Next.js PR: three reviews, your tests and a CI release check
A Next.js change reviewed for correctness, security and test coverage by Parallel Review, tested with your own suite, then checked again from CI before merge.
A route handler that accepts input from the browser deserves more than one pair of eyes. This template runs three focused reviews on a Next.js change, runs your own test suite against the code that was written, and lets your CI ask the same question again before merge.
Which agents run
| Step | Agent |
|---|---|
| Correctness review | Reviewer |
| Security review | Security Auditor |
| Test coverage review | Tester |
| Merge findings | Architect |
The Architect merges the three reviews into one list. Then the code pass writes the change, and the verify step runs your package.json test script, with the package manager your lockfile points to, in an offline sandbox. Vitest and Jest output are parsed into totals.
Gates that apply
- Findings. A findings review reads the real diff, with the three reviews as context. Open high or critical findings block the pull request until triaged.
- Tests on this version. Failing tests block. Editing the change after its tests ran marks it untested.
- Approval. The person who started the session can't cast the approving vote while someone else in the workspace can approve.
Check again from CI
The console opens the pull request on a branch named codeops/run-<id>. In GitHub Actions, add a step to the workflow that runs on pull requests, with a workspace API key stored as a secret:
- name: AI CodeOps release check
if: startsWith(github.head_ref, 'codeops/run-')
env:
WORKSPACE_API_KEY: ${{ secrets.WORKSPACE_API_KEY }}
PR_URL: ${{ github.event.pull_request.html_url }}
run: |
curl -sf -X POST "https://console.aicodeops.dev/api/release/check" \
-H "Authorization: Bearer $WORKSPACE_API_KEY" \
-H "Content-Type: application/json" \
-d "{\"pullRequestURL\":\"$PR_URL\",\"blockOnInFlight\":true}" \
| jq -e '.allowed == true'
The endpoint answers 200 whether the change is allowed or not, so the step reads allowed. blockOnInFlight denies while any session behind the pull request is still running. Use the host you open the console on. All fields are on the API page.
Next
Once this passes and merges, the gated staging deploy template covers the path to production. For code no pull request touches, schedule a weekly codebase inspection.
Frequently asked questions
Do the three reviews run at the same time?
No. They run one after another, and each reads what the earlier ones wrote. Parallel describes how the work is divided.
Will the CI step deny pull requests written by hand?
Yes, a pull request with no session behind it gets No workflow runs found. That is why the step only runs on codeops/run- branches.