Pr review note
the governed runtime for agent skill workflows, off the leash but on the record
npx -y skills add runxhq/runx --skill pr-review-noteAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
What its author says it does
Copied from the file, not written here
Govern one GitHub pull-request review comment through Runx Connect or the canonical MCP pattern, with exact approval, retry safety, and independent readback.
SKILL.md
2.9 KB, as published. Nobody here has run it
PR Review Note
Post one bounded review comment to one known GitHub pull request. The skill is deliberately narrower than a general GitHub operator: it binds approval to the exact repository, pull request, and comment body, executes through a declared provider boundary, and closes only when provider evidence identifies and reads back the created note.
Use it after a review workflow has produced final wording and the operator wants
that exact note posted. Use issue-triage for analysis and drafting, and a
broader GitHub skill for other resource types. This skill never merges a pull
request; comment authority cannot be promoted into merge authority.
Composes
<!-- Generated from the native execution closure; run pnpm core-skills:composes:generate. -->github-mcp-merge-pr#defaultgithub-mcp-pr-review-note#default
How it works
- Supply
owner/name, the exact pull-request number, exact comment body, and a stable idempotency key for that body. - The default
connect-commentrunner computes the body digest and asks for human approval bound to the repository, PR, and digest. - Native
provider.mutateposts underpr.comment; nativeprovider.readthen reads the returned comment ref underpr.read. Repository, PR number, comment ref, and body digest must match before completion. - The explicit
commentrunner preserves the bundledexamples/github-mcp-hero/review-notepath as the canonical MCP composition and deterministic harness surface. It is not live Connect evidence.
The separate merge-refused runner routes the same comment grant to the
bundled examples/github-mcp-hero/merge-pr denial fixture. It is an executable
authority test: a pr.merge request must seal as policy denied, never as a
backdoor merge path.
Stop conditions
- Stop when repository, pull-request number, body, or idempotency key is missing or changes after approval.
- Stop when approval is absent or denied.
- Refuse a provider grant that does not resolve uniquely to
pr.comment. - Refuse a missing, ambiguous, wrong-provider, or under-scoped GitHub Connect grant rather than falling back to a raw token or package HTTP client.
- Do not treat mutation acceptance without an independent comment read, stable comment ref, and matching body digest as final readback.
- Never merge, close, label, or otherwise mutate the pull request beyond the exact comment.
Example
An operator approves “Please add the missing recovery fixture” for PR 42. The skill posts exactly that body under the stable retry key and seals the returned comment id. Changing the body requires a new approval. Attempting to reuse the comment grant for merge is denied before GitHub mutation.