feat: add skills-based code review agent example

[Small-fish-QAQ]

What

Related to #92

This PR adds a lightweight, deterministic code review agent example under examples/skills_code_review_agent.

It implements a minimal runnable workflow for reviewing unified diffs with static rules, structured findings, redaction, deduplication, report generation, SQLite persistence, dry-run sandbox metadata, filter decisions, telemetry summaries, fixtures, and pytest coverage.

This PR is intentionally designed as a dependency-light baseline example rather than a full scanner/sandbox implementation.

Changes

• Add examples/skills_code_review_agent
• Support unified diff input via --diff-file
• Support stdin diff input via --diff-file -
• Add --fail-on-severity for CI-style failure gates
• Add --list-rules for deterministic rule metadata
• Add static review rules for:
  • hardcoded secrets
  • SQL string concatenation risks
  • missing HTTP timeouts
  • broad exception handling
  • resource lifecycle risks
• Add finding redaction and deduplication
• Generate review_report.json and review_report.md
• Persist review tasks, findings, reports, sandbox runs, and filter decisions into SQLite
• Add dry-run sandbox, filter decision, and telemetry summaries
• Add 8 fixtures covering:
  • clean diff
  • security issues
  • SQL injection
  • missing timeout
  • broad exception handling
  • resource leak
  • duplicate finding
  • secret redaction
• Add pytest coverage
• Add README with local usage, SQLite verification, CI gate usage, stdin diff usage, sample outputs, and testing instructions

Test

python -m pytest examples/skills_code_review_agent/tests --basetemp examples/skills_code_review_agent/.pytest_tmp

Result:

16 passed in 0.32s

Smoke test:

python examples/skills_code_review_agent/run_agent.py --diff-file examples/skills_code_review_agent/fixtures/security.diff --output-dir examples/skills_code_review_agent/output --db-path examples/skills_code_review_agent/output/final_reviews.sqlite3 --dry-run --fail-on-severity never

Result:

Skills code review dry-run complete
Changed files: 2
Findings: high=5 medium=2 low=0
Filter decision: allow (diff is within dry-run review limits)
Sandbox status: completed
Failure gate: disabled (--fail-on-severity never)

CI gate check:

python examples/skills_code_review_agent/run_agent.py --diff-file examples/skills_code_review_agent/fixtures/security.diff --output-dir examples/skills_code_review_agent/output --dry-run --fail-on-severity high

Expected result:

Failure gate: triggered (--fail-on-severity high)
Exit code: 1

Rule metadata check:

python examples/skills_code_review_agent/run_agent.py --list-rules

Stdin diff check:

git diff | python examples/skills_code_review_agent/run_agent.py --diff-file - --output-dir examples/skills_code_review_agent/output --dry-run

Notes

This PR focuses on a small deterministic baseline that can run locally without Docker, external scanners, LLM calls, or SDK core changes.

The sandbox layer is implemented as a fake/dry-run runner and does not execute untrusted code. Real Docker / Cube / E2B runtime integration can be added later behind the runner abstraction if maintainers think this lightweight direction is useful.

The implementation is limited to examples/skills_code_review_agent and does not modify the SDK core.

This PR is not intended to duplicate the full scanner/sandbox implementation in #124. Its goal is to provide a lightweight, dependency-light, Windows-friendly example that can be used as a minimal baseline or educational reference.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@099b571). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff             @@
##             main        #127   +/-   ##
==========================================
  Coverage        ?   87.51506%           
==========================================
  Files           ?         467           
  Lines           ?       44005           
  Branches        ?           0           
==========================================
  Hits            ?       38511           
  Misses          ?        5494           
  Partials        ?           0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

[Small-fish-QAQ]

I have read the CLA Document and I hereby sign the CLA

[Small-fish-QAQ]

I added a small follow-up to strengthen this PR as a lightweight deterministic baseline:

• Add --fail-on-severity for CI-style failure gates
• Add --list-rules to show deterministic rule metadata
• Support stdin diff input via --diff-file -
• Keep the implementation dependency-light and limited to examples/skills_code_review_agent

This PR is intentionally not trying to duplicate the full scanner/sandbox implementation in #124. Its goal is to provide a small, deterministic, Windows-friendly baseline example that can run without Docker, external scanners, LLM calls, or SDK core changes.

Latest local test result:

16 passed in 0.32s