pr-review-ci-fix
Automated PR review and CI auto-fix for GitHub and GitLab using the Composio CLI. Pulls diffs, fetches failing job logs, posts review comments, and …
它会碰到什么
逐条看命中(1 条严重或高危)
- 严重
SKILL.md:21exec-pipe-to-shellcurl -fsSL https://composio.dev/install | bash
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
PR Review + CI Auto-Fix
Drive GitHub/GitLab PR reviews and CI triage from the shell using the Composio CLI. No tab-switching between browser, terminal, and chat.
When to Use
- A PR needs a structured review (correctness, style, risks) with inline comments.
- CI is red and you want the agent to read the logs, patch the code, and recheck.
- You want a single command that cycles: fetch diff → critique → fix → push → rerun.
Prereqs
curl -fsSL https://composio.dev/install | bash
composio login
composio link github # or: composio link gitlab
Optional env for non-interactive runs: COMPOSIO_API_KEY.
Core Toolkits
Discover slugs with search, then pin them for reuse:
composio search "list pull request files" --toolkits github
composio search "download workflow logs" --toolkits github
composio search "create pr comment" --toolkits gitlab
Common slugs you'll reuse:
GITHUB_GET_A_PULL_REQUESTGITHUB_LIST_PULL_REQUESTS_FILESGITHUB_CREATE_A_REVIEW_FOR_A_PULL_REQUESTGITHUB_LIST_WORKFLOW_RUNS_FOR_A_REPOSITORYGITHUB_DOWNLOAD_WORKFLOW_RUN_LOGSGITLAB_GET_SINGLE_MERGE_REQUESTGITLAB_LIST_MERGE_REQUEST_DISCUSSIONSGITLAB_CREATE_NEW_MERGE_REQUEST_NOTE
Always confirm via composio execute <SLUG> --get-schema before first use.
Review Workflow
- Pull the PR metadata + diff:
composio execute GITHUB_GET_A_PULL_REQUEST \
-d '{"owner":"acme","repo":"app","pull_number":482}'
composio execute GITHUB_LIST_PULL_REQUESTS_FILES \
-d '{"owner":"acme","repo":"app","pull_number":482}'
- Summarize risk areas (auth, migrations, public APIs, tests) into a review body.
- Post the review with inline comments:
composio execute GITHUB_CREATE_A_REVIEW_FOR_A_PULL_REQUEST -d '{
"owner":"acme","repo":"app","pull_number":482,
"event":"COMMENT",
"body":"Overall LGTM with 2 blocking notes.",
"comments":[
{"path":"src/auth.ts","line":42,"body":"Missing null check on session"},
{"path":"src/auth.ts","line":88,"body":"Token TTL is hardcoded; move to config"}
]
}'
CI Auto-Fix Loop
- Find the red run:
composio execute GITHUB_LIST_WORKFLOW_RUNS_FOR_A_REPOSITORY \
-d '{"owner":"acme","repo":"app","branch":"feat/billing","status":"failure"}'
- Pull logs:
composio execute GITHUB_DOWNLOAD_WORKFLOW_RUN_LOGS \
-d '{"owner":"acme","repo":"app","run_id":123456}'
- Parse failure → patch locally (the agent writes the fix into the working tree).
- Commit + push via local
git, then re-poll step 1 untilconclusion=success. - Post a PR comment describing each fix commit so the human reviewer sees what changed.
One-Shot Workflow File
Save as scripts/review-and-fix.ts and run with composio run --file ./scripts/review-and-fix.ts -- --pr 482:
const pr = process.argv.includes("--pr")
? Number(process.argv[process.argv.indexOf("--pr") + 1])
: null;
const meta = await execute("GITHUB_GET_A_PULL_REQUEST", {
owner: "acme", repo: "app", pull_number: pr
});
const files = await execute("GITHUB_LIST_PULL_REQUESTS_FILES", {
owner: "acme", repo: "app", pull_number: pr
});
console.log(JSON.stringify({ meta, files }, null, 2));
GitLab Variant
Swap slugs and param names:
composio execute GITLAB_GET_SINGLE_MERGE_REQUEST \
-d '{"id":"acme/app","merge_request_iid":482}'
composio execute GITLAB_CREATE_NEW_MERGE_REQUEST_NOTE \
-d '{"id":"acme/app","merge_request_iid":482,"body":"CI fix pushed as commit deadbeef"}'
Troubleshooting
Connection required for github→composio link github- Unknown input shape →
composio execute <SLUG> --get-schema - Log download huge → stream via
composio proxyagainst the raw API andgreplocally - Rate limits → serialize calls or lower poll frequency; avoid
--parallelfor the same repo
Full CLI reference: docs.composio.dev/docs/cli
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。