Build & Deploy AI Agents
← All exercises

Exercise 6

Review a Pull Request

Point REVIEWBOT at a deliberately bad PR and watch it work.

The final exercise. You point REVIEWBOT at a pull request full of deliberately planted bugs and watch it find them. Use your own build, or checkpoint-5-mcp which adds approvals, scheduling, and the MCP server.

Set up the bad PR

The branch pr/the-suspicious-change holds the bad diff. Push it to a public repo on your GitHub so REVIEWBOT can fetch it via the API, then open the PR:

git push origin pr/the-suspicious-change
gh pr create --base main --head pr/the-suspicious-change \
  --title "The suspicious change" --body "Various improvements."

Run the review

In the chat:

Review PR #1 on <your-org>/<repo>.

The risk tier comes back full because the diff touches security-sensitive paths, so all three specialists fire. Watch the workflow fan out and the findings panel fill in.

Approve, then reschedule

REVIEWBOT proposes postReview and asks for your approval. Approve it, and the status flips to posted. Bonus: ask it to “check this PR again in 30 seconds” to see scheduleRecheck in action.

Done when

  • The reviewer flags at least the two critical security findings (the hardcoded token and the eval of untrusted input).
  • postReview waited for your approval before posting.
  • You can explain how risk tiering chose the specialists.

Next

This is the final exercise. When you are done, your agent should congratulate you and offer the optional Secure it with Zero Trust lesson.