Foxglove GitHub Actions

Shared GitHub Actions workflows and prompts for the Foxglove organization.

PR Review Workflow

Review (review.yml)

An AI-powered PR review that combines technical and product perspectives in a single pass. Acts as a CTO who is both a technical leader and product steward — evaluating code quality, architecture, performance, and security alongside user-facing consistency, terminology, documentation, and UX.

Prompt: prompts/review.md

Job environment: the reviewer runs with a shell and can execute commands to check its own claims rather than reasoning from the spec. Repos with a .node-version or .nvmrc get that Node version installed; repos with a yarn.lock get Corepack enabled. Both setup steps are best-effort and skip on repos that don't need them.

Dependencies are not installed. On Yarn repos the reviewer can install them itself when a finding turns on running the repo's own code. node and yarn are the only JS tooling in the allowlist, so npm and pnpm repos get the pinned runtime but no install path.

Repository-specific review instructions

The shared prompt stays general-purpose. To add conventions or review policies specific to a repo (or a subtree within it), commit instruction files alongside the code — no workflow changes needed:

• AGENTS.md — general codebase conventions and agent guidance (an emerging standard). Used to judge idiomatic patterns.
• REVIEWING.md — review-specific policies and checklists (e.g. "require a linked desktop build for PRs that touch packages/desktop").

Each file applies to its own directory and all subdirectories; a file at the repo root applies repo-wide. When multiple files apply to a path, the more deeply nested one takes precedence. The workflow discovers these files automatically (tracked files only) and the reviewer applies them on top of the general guidance, so repo-specific rules don't have to live in this shared prompt.

Usage

Add this workflow to your repository's .github/workflows/ directory:

# .github/workflows/pr-review.yml
name: PR Review

on:
  pull_request: {}

jobs:
  review:
    if: ${{ !github.event.pull_request.head.repo.fork }}
    permissions:
      actions: read
      contents: read
      pull-requests: write
      id-token: write
    uses: foxglove/actions/.github/workflows/review.yml@main
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Note: If your repository restricts the default GITHUB_TOKEN permissions, you may also need to add a top-level permissions block to explicitly grant the required access at the workflow level.

permissions:
  actions: read
  contents: read
  pull-requests: write
  id-token: write