feat: adopt DWP ai-diff-reviewer addon — three-way vendored skills + Cursor-based pr-review workflow - #45
Merged
Merged
Conversation
Adds the third vendored skill to '.agents/skills/' alongside deepworkplan and dailybot: '.agents/skills/ai-diff-reviewer/' (9 files: root SKILL.md, prompt.md, and 4 sub-skill trees — apply-review, generate-extension, open-pr, setup) from 'DailybotHQ/ai-diff-reviewer@v1.7.0'. Installed non-interactively with 'npx --yes skills add ... --force -y' (both flags required to keep the invocation reproducible in CI — see upstream v1.7.0 CHANGELOG for the fix that codified this pattern). skills-lock.json now carries three pinned entries: deepworkplan, dailybot, ai-diff-reviewer. CLI security scan reported the skill as Safe / 0 alerts / Low Risk across Gen, Socket, and Snyk. This install is the local half of the byte-identical local↔CI parity guarantee for this website's own code review: subsequent tasks in the same plan add '.review/extension.md' (task 8), the 'pr-review.yml' workflow (task 9), and extend Step 1a of 'release_and_publish.yml' to auto-refresh this vendored skill alongside deepworkplan and dailybot on every release (task 10). Co-authored-by: Cursor <cursoragent@cursor.com>
Adds the layered override that the vendored ai-diff-reviewer skill reads
locally (today, Flow A) and the pr-review.yml workflow will read at CI
time (once Task 9 lands, Flow B) — byte-identical local <-> CI parity
because upstream's prompt.md is identical to the CI Action's shipped
prompts/default.md at the same tag.
The file is 214 lines with four sections, all code-anchored to this
website's actual conventions:
- Severity overrides — mapped from AGENTS.md's mandatory-rules sections
and the DON'T list.
* critical: reintroducing PUBLIC_GOOGLE_SITE_VERIFICATION or google-
site-verification meta (analytics policy §10); reintroducing any
removed surface (blog / slides / cv / portfolio / dailybot / foodie /
hobbies / trading / entrepreneur — DON'T #18); adding a top-level
page without updating KNOWN_BASE_PATHS in src/middleware.ts
(DON'T #19 — the '[404] (rewrite)' symptom is the tell); non-English
slugs in content collections (DON'T #17); placeholder content in
src/content/** (DON'T #16 zero-tolerance); role='menu' on nav
dropdowns (DON'T #9); missing translations across 17 languages
(i18n:check gate); hardcoded translatable text (DON'T #4);
MainLayout imported in a page wrapper (DON'T #3 + Page Wrapper
Pattern); MainLayout used on internal/** or InternalLayout used on
public/** (DON'T #12); public page linking to /internal/
(DON'T #14).
* warning: text-gray-400/500 or dark variants for body text (§9.2
WCAG AA); <img> missing width/height (§9.3); skipped heading level
(DON'T #10); interactive logic inside .astro files (DON'T #1);
Svelte island missing client:* directive (DON'T #2); client:load
where client:visible/idle would suffice (DON'T #6); hardcoded UI
text (DON'T #4); non-English content missing diacritics/full-width
punctuation (DON'T #15); multilingual variants added to internal
pages (DON'T #13); meta description outside 130-160 chars.
* info: import order breaks (§3); missing alt='' on decorative
images / aria-label on icon-only links (DON'T #11 — informational
because the reviewer often can't tell decorative vs informative
from context).
- Don't comment on — .dwp/**, tmp/**, .agents/skills/**, .claude/**,
.cursor/**, src/content/pages/<lang>/*.md formatting nitpicks,
AGENTS.md/docs/** line length, text-gray-400/500 for icons/decoration
(only body text is a warning).
- Repo-specific context — Astro SSG + Svelte islands, 17 active
languages hard-synced, Page Wrapper Pattern (three files per page),
Broadsheet editorial voice, two-pillar positioning (SDD + harness
engineering), DWP name vendor-neutrality, agent-friendly Markdown
mirrors, Biome-only lint/format.
- PR hygiene — Conventional Commits, new-page four-file check,
i18n:check + md:check gates, vendored-skill hand-edit sniff,
extension.md self-change intentionality.
Co-authored-by: Cursor <cursoragent@cursor.com>
Adds .github/workflows/pr-review.yml for the website — the CI-side AI
review powered by DailybotHQ/ai-diff-reviewer@v1 (marketplace: 'AI Diff
Reviewer'), reading the same .review/extension.md that Task 8 authored
for the locally-vendored skill. Byte-identical local <-> CI parity via
the upstream skill's prompt-sync invariant (prompt.md ≡ prompts/default.md
at the same tag).
