Code Review Workflow

# Create pre-review task
forge task create \
  --title "Pre-review checklist for PR #123" \
  --description "$(cat <<EOF
- [ ] All tests pass
- [ ] Linter passes
- [ ] Type checker passes
- [ ] No console.logs or debugging code
- [ ] CHANGELOG updated
- [ ] Documentation updated
- [ ] Self-review completed
EOF
)" \
  --agent gemini

# Launch all review tasks at once
forge task start-batch \
  task-security \
  task-performance \
  task-best-practices \
  task-testing \
  --parallel

# Monitor progress
forge task watch-batch --all-reviews

# Results ready in ~5-10 minutes

forge task create \
  --title "Aggregate all PR #123 reviews" \
  --description "Combine feedback from all agents into single report" \
  --agent gemini \
  --depends-on task-security,task-performance,task-best-practices,task-testing

# PR #123 Review Summary

## 🔴 Critical Issues (3)
1. **[Security]** SQL injection vulnerability in user search
   - Agent: Claude Code
   - File: `src/api/users.ts:45`
   - Fix: Use parameterized queries

2. **[Performance]** N+1 query in order list endpoint
   - Agent: Gemini
   - File: `src/api/orders.ts:120`
   - Fix: Use eager loading with joins

3. **[Testing]** Missing tests for error scenarios
   - Agent: Test Reviewer
   - Coverage: 45% (target: 80%)
   - Fix: Add error case tests

## 🟡 Medium Issues (7)
...

## 🟢 Minor Issues (12)
...

## ✅ Positive Feedback
- Good separation of concerns
- Clear naming conventions
- Comprehensive error handling

# Critical issues - fix immediately
forge task create \
  --title "Fix SQL injection in user search" \
  --description "Use parameterized queries, validate input" \
  --priority critical \
  --agent claude-code \
  --labels "bugfix,security"

# Medium issues - fix before merge
forge task create \
  --title "Optimize order list query" \
  --description "Replace N+1 with JOIN query" \
  --priority high \
  --agent gemini

# Minor issues - address or defer
forge task create \
  --title "Improve variable naming in auth module" \
  --priority low \
  --agent cursor-cli \
  --labels "refactor,nice-to-have"

# .forge/agents/security-reviewer.yml
name: security-reviewer
description: "Security-focused code reviewer"
base_agent: claude-code

system_prompt: |
  You are a security-focused code reviewer. Review code for:

  OWASP Top 10 vulnerabilities:
  - SQL Injection
  - XSS (Cross-Site Scripting)
  - CSRF
  - Authentication/Authorization flaws
  - Security misconfigurations
  - Sensitive data exposure
  - Insufficient logging
  - XML External Entities (XXE)
  - Broken access control
  - Using components with known vulnerabilities

  Also check for:
  - Hardcoded secrets
  - Weak cryptography
  - Insecure dependencies
  - Input validation
  - Output encoding
  - Rate limiting
  - Error message information leakage

  Provide specific, actionable feedback with:
  - Severity (Critical/High/Medium/Low)
  - Exact file and line number
  - Vulnerability explanation
  - Remediation steps
  - Example secure code

checklist:
  - SQL injection prevention
  - XSS prevention
  - Authentication checks
  - Authorization checks
  - Input validation
  - Output encoding
  - Secret management
  - Dependency security

forge task create \
  --title "Deep security review: Payment processing PR" \
  --agent claude-code \
  --specialized-agent "security-reviewer" \
  --attach-pr 127

# .forge/workflows/auto-review.yml
name: Auto-Review PR

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  multi-agent-review:
    runs-on: forge-server
    steps:
      - name: Security Review
        run: |
          forge task create \
            --title "Security review: PR ${{ github.event.number }}" \
            --agent claude-code \
            --specialized-agent "security-reviewer" \
            --attach-pr ${{ github.event.number }} \
            --auto-comment

      - name: Performance Review
        run: |
          forge task create \
            --title "Performance review: PR ${{ github.event.number }}" \
            --agent gemini \
            --specialized-agent "performance-reviewer" \
            --attach-pr ${{ github.event.number }} \
            --auto-comment

      - name: Best Practices Review
        run: |
          forge task create \
            --title "Best practices review: PR ${{ github.event.number }}" \
            --agent cursor-cli \
            --attach-pr ${{ github.event.number }} \
            --auto-comment

      - name: Aggregate Results
        run: |
          forge review aggregate \
            --pr ${{ github.event.number }} \
            --post-summary

# Configure Forge to comment on PRs
forge config set github.auto_comment true
forge config set github.review_threshold "critical,high"

# Agents will automatically post comments

## 🤖 Forge Security Review

**Agent:** Claude Code (security-reviewer)
**Status:** ⚠️ Issues Found

### 🔴 Critical Issues (1)

**SQL Injection in User Search**
- **File:** `src/api/users.ts`
- **Line:** 45
- **Severity:** Critical

**Current Code:**
```typescript
const query = `SELECT * FROM users WHERE name = '${searchTerm}'`;

const query = 'SELECT * FROM users WHERE name = ?';
const results = await db.query(query, [searchTerm]);

---

## Measuring Review Quality

Track metrics to improve review process.

### Issue Detection Rate

**Measure effectiveness:**
```bash
forge analytics review-effectiveness --period last-30-days

forge analytics agent-review-performance

forge analytics review-coverage