, then surface what Copilot flagged and offer to fix it.
PR_NUMBER=$(gh pr view --json number --jq .number)
REPO=$(gh repo view --json nameWithOwner --jq .nameWithOwner)
If gh pr view fails (no open PR for the branch), stop and tell the user — they need to open a PR first. Don't try to guess which PR they meant.
Copilot may have reviewed this PR before. Record the most recent Copilot review timestamp so later you can recognise the new one:
BASELINE=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
--jq '[.[] | select(.user.login == "Copilot" or .user.login == "copilot-pull-request-reviewer[bot]")] | max_by(.submitted_at) | .submitted_at // ""')
The bot login has shown up as both Copilot and copilot-pull-request-reviewer[bot] in different contexts — match either. BASELINE will be empty if Copilot has never reviewed this PR.
Use the mcp__github-audited__request_copilot_review tool with the PR's owner, repo, and number. That dispatches the review asynchronously — it returns immediately.
sleep 120
Two minutes. This isn't arbitrary — Copilot reviews basically never land in under a minute, and polling immediately clutters the transcript and burns API budget for no reason.
END=$(( $(date +%s) + 180 ))
FOUND=""
while [ $(date +%s) -lt $END ]; do
LATEST=$(gh api "repos/$REPO/pulls/$PR_NUMBER/reviews" \
--jq '[.[] | select(.user.login == "Copilot" or .user.login == "copilot-pull-request-reviewer[bot]")] | max_by(.submitted_at)')
LATEST_TS=$(echo "$LATEST" | jq -r '.submitted_at // ""')
if [ -n "$LATEST_TS" ] && [ "$LATEST_TS" != "$BASELINE" ]; then
FOUND="$LATEST"
break
fi
sleep 15
done
If the loop exits without finding a new review, tell the user it timed out after 5 minutes and suggest re-running the skill shortly. Don't spin forever — Copilot can silently no-op (e.g. on draft PRs or huge diffs) and you don't want to trap the user.
From the review found above, extract the id and body (Copilot's top-level summary). Then pull the inline comments for that review:
REVIEW_ID=$(echo "$FOUND" | jq -r .id)
gh api "repos/$REPO/pulls/$PR_NUMBER/reviews/$REVIEW_ID/comments"
Present a compact report in this shape:
## Copilot review
<summary — the review body, trimmed of boilerplate>
## Issues (<count>)
### path/to/file.ts
- L42: <comment body, one or two lines>
- L57: <…>
### path/to/other.py
- L10: <…>
If Copilot left no inline comments, say so plainly — "Copilot reviewed the PR and didn't flag anything." That's a real, useful result. Don't pad it with filler.
End the report with a single-line ask, e.g.: "Want me to address any of these? Pick which ones or say 'all'."
Do not start editing files before the user confirms. The point of this skill is to surface feedback, not to silently rewrite the branch.
requested_reviewers on the PR), skip Step 3 and go straight to waiting — re-requesting serves no purpose and may reset the clock.mcp__github-audited__request_copilot_review isn't available, fall back to gh api -X POST "repos/$REPO/pulls/$PR_NUMBER/requested_reviewers" -f 'reviewers[]=copilot-pull-request-reviewer' and note the fallback to the user.development
Maintainer-only workflow for handling GitHub Secret Scanning alerts on OpenClaw. Use when Codex needs to triage, redact, clean up, and resolve secret leakage found in issue comments, issue bodies, PR comments, or other GitHub content.
development
Maintainer workflow for OpenClaw releases, prereleases, changelog release notes, and publish validation. Use when Codex needs to prepare or verify stable or beta release steps, align version naming, assemble release notes, check release auth requirements, or validate publish-time commands and artifacts.
development
Run, watch, debug, and extend OpenClaw QA testing with qa-lab and qa-channel. Use when Codex needs to execute the repo-backed QA suite, inspect live QA artifacts, debug failing scenarios, add new QA scenarios, or explain the OpenClaw QA workflow. Prefer the live OpenAI lane with regular openai/gpt-5.4 in fast mode; do not use gpt-5.4-pro or gpt-5.4-mini unless the user explicitly overrides that policy.
development
End-to-end Parallels smoke, upgrade, and rerun workflow for OpenClaw across macOS, Windows, and Linux guests. Use when Codex needs to run, rerun, debug, or interpret VM-based install, onboarding, gateway smoke tests, latest-release-to-main upgrade checks, fresh snapshot retests, or optional Discord roundtrip verification under Parallels.