)]}'
{
  "commit": "db769f53384766f8db739d0b887daf70d7add901",
  "tree": "ba7a0b48d769eb3293f4c5423338c6cbfab80da3",
  "parents": [
    "a69b4e36f5e57543e37f7855ac973fd16fe1b6e6"
  ],
  "author": {
    "name": "Hubert Gruszecki",
    "email": "h.gruszecki@gmail.com",
    "time": "Fri Sep 18 14:27:04 2026 +0200"
  },
  "committer": {
    "name": "Hubert Gruszecki",
    "email": "h.gruszecki@gmail.com",
    "time": "Mon Sep 21 12:41:45 2026 +0200"
  },
  "message": "feat(ci): add /skill review command that runs repo skills\n\nReview runs by hand today: a maintainer copies a diff into a local\nagent and pastes the findings back. The triage commands already\nturn a comment into an action, so a review can ride the same path.\n\nA committer comments `/skill \u003cname\u003e`. One workflow parses the\ncommand, gates the author on the collaborator permission, checks\nout the pull request head and runs the repo skill headlessly\nagainst DeepSeek, with each tool call streamed into the job log.\nA second, on workflow_run where the token can write, posts\nfindings.json as one review with inline comments.\n\nNo pull request code runs. The agent gets Read, Grep, Glob, Write\nand Agent through --restricted and --tools, its file access ends\nat the checkout and one directory of its own, and one Edit rule\nplus --permission-prompts none denies every other write. No Rust\ntoolchain is installed, so a build script, a cargo configuration\nor a rustc wrapper in the pull request has nothing to run it, and\nthere is no cache to poison. The DeepSeek key stays in the step\nenvironment, which the agent cannot read without a shell.\n\nThe skill and the instruction files come from the base branch,\nnever from the pull request under review, and --strict-mcp-config\nloads no MCP server. The first workflow carries no write token\nand nothing in it posts, because an issue_comment run of a fork\nreceives a read-only token.\n\nWhat CI did on the commit reaches the agent as a file, because it\ncannot build or test. Each review opens with the skill\u0027s own\nverdict, the reason and a count per severity. The job log closes\nwith the cost, priced at DeepSeek rates and at two Claude tiers.\n",
  "tree_diff": [
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "ed1fc6647dd752a0a4467f1c36caf0191c777e76",
      "new_mode": 33188,
      "new_path": ".github/review-bot/README.md"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "427476e4d243a48cfa5332710a2b1ed29b76f8de",
      "new_mode": 33188,
      "new_path": ".github/review-bot/comment-style.md"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "2ae5b6a3443eab8629eace6c7f2d909671ffdf3f",
      "new_mode": 33188,
      "new_path": ".github/review-bot/prompt.md"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "17aea746ec6f14e070ba40748ca5253c4e11c14b",
      "new_mode": 33188,
      "new_path": ".github/workflows/pr-skill-review-post.yml"
    },
    {
      "type": "add",
      "old_id": "0000000000000000000000000000000000000000",
      "old_mode": 0,
      "old_path": "/dev/null",
      "new_id": "45c0de3c5aa034e0dda3c1925f30f35a8cfa7671",
      "new_mode": 33188,
      "new_path": ".github/workflows/pr-skill-review-run.yml"
    }
  ]
}