/review-workflow-phases-5-6

PR/MR Review: Workflow Phases 5-6

Phase 5 (test plan generation) and Phase 6 (PR description update) of the review workflow.

> **See Also**: > [Main Command](../../pr-review.md) | > [Workflow Index](review-workflow.md) | > [Phases 1-4](review-workflow-phases-1-4.md) | > [Enforcement](review-workflow-enforcement.md) | > [Framework](review-framework.md) | > [Configuration](review-configuration.md)

Phase 5: Test Plan Generation (MANDATORY)

**⚠️ ENFORCEMENT CHECK: This phase MUST complete with a `gh pr comment` call.** **If you skip this phase, the workflow is INCOMPLETE.**

After documenting review threads, generate a detailed test plan that `/fix-pr` can execute to verify fixes.

**CRITICAL REQUIREMENT:**

• The test plan MUST be posted as a **separate PR comment** using `gh pr comment`
• Do NOT just include the test plan in your conversational output
• Do NOT just include the test plan in the review summary
• The test plan comment enables `/fix-pr` to find and execute verification steps

13. **Generate Test Plan Document**

Create a structured test plan covering all blocking and in-scope issues:

    ## Test Plan for PR #42

    Generated from `/pr-review` on YYYY-MM-DD

    ### Prerequisites
    - [ ] All blocking issues (B1-BN) have been addressed
    - [ ] All in-scope issues (S1-SN) have been addressed
    - [ ] Code compiles without errors

    ---

    ### Blocking Issues Verification

    #### B1: Missing token validation
    **File:** `middleware/auth.py:45`
    **Issue:** Always returns True, validation not implemented

    **Verification Steps:**
    1. [ ] Review the fix at `middleware/auth.py:45`
    2. [ ] Run: `pytest tests/test_auth.py -k "token_validation" -v`
    3. [ ] Manual check: Attempt login with invalid token, verify rejection
    4. [ ] Verify error response includes appropriate message

    **Expected Outcome:**
    - Tests pass
    - Invalid tokens return 401 Unauthorized
    - No security regression

    ---

    #### B2: SQL injection vulnerability
    **File:** `models/user.py:123`
    **Issue:** String interpolation in query

    **Verification Steps:**
    1. [ ] Review the fix at `models/user.py:123`
    2. [ ] Run: `bandit -r models/ -ll`
    3. [ ] Run: `pytest tests/test_models.py -k "sql" -v`
    4. [ ] Manual check: Verify parameterized queries used

    **Expected Outcome:**
    - Bandit reports no high-severity SQL issues
    - All SQL queries use parameterized format
    - Tests pass

    ---

    ### In-Scope Issues Verification

    #### S1: Password reset flow missing
    **Requirement:** Users must be able to reset passwords

    **Verification Steps:**
    1. [ ] Verify endpoint exists: `rg "password.*reset" routes/` (or `grep -r`)
    2. [ ] Run: `pytest tests/test_auth.py -k "password_reset" -v`
    3. [ ] Manual check: Test password reset email flow

    **Expected Outcome:**
    - Password reset endpoint implemented
    - Email sending functionality works
    - Tests cover happy path and error cases

    ---

    ### Build & Quality Gates

    **Run these commands to verify overall quality:**

    ```bash
    # Full test suite
    make test

    # Linting and formatting
    make lint

    # Security scan
    make security-check

    # Build verification
    make build

**All must pass before PR approval.**

---

Summary Checklist

| Issue ID | File | Verified | Notes | |----------|------|----------|-------| | B1 | middleware/auth.py:45 | [ ] | | | B2 | models/user.py:123 | [ ] | | | S1 | routes/auth.py | [ ] | | | S2 | auth.py:78 | [ ] | |

**Ready for merge when all boxes checked.**

14. **Post Test Plan to PR (MANDATORY)**

    The test plan MUST be posted as a PR comment so `/fix-pr` can reference it:

    ```bash
    gh pr comment $PR_NUMBER --body "$(cat <<'EOF'
    ## Test Plan for PR #$PR_NUMBER

    Generated from `/pr-review` on $(date +%Y-%m-%d)

    ### Prerequisites
    - [ ] All blocking issues (B1-BN) have been addressed
    - [ ] All in-scope issues (S1-SN) have been addressed
    - [ ] Code compiles without errors

    ---

    ### Blocking Issues Verification

    #### B1: [Issue title]
    **File:** \`path/to/file.py:line\`
    **Issue:** [Description]

    **Verification Steps:**
    1. [ ] Review the fix at \`path/to/file.py:line\`
    2. [ ] Run: \`[specific test command]\`
    3. [ ] Manual check: [verification procedure]

    **Expected Outcome:**
    - [What success looks like]

    ---

    [Repeat for each blocking and in-scope issue]

    ---

    ### Build & Quality Gates

    **Run these commands to verify overall quality:**

    \`\`\`bash
    # Project-specific commands (detect from Makefile/pyproject.toml)
    make test && make lint && make build
    # OR
    uv run pytest && uv run ruff check . && uv run mypy src/
    \`\`\`

    **All must pass before PR approval.**

    ---

    ### Summary Checklist

    | Issue ID | File | Verified | Notes |
    |----------|------|----------|-------|
    | B1 | path/to/file.py:line | [ ] | |
    | B2 | path/to/file.py:line | [ ] | |
    | S1 | path/to/file.py:line | [ ] | |

    **Ready for merge when all boxes checked.**

    ---
    *Test plan generated by /pr-review - execute with /fix-pr*
    EOF
    )"

**Test Plan Posting Rules:**

• MUST be posted as a separate PR comment (not part of the review body)
• MUST include all blocking and in-scope issues
• MUST have specific verification commands for each issue
• SHOULD detect project's test/lint/build commands from Makefile or pyproject.toml
• Posted AFTER the review summary comment

15. **Confirm Test Plan Posted**

After posting, verify the comment was created:

    # Verify test plan comment exists
    gh api repos/{owner}/{repo}/issues/{pr_number}/comments \
      --jq '.[] | select(.body | contains("Test Plan for PR")) | .id' | head -1

    # If successful, output confirmation