Index of every page on this site: llms.txt
All skills
michaelshimeles avatar

/greploop

@11b1576
Run it yourself

Address Greptile feedback on a PR, MR, or shelved changelist through bounded review and fix cycles. Use when the task includes a Greptile review loop. Supports the alternate @greptile-apps trigger for large PRs.

Use this Skill: https://skilld.dev/gh/michaelshimeles/rstack/greploop

Nothing lands on disk. Nothing to clean up.

Fork this Skill

Edit a local copy. It keeps the author and licence.

referencesgitlab-api.md

≈658 tokens on demand. Your agent reads this file only when SKILL.md points to it.

GitLab reviews

Use the configured glab instance and MR source branch. --trigger from the shared workflow determines the mention; @greptile is the default. Do not infer that Greptile is running from unrelated CI pipelines.

Start an attempt

Read glab mr view IID --output json and record the MR's sha. Snapshot all pages of notes before posting, including IDs, bodies, and update timestamps. Verify the configured bot's exact username once, then use that identity.

glab api 'projects/:fullpath/merge_requests/IID/notes?per_page=100&page=1'
glab api --method POST 'projects/:fullpath/merge_requests/IID/notes' \
  --field 'body=@greptile review'

Record the returned trigger note's ID and created_at. Use the alternate mention when requested. For multiline messages, use a file or structured API argument that preserves the text.

Wait for feedback

Poll notes at 10-second intervals, with a 10-minute deadline. Paginate until a page contains fewer than 100 notes. Read the current SHA before and after each poll. Stop if it changed. Only accept a new or changed bot summary updated strictly after the trigger and explicitly associated with that SHA by the site's review metadata or a last-reviewed-commit link. An older 5/5, a changed timestamp alone, or a successful CI pipeline is insufficient.

If the integration exposes a Greptile job, also record its attempt ID and start time. Wait for the new job to finish; do not reuse an older completed job for the same SHA. Cancelled or timed-out jobs stop the attempt. If the site exposes no way to associate feedback with the requested revision, report that limitation and stop rather than declaring a fresh review.

Read and resolve discussions

glab api 'projects/:fullpath/merge_requests/IID/discussions?per_page=100&page=1'

Paginate all discussions. Resolution fields belong to each note: select notes with resolvable == true and resolved == false from the trusted bot. Read the whole discussion, including replies, before acting. Keep unresolved findings from earlier commits; a push does not resolve them.

After checks pass and a fix is published, resolve its discussion:

glab api --method PUT \
  'projects/:fullpath/merge_requests/IID/discussions/DISCUSSION_ID' \
  --field resolved=true

Resolve only addressed Greptile discussions. Re-fetch notes and discussions, and confirm the reviewed SHA still matches before reporting success. General summary findings also count, even without a resolvable inline discussion.

Field definitions: GitLab discussions API.

Source: SKILL.md on GitHub

skilld matched fixed text patterns in SKILL.md and file names. Patterns miss obfuscated code.

skilld run checks every file with the same patterns. It asks for approval before it loads a Skill with a behavior marked Needs approval.

2 warnings6d3 checks · Risk MEDIUM
  • Gen Agent Trust Hub6d

    The skill provides automation for addressing pull request feedback from the Greptile review service using CLI tools and a Python helper script. While the core functionality appears legitimate, there is a discrepancy between the platform-reported author and the author name claimed in the skill metadata, which may lead to confusion regarding the source of the tool. Additionally, the skill processes external comments from version control platforms, introducing a surface for indirect prompt injection, and executes shell commands for API interactions.

  • Socket7d

    No alerts

  • Snyk7d

    Risk: MEDIUM · 1 issue

Signed by skilld at 11b1576. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub last week.

Activeupdated 3 weeks ago
metadata
{
  "author": "greptileai",
  "version": "2.0"
}
Other metadata
compatibility
GitHub automation requires Python 3.10+ and authenticated gh. GitLab requires glab; Perforce requires p4 and the site's review integration. Greptile must be installed.

README badge

README badge for michaelshimeles/rstack/greploop