# Verify PR

Should be used to run a sandboxed deep verification of a qwen-code PR, "/verify-pr...

- Repository: https://github.com/QwenLM/qwen-code (28858 stars)
- Category: Design
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add QwenLM/qwen-code --skill verify-pr -g -a claude-code -y`
Codex: `npx skills add QwenLM/qwen-code --skill verify-pr -g -a codex -y`
Cursor: `npx skills add QwenLM/qwen-code --skill verify-pr -g -a cursor -y`
Gemini CLI: `npx skills add QwenLM/qwen-code --skill verify-pr -g -a gemini-cli -y`

## Description

This skill should be used to run a sandboxed deep verification of a qwen-code PR, "/verify-pr <n>", "/verify-pr <n> --publish" (local round that also posts the report comment), "深度验证这个 PR", "验证这个 PR 并把报告发到评论", "有更新了，重新验证", "重新验证 PR <n>", "re-verify after update", A/B load-bearing proof against the base build, mock-free harnesses with wire oracles, and targeted gates, producing tmp/pr<n>-verify-<ts>/report.md plus a machine-readable verdict. Designed for the token-free CI verify job; also usable locally.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# PR Deep Verification

Produce maintainer-grade behavioral evidence for one PR: prove the central
change is load-bearing with an A/B against the base build, exercise the changed
surface with mock-free harnesses, and report scripted pass/fail assertions, never impressions. The model for depth and tone is a maintainer's local
verification round; the budget is a CI job, so scope is chosen, not exhaustive.

## Start here

Two entry paths share the contract below.

- **Sandboxed lane**, comment `@qwen-code /verify` on the PR. The workflow
  supplies `$QWEN_VERIFY_CONTEXT`, an already-built tree and the time budget,
  and publishes the report. There is nothing to prepare.
- **Maintainer round on a workstation**, `/verify-pr <n>`, starting with
  `node scripts/verify-pr-prepare.mjs <n> --repo <owner>/<repo>` (the
  preflight requires the repository explicitly; `origin` is not a fallback).
  It writes the round's coordinates (`repo`, `pr`, `baseRefOid`, `headRefOid`)
  to `context.json` and refuses a tree that is not a clean checkout of the PR
  head, when it passes, the current tree is the head side of the A/B, so stay
  on the PR branch and keep it clean. The gate attests the source only:
  `dist/` and `node_modules/` are gitignored, so reuse the install and build
  only after establishing they were produced for this head, and otherwise
  refresh them (the local install strategy below).
  This round executes untrusted PR code, so it needs an isolation boundary
  (see _Local invocation_).

`/verify-pr <n>` proves the change and posts nothing. `--publish` adds the
report comment and its image evidence; `--watch` installs a standing trigger.
Before publishing a local round, run
`node scripts/verify-pr-check.mjs <artifact dir>`; it applies the consistency
rules the publisher enforces in CI.

## Environment contract (CI verify job)

The workflow (`qwen-triage.yml` `verify` job) guarantees:

The rest: https://github.com/QwenLM/qwen-code/blob/HEAD/.qwen/skills/verify-pr/SKILL.md