ci/opencode/ci/workflows/review.md

description

description
Review CI code changes with multi-persona analysis — auto-apply P0 fixes, flag P1+ for post-hoc review

CI Review

Multi-persona code review workflow. Reviews changes in the current phase, auto-applies P0 fixes, and flags P1+ issues for post-hoc review.

Usage: ci-review [phase_number]

Step 0: Confirm Active Project

Check ci listProjects() or read .ci/config.json to determine if multi-project mode is active.

If .ci/config.json has projects[] with length > 0:

• Confirm active_project is correct for this review
• If not, set it with ci setActiveProject(<slug>)
• All commit messages must include project: <slug> in ---ci--- block

If single-project mode: proceed with existing conventions.

Step 1: Load Changes

git log --grep="P##" --max-count=30
git diff phase/NN-slug...HEAD

Load all changes for the current or specified phase.

Step 2: Persona Reviews

For each persona (correctness, testing, security, performance, maintainability, adversarial):

Correctness

• Logic errors, off-by-ones, missing edge cases
• Incorrect data transformations
• Race conditions

Testing

• Missing test cases for new code
• Flaky test patterns
• Inadequate assertions

Security

• Input validation gaps
• Injection vectors
• Secret exposure
• Missing auth checks

Performance

• Unnecessary allocations
• O(n^2) patterns
• Missing caching opportunities

Maintainability

• Naming inconsistencies
• Coupling violations
• Missing error handling

Adversarial

• Attack surface expansion
• Abuse cases
• Trust boundary violations

Step 3: Classify and Fix

For each finding:

• P0 (blocking): Logic errors, security vulnerabilities, broken imports → auto-apply
• P1 (important): Coverage gaps, naming issues, missing edge cases → flag
• P2 (nit): Style, formatting, minor suggestions → flag

Step 4: Commit

verify(P##): code review — [N] P0 auto-fixed, [M] P1+ flagged

---ci---
phase: [N]
milestone: [vX.X]
status: verify
lessons:
  - [P0 fix: description]
---/ci---

Step 5: Return Result

Report findings by persona, P0 fixes applied, P1+ flags.