Structurally identical to the sibling workflow in the deepworkplan-skill
repo (same tag: chore(review) 0e3b43c). The only adaptation is the
header comment naming the DWP website rather than the skill repo — every
config value, job body, and gate contract is a byte-for-byte match with
the skill-repo workflow.
Four coordinated jobs:
- scope — three-tier gate: (a) author-association ∈ {OWNER, MEMBER,
COLLABORATOR} (cheapest, cannot be spoofed); (b) ready label present
(case-insensitive); (c) CURSOR_API_KEY configured. Emits should_run
+ empty_reason for downstream.
- labels-bootstrap — idempotent 'gh label create' for ready and
pr-reviewed; only runs when should_run=true.
- review — checks out with fetch-depth: 0 (branch diff needs base ref)
and persist-credentials: false (Cursor CLI has broad local access;
persisted token = exfil surface). Invokes the Action with:
provider: cursor
model: auto
label-gate: ready
author-association: OWNER,MEMBER,COLLABORATOR
applied-label: pr-reviewed
strictness: block-on-critical
prompt-extension-file: .review/extension.md
max-inline-comments: 15
- gate — stable-named 'AI review gate' (single-quoted YAML string).
This is the ONLY job to mark as required in branch protection.
SKIPS on no-ready-label or author-association mismatch (skipped
required checks pass in GitHub). FAILS loud on no-provider-secret
or review-leg failure.
Trigger discipline: pull_request only, types [opened, labeled],
NOT synchronize — push does not re-review; toggle the ready label
to re-run.
Post-CI walkthrough: after this workflow posts its review, developers
may invoke the vendored skill's apply-review sub-skill locally to walk
through findings per-finding (apply / defer / skip). Read-only by
default; edits require per-finding consent; never commits or pushes.
Not pushed yet — plan pushes the branch after Task 10 + Task 11 land.
Co-authored-by: Cursor <cursoragent@cursor.com>
…ailybot on every release
Extends Step 1a of release_and_publish.yml to keep the third vendored
skill ('.agents/skills/ai-diff-reviewer/', installed via task 7) in
lockstep with each website release. Every commit that touches Step 1a
preserves the same non-interactive contract on 'npx skills add' —
BOTH '--yes' (npm's proceed prompt) AND '-y' (the skills CLI's agent-
picker prompt) — as codified by upstream ai-diff-reviewer v1.7.0's
own auto-release fix.
Seven mechanical additions:
- resolve() call → AIDR_TAG (DailybotHQ/ai-diff-reviewer)
- read_version() call → AIDR_CUR (.agents/skills/ai-diff-reviewer/SKILL.md)
- moved-flag → AIDR_MOVED
- install branch → install_and_verify DailybotHQ/ai-diff-reviewer …
- 'git add' list → .agents/skills/ai-diff-reviewer/
- commit-message builder → parts+=("ai-diff-reviewer ${AIDR_TAG}")
- step summary tables (BOTH the no-op branch AND the commit branch) →
a third row for ai-diff-reviewer with Vendored / Latest / Moved columns
Header comment updated: 'two vendored skills' → 'three vendored skills';
'deepworkplan and dailybot' → 'deepworkplan, dailybot, and
ai-diff-reviewer'; 'Both skills already at latest' → 'All three skills
already at latest'.
Verified end-to-end via /tmp/dogfood.sh — a 10-scenario harness of the
selective commit-subject builder (S1–S10 covering every combination of
{none/dwp/db/aidr/dwp+db/dwp+aidr/db+aidr/all-three} moved, plus the
'unresolved / API blip' no-op paths). All 10 scenarios produced the
expected subject string (S1/S9/S10 → empty → no-op path; S2/S3/S4 →
one skill; S5/S6/S7 → two skills separated by ', '; S8 → three skills
separated by ', ').
YAML validated with pyyaml (no structural regression).
Not pushed yet — task 11 (docs) is the final commit before the plan
pushes the branch.
