code-review

Ask the agent to review the PR or diff; this Skill routes the request through risk ranking, pass/fail gates on build, tests, lint, secrets, and security, then test-quality judgement. The output is severity-ordered findings with item, location, evidence, impact, fix, and a merge recommendation.

A structured review should rank the diff by blast radius first, then run sequential gates: build, tests, lint, and secrets before layering, security, and contracts. Changed tests should be judged for vacuous assertions, and high-risk untested units should get named missing test cases.

Yes, GitHub Copilot code review reads agent skills from .github/skills/ on the head branch and favors skills whose name and description target review. Copilot always leaves a Comment review, never Approve or Request changes, so its verdict does not block merge.

Yes, stack-specific adjustment extensions ship for Python, TypeScript, React, .NET, and Azure and merge in at scaffold time based on detected stacks. Each extension adds stack rules such as fixture isolation for pytest, nullability and CancellationToken checks for C#, and unawaited promise findings for TypeScript.

The Skill falls back to doing each step inline at its cheapest form: diff stat plus git log for ranking, the checklist's Phase 1 gates verbatim, and naming every high-risk untested unit with its missing test case. It states which siblings were absent so the thinner review is explicit.