360 Secure SkillHub
360 安全技能中心

PR Autocheck

封装 PR 提交后自动检查流水线：用 git diff 做确定性审查（含硬编码密钥、动态 eval、调试打印等规则），复用可选健康检查，汇总为带 overall 等级的 JSON 报告并保存副本，配置 webhook 时推送 Discord embed，未配置则保留载荷并退出码 3。

terrycarter1985
terrycarter1985
热度 16.00
最近更新 2026-06-20 15:49:26
分类：开发依赖：代码执行 / 读写文件 / 第三方 API应用场景：代码审查 / DevOps / 自动化脚本 / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add pr-autocheck
Metadata
name
pr-autocheck
description
Automated post-submit checks for an AI code-review platform. Use when a new pull request is submitted (or on demand) to run a code review, validate service health, combine both into one report, and sync the result to a team Discord channel via webhook. Triggers on requests like "run PR autocheck", "review this PR and post to Discord", "automate PR checks", or wiring a CI/post-submit hook.

PR Autocheck

End-to-end pipeline for a newly submitted PR: code review → service health → Discord sync. All steps are deterministic shell + jq; no gh required (falls back to git diff).

Quick start

Run from inside the target git repository:

bash scripts/run.sh --base origin/main --head HEAD --repo myrepo --pr 130

This prints the combined JSON report, saves a copy to reports/, and posts an embed to Discord when DISCORD_WEBHOOK_URL is set.

Configuration

Env Purpose Default
DISCORD_WEBHOOK_URL Discord channel webhook for delivery unset → payload saved to reports/, exit 3
HEALTHCHECK_CMD Override health command (must emit JSON) healthcheck skill healthcheck.sh --json
PR_AUTOCHECK_AI 1 allow optional AI deepening, 0 skip 1

Steps & scripts

  1. scripts/review.sh BASE HEAD — deterministic review of the diff. Flags hardcoded secrets, dynamic eval/exec, debug prints, TODO/FIXME, oversized diffs. Emits {status, files_changed, findings[], summary}.
  2. Service health — reuses the healthcheck skill (--json) when available, otherwise reports unknown instead of failing the pipeline.
  3. scripts/notify-discord.sh — builds a color-coded Discord embed from the combined report and POSTs it to the webhook. No webhook = no fake success: it saves the payload and exits 3 so callers can surface "delivery pending".

scripts/run.sh orchestrates all three and computes an overall severity (ok / warn / critical).

Wiring as a post-submit hook

Point your PR event (CI job, GitHub Action, or OpenClaw cron) at:

DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/..." \
  bash scripts/run.sh --base "$BASE_SHA" --head "$HEAD_SHA" --repo "$REPO" --pr "$PR_NUMBER"

Exit code is 0 (pipeline ran); inspect the JSON overall field and the discord_exit line on stderr to gate merges or alert.