helpers/skills/doc-post/SKILL.md
Use this skill to post validation and review findings as comments on a GitHub PR or GitLab MR. Reads workspace findings files and formats them as inline or summary comments.
npx skillsauth add opendatahub-io/ai-helpers doc-postInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Post validation and review findings as comments on a PR/MR.
$ARGUMENTS contains:
--validation: post validation findings only--review: post review findings only--all (default): post both validation and review findingsFrom the PR URL, determine the platform:
github.com → GitHub (use gh CLI)Based on flags, read the relevant findings files:
workspace/validation-findings.jsonworkspace/review-findings.jsonIf a requested file doesn't exist, warn and skip it.
Create a summary comment with an overview table:
## Documentation Review Results
| Category | High | Medium | Low | Total |
|----------|------|--------|-----|-------|
| Validation | 0 | 3 | 5 | 8 |
| Review | 1 | 2 | 3 | 6 |
| **Total** | **1** | **5** | **8** | **14** |
**Review confidence**: 0.78
### High-severity findings
1. **[ref_model-serving-params.adoc:42]** Technical inaccuracy: The documented API field 'replicas' should be 'minReplicas'
- **Suggestion**: Change 'replicas' to 'minReplicas' per the CRD type definition
### Medium-severity findings
1. **[con_model-serving.adoc:15]** Vale: Use 'Red Hat OpenShift AI' instead of 'RHOAI' on first reference
For findings that reference specific files and lines in the PR's changed files:
gh pr view <URL> --json files# Post summary comment
gh pr comment <PR-URL> --body "<summary>"
# Post inline review (if applicable)
gh api repos/{owner}/{repo}/pulls/{number}/reviews \
--method POST \
--field body="Documentation review complete" \
--field event="COMMENT" \
--field comments="[...]"
Use the GitLab API to post merge request notes.
Report to caller:
Comments posted on the PR/MR. No workspace file produced.
gh CLI not available (cannot post to GitHub)development
Run hexora static analysis on a Python package repository to detect suspicious code patterns, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
development
Inspect recent git history of a Python package repository for suspicious commits touching supply-chain-sensitive files, then triage findings with AI reasoning to produce a structured risk report section.
development
Scan a Python package repository for compiled/binary files using Fromager-style detection and malcontent YARA analysis, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
testing
Use this skill to identify non-Red Hat RPM packages installed in container images or on the local machine. For containers, pulls images across multiple architectures and release tags; for local scans, inspects the host directly. Extracts RPM signing metadata and reports packages not signed with the Red Hat GPG key as CSV output. Use when auditing compliance, checking supply-chain provenance, or scanning for third-party RPMs in RHOAI component images.