---
name: review-a-pull-request-for-bugs-and-risky-changes
description: Review a pull request for real bugs, risky changes and missing tests, ranked by severity, with a merge verdict.
---

# Review a pull request for bugs and risky changes

Use this when asked to review a pull request, a diff, or a branch before it is merged.

## Inputs

- **The pull request** (`{{pr}}`): a URL, a number in the current repository, or a pasted diff.
- **Focus** (`{{focus}}`): optional. Something the author is worried about.

## Procedure

1. Read the whole diff first. Do not comment while reading.
2. For each changed file, ask: what input or state makes this wrong? What did it do before?
3. Look for, in this order: behavior changes and bugs, data loss or security problems,
   changes that are hard to roll back (migrations, external calls, config), missing tests
   for changed logic.
4. Verify each suspected finding against the code before reporting it. Drop anything you
   cannot make concrete.
5. Ignore style and naming unless it hides a bug.

## Output

For each finding: file and line, what goes wrong, a concrete scenario, a suggested fix.
Most serious first. Finish with one line: **safe to merge**, **merge after fixes**, or
**needs rethinking**.

## Afterwards

Ask the person "Did it work? (yes / partly / no)" and, if connected to Riprova, report the
answer with the report_run tool.