feat: add Antigravity PR review bot workflow

Setup a read-only code review pipeline using the google-antigravity SDK and GitHub Actions. It triggers on maintainer PR opens or /review comments and leverages the review-pr skill to evaluate quality and architecture.

Author: rickeylev

.github/workflows/antigravity-review.yml

@@ -0,0 +1,57 @@
+name: Antigravity Code Review
+
+on:
+  pull_request_target:
+    types: [opened]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    # Trigger only if:
+    # 1. It is a pull_request_target event, it is NOT a draft, and the author is a maintainer
+    #    (OWNER, MEMBER, or COLLABORATOR).
+    # 2. OR it is an pull_request_review_comment event, the comment body has a line starting with "/review",
+    #    and the commenter is a maintainer.
+    if: >
+      (github.event_name == 'pull_request_target' && !github.event.pull_request.draft &&
+       (github.event.pull_request.author_association == 'OWNER' || github.event.pull_request.author_association == 'MEMBER' || github.event.pull_request.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review_comment' &&
+       (startsWith(github.event.comment.body, '/review') || contains(github.event.comment.body, '\n/review')) &&
+       (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER' || github.event.comment.author_association == 'COLLABORATOR'))
+    steps:
+      - name: Checkout PR Branch (Untrusted)
+        uses: actions/checkout@v7
+        with:
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+          persist-credentials: false
+
+      - name: Checkout Trusted Reviewbot (Base Branch)
+        uses: actions/checkout@v7
+        with:
+          sparse-checkout: |
+            tools/private/reviewbot
+          path: trusted-reviewbot
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v8.1.0
+
+      - name: Set up Python
+        run: uv python install 3.13
+
+      - name: Install Dependencies
+        run: |
+          uv pip install google-antigravity requests
+
+      - name: Run Antigravity Review
+        env:
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          uv run trusted-reviewbot/tools/private/reviewbot/antigravity_review.py \
+            --prompt trusted-reviewbot/tools/private/reviewbot/prompt.txt

tools/private/reviewbot/antigravity_review.py

@@ -0,0 +1,48 @@
+import argparse
+import asyncio
+from pathlib import Path
+
+from google.antigravity import Agent, CapabilitiesConfig, LocalAgentConfig
+
+
+def parse_args():
+    parser = argparse.ArgumentParser()
+    parser.add_argument("--prompt", required=True, help="Path to prompt file")
+    return parser.parse_args()
+
+
+async def main():
+    args = parse_args()
+
+    # Read prompt file
+    prompt = Path(args.prompt).read_text()
+
+    # Initialize the Antigravity Agent in read-only mode for security.
+    # Register the review-pr skill from the local reviewbot folder.
+    config = LocalAgentConfig(
+        skills_paths=["tools/private/reviewbot/skills/review-pr"],
+        capabilities=CapabilitiesConfig(
+            allow_filesystem_read=True,
+            allow_filesystem_write=False,
+            allow_network=False,
+        ),
+    )
+
+    # General coordinator instructions for the reviewer agent.
+    system_instructions = (
+        "You are a code review assistant. Use your available skills to perform "
+        "reviews on pull requests."
+    )
+
+    async with Agent(config, system_instructions=system_instructions) as agent:
+        response = await agent.chat(prompt)
+        report = await response.text()
+
+    print("--- REVIEW REPORT GENERATED ---")
+    print(report)
+
+    # TODO: Use GITHUB_TOKEN to post the report back to the PR comments.
+
+
+if __name__ == "__main__":
+    asyncio.run(main())

tools/private/reviewbot/prompt.txt

@@ -0,0 +1,3 @@
+Use the review-pr skill to review the files modified in this pull request.
+Summarize your findings and suggest specific, actionable improvements.
+Group your findings into clear, descriptive nits or suggestions.

tools/private/reviewbot/skills/review-pr/SKILL.md

@@ -0,0 +1,36 @@
+---
+name: review-pr
+description: Perform a read-only code review on a pull request.
+---
+
+# review-pr
+
+You are an expert Starlark, Python, and Bazel code reviewer. Analyze the changed files for
+correctness, edge cases, and performance. Focus strictly on logical
+correctness, concurrency safety, system architecture, performance bottlenecks,
+and resource management. Do not comment on style nits or formatting issues
+that an automated formatter can handle. Be constructive and concise.
+
+Follow these checklists during your review:
+
+### General Quality & Architecture Checklist
+*   **PR Description Audit**: Verify the description contains the Why
+    (business/technical reason), a brief high level overview of changes,
+    Issue/Bug Link, and explicit Testing Evidence.
+*   **Separation of Concerns**: Suggest extracting large hardcoded data structures
+    (e.g., massive templates, complex regexes) to resource files.
+*   **Logic Correctness**: Verify calculations, negative values, division-by-zero,
+    and null safety before member access.
+*   **Error Handling**: Flag silent failures (e.g., empty except blocks) and
+    unconditional defaults that override configs.
+*   **Deterministic Operations**: Sort collections/keys to guarantee
+    reproducible/deterministic execution.
+
+### Skeptical Critic (Adversarial Specialist Review)
+*   **Dynamic Filtering**: Filter the PR diff and run only the specialist checks
+    that have relevant files changed (e.g. skip the C++ checks if only Python
+    files are modified).
+*   **Specialist Review Pillars**: Run parallel audits focusing on:
+    1.  Crash Regression: Null safety and resource lifecycle.
+    2.  Performance & Latency: Thread bottlenecks, locks, and network calls.
+    3.  Test Integrity: Coverage validity, change detectors defense.