Co-authored-by: Cursor <cursoragent@cursor.com>
Extend AGENTS.md's "Vendored agent skills — refreshed on every website
release" section to cover ai-diff-reviewer alongside deepworkplan and
dailybot, and document the new pr-review.yml workflow under a
"PR review workflow — Cursor-based, ready-label gated" section:
- Marketplace naming ("AI Diff Reviewer" / DailybotHQ/ai-diff-reviewer)
- Trigger, jobs, and branch-protection integration (AI review gate)
- CURSOR_API_KEY secret setup
- ready / pr-reviewed label semantics
- Local <-> CI <-> apply-review three-moment loop
- Shared .review/extension.md as the single override file
Extend .github/docs/WORKFLOWS.md with a new "6. pr-review.yml" section
mirroring the existing per-workflow docs style (Jobs, Gate semantics,
Failure modes, Trigger discipline, Shared with the local skill), and
update the Dogfood step, Workflow Dependencies diagram, and External
Actions table to reflect three vendored skills.
No .claude/ or .cursor/ paths introduced.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add "CI Secrets (GitHub Actions)" subsection to docs/SECURITY.md documenting the CURSOR_API_KEY and AUTOMATION_GITHUB_TOKEN secrets consumed by pr-review.yml and release_and_publish.yml, plus the minimal-permission posture of pr-review.yml (persist-credentials: false on checkout, on: pull_request rather than pull_request_target, three-tier scope gate short-circuiting before any diff fetch from external contributors). Companion to the plan Security Review report at .dwp/plans/PLAN_add_ai_diff_reviewer_addon/analysis_results/SECURITY_REVIEW.md (gitignored working state) — verdict: CLEAN. Zero critical findings, zero warnings, six info-level positives across 18 systematic checks in both working trees (website + skill repo). Co-authored-by: Cursor <cursoragent@cursor.com>
Mandatory second-to-last task of PLAN_add_ai_diff_reviewer_addon. Verdict: zero new skills or agents authored — four candidate patterns evaluated (install-and-verify-vendored-skill, add-pr-review-workflow, author-DWP-addon, extend-dogfood-refresh); each either (a) already covered by an upstream skill's existing sub-skill (setup for the pr-review workflow), (b) adequately documented in the addon README that Task 1 references, or (c) too repo-specific to hoist. Two cross-repo recommendations recorded for a follow-up plan in the skill repo (not executed here): - Lift install_and_verify() into skills/deepworkplan/shared/ - Codify additive-augmentation of mandatory final tasks in addons/README.md Full analysis at .dwp/plans/PLAN_add_ai_diff_reviewer_addon/analysis_results/SKILLS_DISCOVERY.md (gitignored working state — empty commit preserves the audit trail). Co-authored-by: Cursor <cursoragent@cursor.com>
Final mandatory task of PLAN_add_ai_diff_reviewer_addon (14/14 complete). Wrote the stakeholder-readable Executive Report at .dwp/plans/PLAN_add_ai_diff_reviewer_addon/analysis_results/EXECUTIVE_REPORT.md (gitignored working state) with all six required sections: Executive Summary, Product Impact (four stakeholder groups), Technical Details (artifact-by-artifact list with commit hashes for both trees), QA Verification Guide (8 test scenarios), FAQs (8 questions), Next Steps (6 recommendations). Plan outcome: the DailybotHQ/ai-diff-reviewer skill (v1.7.0) is now a first-class opt-in DWP addon with two supported adoption flows (local-only and dual-surface); both the deepworkplan-skill repo and this website vendor three skills (deepworkplan + dailybot + ai-diff-reviewer) refreshed at release time; both repos ship an identically-configured Cursor-based pr-review.yml gated on the `ready` label and write-tier author-association with AI review gate as the stable branch-protection anchor; documentation synchronized across AGENTS.md, .github/docs/WORKFLOWS.md, and docs/SECURITY.md in both trees; Security Review verdict CLEAN with 18 systematic checks passing. Empty commit preserves the audit trail; the report itself is gitignored plan working state. Co-authored-by: Cursor <cursoragent@cursor.com>
Pin Action and vendored skill to v2.0.0, enable skip-ai-review emergency bypass, document labels/IAR in AGENTS and WORKFLOWS, and keep the skills.sh trust overrides in .review/extension.md. Co-authored-by: Cursor <cursoragent@cursor.com>
This comment has been minimized.
This comment has been minimized.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Reinstall the published skill pack so this branch vendors the fifth addon, SR wiring, and lockfile pin; soften local↔CI finding-parity docs for IAR. Co-authored-by: Cursor <cursoragent@cursor.com>
xergioalex
added
Ready
AI review for
|
There was a problem hiding this comment.
Verdict
Solid Flow B adoption — workflow gating, dogfood --yes/-y, and trust overrides look sound; two documentation/ops warnings should be fixed before treating local↔CI parity and secret failure modes as accurate.
