/review-git

allowed-tools: Read, Bash(git:*), Bash(rg:*), Bash(fd:*), Bash(gdate:*), Bash(jq:*), Bash(bat:*)
name: "Review Git"
description: "Comprehensive automated git repository review with security analysis and quality assessment"
author: "wcygan"
tags: ["git","review"]
version: "1.0.0"
created_at: "2025-07-14T00:00:00Z"
updated_at: "2025-07-14T00:00:00Z"

Context

• Session ID: !`gdate +%s%N`
• Current repository status: !`git status --porcelain`
• Current branch: !`git branch --show-current`
• Recent commits: !`git log --oneline -5`
• Staged changes summary: !`git diff --staged --name-only | head -10 || echo "No staged changes"`
• Unstaged changes summary: !`git diff --name-only | head -10 || echo "No unstaged changes"`
• Last commit details: !`git log -1 --stat --pretty=format:"%h %s (%an, %cr)" || echo "No commits found"`
• Modified file types: !`git status --porcelain | awk '{print $2}' | sed 's/.*\.//' | sort | uniq -c | head -5 || echo "No changes detected"`
• Repository size context: !`git log --oneline | wc -l | tr -d ' '` commits, !`fd . -t f | wc -l | tr -d ' '` files

Your Task

STEP 1: Initialize comprehensive repository review session

• CREATE review session state: `/tmp/git-review-session-$SESSION_ID.json`
• ANALYZE repository context from dynamic git status and change summary
• DETERMINE review scope (staged, unstaged, recent commits, or specific target)
• LOG session initialization with timestamp and repository metadata

TRY:

{
  "sessionId": "$SESSION_ID",
  "timestamp": "$(gdate -Iseconds 2>/dev/null || date -Iseconds)",
  "repository": "$(basename $(git rev-parse --show-toplevel))",
  "branch": "$(git branch --show-current)",
  "reviewScope": "auto-detect",
  "changesDetected": {
    "staged": "$(git diff --staged --name-only | wc -l | tr -d ' ')",
    "unstaged": "$(git diff --name-only | wc -l | tr -d ' ')",
    "untracked": "$(git ls-files --others --exclude-standard | wc -l | tr -d ' ')"
  }
}

CATCH (git_access_failed):

• LOG error details to session state
• PROVIDE guidance for repository access issues
• CONTINUE with available analysis

STEP 2: Comprehensive change analysis with automated context gathering

**Current Changes Deep Analysis:**

FOR EACH change category:

• **Staged Changes Analysis**:

  if [ "$(git diff --staged --name-only | wc -l | tr -d ' ')" -gt 0 ]; then
    echo "📋 Analyzing staged changes..."
    git diff --staged --stat
    echo "🔍 Detailed staged diff available for review"
  fi

• **Unstaged Changes Analysis**:

  if [ "$(git diff --name-only | wc -l | tr -d ' ')" -gt 0 ]; then
    echo "⚠️  Analyzing unstaged changes..."
    git diff --stat
    echo "🔍 Detailed unstaged diff available for review"
  fi

• **Recent Commit Analysis**:

  echo "📅 Recent commit analysis..."
  git log -3 --pretty=format:"%h %s (%an, %cr)" --stat
  echo "🔍 Last 3 commits analyzed for patterns and quality"

STEP 3: Advanced security analysis with automated pattern detection

TRY:

**Automated Security Scanning:**

echo "🔒 Performing automated security analysis..."

# Credential and API key detection
echo "  🔑 Scanning for exposed credentials..."
rg -i "(api[_-]?key|secret|password|token|credential)" . --type-not=lock --type-not=log -C 1 || echo "    ✅ No obvious credential exposures found"

# Hardcoded sensitive patterns
echo "  🔐 Checking for hardcoded sensitive data..."
rg "(BEGIN\s+(?:RSA\s+)?(?:PRIVATE\s+)?KEY|ssh-rsa|ssh-ed25519)" . --type-not=lock -C 1 || echo "    ✅ No hardcoded keys detected"

# Database connection strings
echo "  🗄️  Scanning for exposed database connections..."
rg "(mongodb://|postgres://|mysql://|redis://)" . --type-not=lock -C 1 || echo "    ✅ No exposed database URLs found"

# Environment variable leaks
echo "  🌍 Checking for environment variable exposures..."
rg "process\.env\.[A-Z_]+" . --type js --type ts -C 1 || echo "    ℹ️  No JavaScript env var usage detected"

# Shell injection vulnerabilities
echo "  💉 Analyzing shell injection risks..."
rg "(\$\{[^}]+\}|\$[A-Z_]+)" . --type sh --type bash -C 1 || echo "    ✅ No shell variable substitution risks found"

**Project-Specific Security Checks:**

• **Dotfiles Security**: Verify no personal credentials in shell configs
• **Script Security**: Check shell script quoting and escaping patterns
• **Permission Validation**: Ensure executable scripts have appropriate permissions

CATCH (security_scan_failed):

• LOG scan failures to session state
• PROVIDE manual security checklist
• CONTINUE with other review aspects

STEP 4: Automated code quality assessment with CLAUDE.md compliance

**Think hard about code quality implications and architectural decisions in the changes.**

**Modern CLI Tool Usage Validation:**

echo "🛠️  Validating modern tool preferences..."

# Check for legacy tool usage (per CLAUDE.md requirements)
echo "  ⚠️  Scanning for deprecated tool usage..."
rg "\b(grep|find|cat|ls|df|top)\b" . --type sh --type bash -C 1 || echo "    ✅ No legacy tool usage detected"

# Verify modern alternatives are used
echo "  ✅ Checking for modern tool adoption..."
rg "\b(rg|fd|bat|eza|jq|yq|delta|zoxide)\b" . --type sh --type bash -C 1 || echo "    ℹ️  Consider adopting modern CLI tools"

**Deno Best Practices Validation:**

echo "🦕 Validating Deno project compliance..."

# Check for JSR imports (preferred over deno.land)
if [ -f "deno.json" ] || fd "\.ts$" . >/dev/null; then
  echo "  📦 Analyzing import patterns..."
  rg "from ['\"]https://deno\.land" . --type ts || echo "    ✅ No legacy deno.land imports found"
  rg "jsr:@std/" . --type json --type ts || echo "    💡 Consider migrating to JSR imports"
fi

# Validate deno.json task structure
if [ -f "deno.json" ]; then
  echo "  📋 Validating task definitions..."
  jq '.tasks // {} | keys[]' deno.json 2>/dev/null | head -5 || echo "    ⚠️  No tasks defined in deno.json"
fi

**Error Handling and Code Structure:**

• ANA