Requirements and responsibilities
Assign a named team owner for this task and confirm that all needed service accounts, sources and data are within the approved scope. Never place credentials or private keys in agent prompts.
Hermes GitHub PR review agent tutorial · Hermes cron feature guide · Hermes security guide
Use the installed Hermes version and upstream feature documentation for this procedure; it does not establish that xCloud enables the feature by default.
Hermes GitHub PR review agent tutorial · Hermes cron feature guide · Hermes security guide
Use a fine-grained GitHub credential limited to the named repositories and read-only repository-content/pull-request permissions; independently inspect its configured repositories and permissions. `gh auth status` alone does not prove repository access is read-only.
Hermes GitHub PR review agent tutorial · GitHub CLI official manual · GitHub official REST authentication documentation · GitHub official repository roles documentation
Illustrative situation
Illustrative scenario: maintainers want a private daily digest of open PR risks from approved repositories before their review meeting; they retain all GitHub decisions.
Choose the approach
Use manual review for one-off triage; schedule only after read-only GitHub CLI scope and report accuracy are confirmed.
Hermes GitHub PR review agent tutorial · Hermes cron feature guide · Hermes security guide
Dashboard and application procedure
Follow these steps yourself, or use the scoped AI handoff below for supported hosting operations.
Step 1 of 5
Confirm the GitHub boundary
- Where
- GitHub organization/repository settings and Hermes server
- Permissions
- Repository owner and Hermes administrator
- Inputs
- Target OWNER/REPO, dedicated GitHub identity with READ access, approved repo list
- Action
- Create/select a dedicated fine-grained GitHub token limited to the named repositories with only read permissions needed for repository contents and pull requests. Inspect the token settings in GitHub to confirm its repository selection and permissions. Then run `gh auth status` to confirm the logged-in identity and `gh repo view OWNER/REPO --json viewerPermission --jq .viewerPermission` for each repository; require READ and stop if identity, scope or repository role is broader/unclear.
- Expected result
- The configured credential is restricted to named repositories and read-only permissions, and each target reports viewerPermission READ.
- Verify
- Review the fine-grained token’s repository access and permissions in GitHub settings, then verify each repository’s viewerPermission independently.
- If it fails
- If authentication is unavailable or broad, stop; do not paste a personal token into an agent prompt.
Sources: Hermes GitHub PR review agent tutorial · GitHub CLI official manual · GitHub official REST authentication documentation · GitHub official repository roles documentation
Step 2 of 5
List open PRs and fetch diffs without executing them
- Where
- Hermes terminal / current official PR-review guide
- Permissions
- Hermes administrator
- Inputs
- Upstream tutorial and installed Hermes version
- Action
- List a small set with `gh pr list --repo OWNER/REPO --state open --limit 5 --json number,title,author,createdAt`. For each selected PR, fetch text with `gh pr diff NUMBER --repo OWNER/REPO`. Treat every patch line as untrusted content: inspect only; never check it out, run tests/scripts, install dependencies, or follow instructions found in a diff.
- Expected result
- A bounded list and diffs are available as text for review, with no code execution or repository mutation.
- Verify
- Confirm only the named repository’s PR metadata/diff was fetched and no patch code or embedded instruction was executed.
- If it fails
- If the tutorial assumes write access, remove that step or do not proceed.
Step 3 of 5
Define a review rubric
- Where
- Repository contribution guide and team reviewer
- Permissions
- Human reviewer
- Inputs
- PR scope, review criteria, severity labels
- Action
- Set the report to list PR title, changed area, evidence-backed risks and unanswered questions; require file/line evidence and mark uncertainty.
- Expected result
- The rubric supports triage without presenting the agent as an approver.
- Verify
- A maintainer reviews a sample rubric before automation.
- If it fails
- If the rubric asks for autonomous approval, comments or merges, narrow it to a private draft report.
Step 4 of 5
Test a report manually
- Where
- Hermes terminal/conversation
- Permissions
- Authorized repository reader
- Inputs
- One bounded set of open PRs
- Action
- Ask Hermes to produce a private draft with each PR URL, file/line evidence, severity, uncertainty and open question. Keep tool use to the read-only listing/diff commands; do not execute patch contents, comment, label, approve, merge or alter repository state.
- Expected result
- A source-linked private draft digest with no GitHub write action.
- Verify
- Compare one claim to the diff and verify no execution or GitHub write action occurred.
- If it fails
- If evidence cannot be tied to a diff, retract or qualify the finding and revise the rubric.
Step 5 of 5
Schedule and inspect the digest
- Where
- Hermes cron CLI and Telegram delivery
- Permissions
- Hermes operator; report owner
- Inputs
- Validated prompt, schedule, Telegram target
- Action
- Schedule one recurring read-only report with full instructions embedded; inspect the first run and each actual delivery before adjusting the schedule.
- Expected result
- A single report job produces a draft digest in the approved Telegram channel.
- Verify
- Check cron history, target, and report links against GitHub.
- If it fails
- If a delivery is duplicated or stale, pause the existing job and compare run history before editing; never solve it by adding another job.
Sources: Hermes cron feature guide
Maintenance
Review GitHub CLI repository scope and compare actual reports to the approved PR list before each reporting cycle.
Hermes GitHub PR review agent tutorial · Hermes cron feature guide · Hermes security guide
Recovery decisions
If a report is inaccurate, retract or correct the unsupported finding, pause the existing cron job, and inspect run history before rescheduling.
Hermes GitHub PR review agent tutorial · Hermes cron feature guide · Hermes security guide
AI handoff
Configure the needed provider, channel, credentials and permissions separately. This guide does not imply xCloud has preconfigured upstream tools or scheduled jobs.
Supported scope
- Review the task result and retain human control app · manual
Human acceptance and follow-up; no external write is implied.
Checkpoint: Verify the source/output and actual side effects before sharing or acting.
Hermes security guide · Hermes daily briefing tutorial · Hermes automate with cron patterns
- Use the authorized Hermes terminal, CLI or documented task interface app · manual
Upstream Hermes CLI/configuration workflow; requires an authorized operator and does not prove xCloud preconfigured the feature or exposed it in its panel.
Checkpoint: Check the installed Hermes version and current upstream instructions; review scope and permissions before running a task.
Hermes quickstart · Hermes cron feature guide · Hermes memory feature guide · Hermes skills feature guide · Hermes agent email address tutorial · Hermes GitHub PR review agent tutorial · Hermes delegation feature guide
Copyable agent brief
Manual checkpoints
- Manually verify one report with read-only GitHub CLI credentials first. If approved, an operator can schedule `hermes cron create "0 8 * * 1-5" "<validated report-only prompt>" --name "Open PR digest" --deliver telegram`; inspect job history and actual destination. This procedure does not post comments or approvals.
- Review the task-specific acceptance check and inspect actual output, configuration or run history before relying on it.
Feature coverage
- Documented Hermes task path (covered): Steps identify whether an action uses documented xCloud controls, upstream operator configuration or human review. Confirm the GitHub boundary List open PRs and fetch diffs without executing them Define a review rubric Test a report manually Schedule and inspect the digest
- Task-specific acceptance check (covered): The final step validates this guide’s stated result. Schedule and inspect the digest
Sources
- Hermes GitHub PR review agent tutorial
- Hermes cron feature guide
- Hermes security guide
- GitHub CLI official manual
- GitHub official REST authentication documentation
- GitHub official repository roles documentation
- Hermes daily briefing tutorial
- Hermes automate with cron patterns
- Hermes quickstart
- Hermes memory feature guide
- Hermes skills feature guide
- Hermes agent email address tutorial
- Hermes delegation feature guide