Review a pull request or analyze your own changes using workflow specialist
Reviews pull requests or analyzes local changes using specialized agents for security, testing, and accessibility.
/plugin marketplace add kanopi/cms-cultivator/plugin install cms-cultivator@claude-toolbox[pr-number|self] [focus-area]Spawn the workflow-specialist agent using:
Task(cms-cultivator:workflow-specialist:workflow-specialist,
prompt="Review changes comprehensively. Target: [first argument - PR number or 'self']. Focus area: [second argument if provided, otherwise 'all aspects']. Orchestrate specialists in parallel as needed (testing, security, accessibility). Provide detailed code review with actionable recommendations.")
Review someone else's PR:
/pr-review <pr-number> - Full review of PR by number/pr-review <pr-number> code - Focus on code quality only/pr-review <pr-number> security - Focus on security only/pr-review <pr-number> breaking - Focus on breaking changes onlyAnalyze your own changes (before creating PR):
/pr-review self - Analyze local changes (all aspects)/pr-review self size - Focus on size/complexity only/pr-review self breaking - Focus on breaking changes only/pr-review self testing - Focus on test plan onlyFocus options: code, security, breaking, testing, size, performance
This command spawns the workflow-specialist agent, which orchestrates a comprehensive code review process by:
PR Review Mode (/pr-review <pr-number>):
gh pr view, gh pr diff)gh pr reviewSelf-Review Mode (/pr-review self):
Code Quality:
Functionality:
Security:
Testing:
Size & Complexity:
Breaking Changes:
Dependencies:
composer audit, npm audit)Deployment:
Drupal Projects:
config/sync/)hook_update_N)WordPress Projects:
$wpdb->prepare())code)Only analyzes readability, maintainability, consistency, documentation, and naming. Skips security, size, and breaking changes.
security)Only analyzes input validation, SQL injection, XSS, authentication/authorization, and secrets. Skips code quality and size analysis.
breaking)Only analyzes API changes, database changes, dependency changes, and migration paths. Provides version bump recommendations.
testing)Only generates comprehensive test plan with functional, security, performance, and accessibility tests. Skips code review.
size)Only analyzes lines changed, files changed, size category, complexity assessment, and split recommendations.
performance)Only analyzes query optimization, asset sizes, page load times, caching strategies, and N+1 queries.
The workflow specialist generates structured reviews following this format:
# PR Review - [PR Title]
**PR**: #[number]
**Author**: [username]
**Size**: [XS/S/M/L/XL] ([X] files, +[Y]/-[Z] lines)
**Complexity**: [Low/Medium/High]
**Review Time Estimate**: [X] hours
---
## Summary
[Brief overall assessment]
## Strengths
- [What was done well]
---
## 📊 SIZE & COMPLEXITY ANALYSIS
**Category**: [XS/S/M/L/XL]
**Lines Changed**: +[X] -[Y]
**Files Changed**: [N]
**Mixed Concerns**: [✅ Single Focus | ⚠️ Mixed | ❌ Multiple Unrelated]
**Recommendation**: [Is PR review-ready? Should it be split?]
---
## ⚠️ BREAKING CHANGES
**Found**: [N] breaking changes
- [X] Critical
- [X] High
- [X] Medium
- [X] Low
[List with migration paths and version bump recommendations]
---
## Required Changes
These must be addressed before approval:
### Critical Issues
- [ ] **[Issue]** (path/to/file.php:123)
- Problem: [Specific problem]
- Suggestion: [How to fix]
### Security Concerns
- [ ] **[Security issue]** (path/to/file.php:456)
- Risk: [What could happen]
- Fix: [Recommended solution]
---
## Suggestions
These would improve the code but aren't blockers:
### Performance
- **[Suggestion]** (path/to/file.php:789)
### Code Quality
- **[Suggestion]** (path/to/file.php:101)
---
## ✅ TEST PLAN
### Test Environment Setup
- [ ] Pull latest code
- [ ] Install dependencies
- [ ] Run database updates
- [ ] Import config/sync ACF
### Functional Tests
[Specific test cases]
### Security Tests
[Authentication, input validation]
### Automated Tests
- [ ] `vendor/bin/phpunit`
- [ ] `npm run cypress:run`
- [ ] `composer phpstan`
- [ ] `composer phpcs`
### CMS-Specific Tests
[Drupal: drush cim, drush updb]
[WordPress: Permalinks, ACF, CPTs]
---
## Overall Recommendation
- [ ] **Approve** - Ready to merge
- [ ] **Request Changes** - Must address required changes first
- [ ] **Comment** - Feedback provided, author's discretion
Before reviewing, run Kanopi's quality checks:
# Drupal - Run all checks
ddev composer code-check # phpstan + rector + code-sniff
# WordPress - Run checks individually
ddev composer phpstan # Static analysis
ddev composer phpcs # Code standards
ddev composer rector-check # Modernization
# Both platforms - Check dependencies
ddev composer audit # PHP vulnerabilities
ddev exec npm audit # JavaScript vulnerabilities
# Quality checks
ddev composer code-check # Drupal
ddev composer phpstan # WordPress
ddev composer phpcs # WordPress
# Security checks
ddev composer audit
ddev exec npm audit
# End-to-end tests
ddev cypress-run
# Performance tests
ddev critical-run
The workflow specialist intelligently delegates to other specialists:
For PR Reviews:
security-specialisttesting-specialistaccessibility-specialistFor Self-Reviews:
The workflow specialist uses these categories to assess PR size:
Research shows:
The workflow specialist watches for:
/pr-create - Create PR after self-review/pr-commit-msg - Generate commit message/audit-security - Deep security auditworkflow-specialist - Orchestrates comprehensive PR reviews with parallel specialist delegation for security, testing, and accessibility analysis.
Before (manual PR review):
With workflow-specialist:
/pr-reviewConduct comprehensive PR review from multiple perspectives (PM, Developer, QA, Security)