<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. --> <!-- SPDX-License-Identifier: Apache-2.0 -->

Security Code Review

Review the changes in a GitHub PR for security. An issue input must identify one open linked PR. Report a verdict for each category.

Prerequisites

• gh (GitHub CLI) must be installed and authenticated.
• git must be available.
• Network access to clone repositories and fetch PR metadata.

Step 1: Parse the GitHub URL

If the user gives a PR or issue URL, extract the owner, repository, and number. Otherwise, ask for the URL.

Supported URL formats:

• https://github.com/OWNER/REPO/pull/NUMBER
• https://github.com/OWNER/REPO/issues/NUMBER

For a PR URL, verify the number before Step 2:

gh pr view <number> --repo OWNER/REPO --json number,url

For an issue URL, list its open closing PRs:

gh issue view <number> --repo OWNER/REPO --json closedByPullRequestsReferences \
  --jq '.closedByPullRequestsReferences | map(select(.state == "OPEN")) | .[].number'

Continue only when this returns one PR number, and verify that number with gh pr view. If it returns zero or more than one, stop and ask for the PR URL. Use the verified PR number in each later command.

Step 2: Check Out the Code

Compare gh repo view --json nameWithOwner -q .nameWithOwner with the URL. If the repositories match, check out the verified PR:

gh pr checkout <number>

If the repositories do not match, clone the target to a temporary directory:

REVIEW_DIR=$(mktemp -d)
gh repo clone OWNER/REPO "$REVIEW_DIR"
cd "$REVIEW_DIR"
gh pr checkout <number>

Step 3: Identify Changed Files

List all files changed from the base branch:

git diff main...HEAD --name-status

If the PR targets another branch, use that branch as the base. Check it with:

gh pr view <number> --json baseRefName -q .baseRefName

Step 4: Read Each Changed File and Diff