Findings
| # | Severity | File | Summary |
|---|---|---|---|
| 1 | docs/SECURITY.md:234 |
AUTOMATION_GITHUB_TOKEN does not fall back to GITHUB_TOKEN |
|
| 2 | .github/workflows/pr-review.yml:167 |
Floating @v2 Action vs vendored skill 2.0.0 breaks the byte-identical local↔CI claim |
|
| 3 | ℹ️ info | .github/workflows/pr-review.yml:24 |
Stale “absent from the matrix” comment (no matrix job) |
1. docs/SECURITY.md:234 — ⚠️ warning
The new CI-secrets table says an absent AUTOMATION_GITHUB_TOKEN “Falls back to GITHUB_TOKEN”. release_and_publish.yml always passes token: ${{ secrets.AUTOMATION_GITHUB_TOKEN }} into actions/checkout@v4 with no || / conditional — an unset secret becomes '', which is not the omitted-input default of ${{ github.token }}. Maintainers reading this table will mis-diagnose a missing PAT.
2. .github/workflows/pr-review.yml:167 — ⚠️ warning
CI pins the moving major DailybotHQ/ai-diff-reviewer@v2 while skills-lock.json / .agents/skills/ai-diff-reviewer/SKILL.md freeze the local companion at 2.0.0. AGENTS.md and WORKFLOWS.md market byte-identical local↔CI prompt parity; that only holds until upstream cuts the next v2.x and CI advances before the next website dogfood. Pin @v2.0.0 (advance with dogfood) or soften the parity wording to admit the drift window.
3. .github/workflows/pr-review.yml:24 — ℹ️ info
Header comment still says the review job is “absent from the matrix” when CURSOR_API_KEY is missing. This workflow has a single review job that is skipped — not a matrix exclusion.
Notes (no inline anchor)
- Vendored trees under
.agents/skills/**were out of scope per.review/extension.md(release-managed dogfood copies). Spot-checked install paths: Step 1a keeps bothnpx --yesand-y; nopull_request_target/ head_ref checkout; PR content for the scope script is correctly routed throughenv:. - Gate semantics (skip on no-ready / author-association; fail loud on missing
CURSOR_API_KEY;skip-ai-reviewshort-circuit) match the documented branch-protection story — still pair the requiredAI review gatecheck with a ruleset onskip-ai-reviewbefore relying on it as a merge gate. .review/extension.mdis a strong, AGENTS.md-anchored override set (17-lang, trust/pipe bans, middleware allowlist, WCAG).
Recommendation: request-changes
| | Secret | Required by | Purpose | Failure mode when absent | | ||
| |--------|-------------|---------|---------------------------| | ||
| | `CURSOR_API_KEY` | `pr-review.yml` | Authenticates the [`DailybotHQ/ai-diff-reviewer`](https://github.com/marketplace/actions/ai-diff-reviewer) Action against Cursor's review provider | The `AI review gate` job fails loud with an actionable message ("`CURSOR_API_KEY` is not configured on this repo") | | ||
| | `AUTOMATION_GITHUB_TOKEN` (optional) | `release_and_publish.yml` | Bot user PAT so the release commit + tag can push to protected `main` | Falls back to `GITHUB_TOKEN`, which will fail at the push step unless `github-actions[bot]` is in the branch-protection bypass list | |
There was a problem hiding this comment.
Incorrect failure-mode claim: an unset AUTOMATION_GITHUB_TOKEN does not fall back to GITHUB_TOKEN.
release_and_publish.yml always passes token: ${{ secrets.AUTOMATION_GITHUB_TOKEN }} into actions/checkout@v4. When the secret is missing, that expression is '' — which is not the same as omitting token (the default ${{ github.token }}). Checkout/push will fail with an empty token, not silently use GITHUB_TOKEN.
Suggest replacing the Failure-mode cell with something like: "Checkout/push fail until the PAT is set (or until github-actions[bot] is allowed to push with an explicit token: ${{ github.token }} change)."
| # with broad local access; a persisted token on disk is an exfil | ||
| # surface. The reviewer talks to the GitHub API in-process. | ||
| persist-credentials: false | ||
| - uses: DailybotHQ/ai-diff-reviewer@v2 |
There was a problem hiding this comment.
Local↔CI parity drift: this workflow tracks the moving major @v2, but the vendored skill is frozen at version: "2.0.0" (see .agents/skills/ai-diff-reviewer/SKILL.md + skills-lock.json).
