PR Review Feature (/review)

Relevant source files

The following files were used as context for generating this wiki page:

• app/review/page.tsx
• app/api/review/route.ts
• app/api/prs/route.ts
• app/api/merge/route.ts
• components/PRCard.tsx
• README.md

The PR Review Feature is a specialized module within the GeNCorE Command Center designed to manage, evaluate, and finalize GitHub Pull Requests (PRs). It provides a mobile-optimized interface for developers to view active PRs, approve them, request changes with mandatory comments, or perform merges using the GitHub REST API.

This feature serves as a remote control for repository maintenance, allowing users to handle the final stages of the development lifecycle—specifically reviewing code generated by AI agents like Claude, Copilot, or Codex—without needing to navigate the full GitHub web interface.
Sources: README.md:12, app/review/page.tsx:162-164

Architecture and Data Flow

The review system follows a client-server architecture using Next.js App Router. The frontend (/review page) interacts with several backend API routes that proxy requests to the GitHub API using a server-side GITHUB_TOKEN. This ensures that sensitive credentials never reach the client side.
Sources: README.md:79, app/api/review/route.ts:5-15

Review Lifecycle Flow

The following diagram illustrates the lifecycle of a PR review action, from the user interface interaction to the GitHub API execution.

The flow ensures that any action taken on the UI is validated on the server before being dispatched to GitHub.
Sources: app/review/page.tsx:43-138, app/api/review/route.ts:40-75

Key Components

Review Page (app/review/page.tsx)

This is the main entry point for the feature. It manages state for the list of PRs (prs), loading indicators (loading, actionLoading), and the results of review operations (result).

• fetchPRs: An asynchronous function that retrieves open PRs from the internal /api/prs endpoint.
• handleApprove: Triggers a POST request to /api/review with the APPROVE event.
• handleRequestChanges: Prompts the user for a mandatory comment before triggering a REQUEST_CHANGES event.
• handleMerge: Executes a squash merge via the /api/merge endpoint after user confirmation.
  Sources: app/review/page.tsx:18-138

PR Card Component (components/PRCard.tsx)

A reusable UI component that displays PR metadata (title, number, branch, labels) and conditional action buttons.

• Conditional Rendering: Action buttons (Approve, Zmiany, Merge) are only displayed if the PR is not a draft and its state is 'open'.
• Agent Detection: Uses detectAgentFromPR to identify if the PR was created by a specific AI agent, applying thematic colors (e.g., purple for Copilot).
  Sources: components/PRCard.tsx:45-92

API Implementation

The review feature relies on three primary API endpoints to communicate with GitHub.

API Endpoints Summary

Endpoint	Method	Purpose	Key Parameters
/api/prs	GET	Fetches the latest 20 open PRs.	None
/api/review	POST	Submits a review (Approve/Request Changes).	prNumber, event, body
/api/merge	POST	Finalizes a PR into the base branch.	prNumber, mergeMethod
Sources: README.md:20-24, app/api/review/route.ts:18-35, app/api/merge/route.ts:18-38

Review Logic (app/api/review/route.ts)

The review route implements strict validation logic:

1. Security Validation: Ensures prNumber is a safe integer (between 1 and 2,147,483,647) to prevent SSRF.
2. Event Validation: Only APPROVE, REQUEST_CHANGES, and COMMENT are allowed.
3. Mandatory Comments: If the event is not APPROVE, the body field must contain non-empty text.
   Sources: app/api/review/route.ts:31-50

// Example validation logic for reviews
const { prNumber, event = 'APPROVE', body: reviewBody = '' } = body;

if (event !== 'APPROVE' && !reviewBody.trim()) {
  return NextResponse.json(
    { error: 'Komentarz jest wymagany dla REQUEST_CHANGES i COMMENT' },
    { status: 400 }
  );
}

Sources: app/api/review/route.ts:46-51

Sequence of a PR Merge

When a user decides to merge a PR, the system performs a sequence of checks and network calls to ensure data integrity and user intent.

Configuration and Security

The feature's behavior is dictated by environment variables and security middleware:

• Repository Targets: Controlled by NEXT_PUBLIC_REPO_OWNER and NEXT_PUBLIC_REPO_NAME.
• Authentication: Every request to the review APIs is intercepted by middleware.ts, which verifies the auth cookie (a HMAC-SHA256 hash of the ADMIN_TOKEN).
• GitHub Token: The GITHUB_TOKEN is strictly server-side, used in the Authorization header of fetch calls to GitHub.
  Sources: app/api/review/route.ts:3-10, middleware.ts:47-58, README.md:79-82

Conclusion

The PR Review feature (/review) provides a robust, secure, and mobile-friendly interface for managing GitHub Pull Requests. By abstracting the GitHub API through Next.js server routes and enforcing strict validation for PR numbers and mandatory comments, it ensures that repository maintenance tasks can be performed safely and efficiently from any device.