copilot-code-reviewer

Reviews LFX One pull requests for correctness, design, and security defects.

12|6|Updated Jul 14, 2025
One-click install
npx skills add https://github.com/linuxfoundation/lfx-self-serve --skill copilot-code-reviewer-linuxfoundation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: copilot-code-reviewer
Source: https://github.com/linuxfoundation/lfx-self-serve/tree/main/.github/skills/copilot-code-reviewer
Command: npx skills add https://github.com/linuxfoundation/lfx-self-serve --skill copilot-code-reviewer-linuxfoundation

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing pull requests on the LFX One Angular/Express monorepo requires deep knowledge of its BFF architecture, auth boundaries, and house standards, and generic reviewers produce noisy, low-confidence comments that waste author attention. ## Core Features & Use Cases - Architecture-aware review: Judges each change against the LFX One shape — the thin Express BFF, the microservice proxy contracts, the auth middleware route table, and the SSR/hydration boundary. - High-signal commenting: Comments only on changed lines with >=80% confidence, one comment per issue, and never duplicates what CI linting, type-checking, or formatting already enforce. - Delegated deep review: Applies the self-serve-code-review and self-serve-security-review skills for line-level grounding and security-surface analysis of auth, proxy, identity, and innerHTML changes. - Use Case: A PR adds a new proxy endpoint and loosens an auth route classification; the reviewer verifies the route change against auth.middleware.ts, flags the unwarranted public surface, and notes the unverified upstream contract instead of guessing. ## Quick Start Ask the reviewer to review this pull request for correctness, design, and security issues on the LFX One repository.

Frequently Asked Questions about copilot-code-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request on the LFX One repository?▼

Invoke the copilot-code-reviewer skill on the PR. It reads the diff in context, places the change against the BFF architecture and auth boundaries, and comments only on high-confidence defects in the changed lines.

What kinds of issues does this code reviewer flag?▼

It flags bugs, security issues, broken upstream contracts, and violations of documented repo standards such as Tailwind and PrimeNG wrapper conventions. It stays silent on formatting, linting, and anything CI already enforces.

Does the reviewer run builds, tests, or linters?▼

No. It reviews by reading code only and never executes builds, lint, or tests. Deterministic checks are left to CI, and the reviewer avoids duplicating anything the pipeline already catches.

Can it verify contracts owned by upstream microservices?▼

Only partially. Peer repos are not checked out, so when a finding depends on an unreadable upstream contract it notes the unverified dependency for the author to confirm rather than asserting a low-confidence defect.

What are the limitations of this PR review approach?▼

It produces judgment only: it never approves, merges, or edits code, and it comments only on lines changed in the diff. Pre-existing issues in untouched code are out of scope unless directly triggered by the PR.