AGENTS.md / WORKFLOWS.md state that local prompt.md is byte-identical to the Action's prompts/default.md and that a local pre-push review shares the same methodology as CI. That holds only while both surfaces sit on the same release; the next upstream v2.x tag lets CI advance immediately while the dogfooded skill stays put until the next website release.
Either pin the Action to the vendored skill tag:
Suggested change
| - uses: DailybotHQ/ai-diff-reviewer@v2 | |
| - uses: DailybotHQ/ai-diff-reviewer@v2.0.0 |
and bump both together on dogfood, or soften the AGENTS/WORKFLOWS parity wording to document the intentional drift window.
| # | ||
| # Secrets required (repo settings > Secrets): | ||
| # * CURSOR_API_KEY — Cursor subscription key (unlimited on Pro). | ||
| # Without it the review job is absent from the matrix and the merge gate |
There was a problem hiding this comment.
Stale wording: there is no matrix here. When CURSOR_API_KEY is missing, the single review job is skipped via should_run=false / empty_reason=no-provider-secret, and the gate job fails loud — it is not “absent from the matrix”.
Minor comment cleanup so the header matches the four-job design (scope → labels-bootstrap → review → gate).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adopt the newly-authored AI Diff Reviewer DWP addon (upstream
DailybotHQ/ai-diff-reviewer@v1.7.0) end-to-end in this website:.agents/skills/ai-diff-reviewer/joins the two already-vendored copies (deepworkplan,dailybot). All three are pinned inskills-lock.jsonwith SHA-256 fingerprints..github/workflows/pr-review.ymlruns onpull_requesttomainfor authors with write-tierauthor-association, gated by thereadylabel, single Cursor provider (model: auto), and appliespr-reviewedon success.criticalfindings block merges;warning/infoare reported inline..review/extension.md(214 lines) codifying severity overrides + "don't comment on" scopes + repo-specific context anchored to this repo'sAGENTS.mdinvariants (17-language sync, WCAG AA text colors,KNOWN_BASE_PATHSmiddleware allowlist, noPUBLIC_GOOGLE_SITE_VERIFICATION, no removed surfaces reintroduced, Page Wrapper Pattern).release_and_publish.ymlStep 1a now refreshes all three vendored skills at every release cut (up from two). Same version-invariant +[skip release]marker pattern established in v1.0.75, plus the mandatory--yes+-ynon-interactive contract on everynpx skills addinvocation.AGENTS.mdgains "PR review workflow — Cursor-based, ready-label gated" alongside the extended three-skill "Vendored agent skills" section, and documents the Local ↔ CI ↔ apply-review three-moment loop..github/docs/WORKFLOWS.mdgets a new "6. pr-review.yml" section mirroring the existing per-workflow style.docs/SECURITY.mddocumentsCURSOR_API_KEYand the workflow's minimal-permission posture.Companion PR in the skill repo: DailybotHQ/deepworkplan-skill#feat/ai-diff-reviewer-addon — authors the addon that this website adopts. Once that PR merges and cuts a
deepworkplan-skillrelease, the next website release will automatically dogfood the new methodology via Step 1a.Adoption flow
The addon is opt-in and offers two supported adoption flows at consent time:
pr-review.yml(this PR) + optionalapply-reviewpost-CI walkthrough. Byte-identical prompt parity between the vendored skill and the CI Action.This PR adopts Flow B.
Required secret
Register
CURSOR_API_KEYin Settings > Secrets and variables > Actions before applying thereadylabel to any PR. Without it, theAI review gatejob fails loud with an actionable message.Branch protection
Mark ONLY the stable-named
AI review gatejob as a required status check. GitHub treats "skipped" required checks as passing, so PRs withoutready(or from external contributors) remain mergeable.Test plan
CURSOR_API_KEYin repo settings.readylabel to this PR — verify the four-job sequence:Decide review scope→Bootstrap review labels→AI review — cursor→AI review gate.pr-reviewedlabel is applied on green.AI review gateas green.readyoff then on — verify the workflow re-runs.main, verifyrelease_and_publish.ymlStep 1a exercises the three-way dogfood path.ai-diff-reviewerskill run on the branch before pushing yields the same verdict CI produced.Full plan artifacts
Executed via the DWP methodology (this repo's own installed skill). 14/14 tasks completed; plan working state at
.dwp/plans/PLAN_add_ai_diff_reviewer_addon/(gitignored) with Security Review verdict clean across 18 systematic checks.Made with Cursor