Pull Requests

gx review posts its findings as a comment on the pull request, when it can find a GitHub token and a pull request to post them on.

There is no GitHub App, and nothing to install on your account or organization. gx uses a token that is already yours.

Finding a token

In order:

1. GH_TOKEN
2. GITHUB_TOKEN
3. the GitHub CLI's own login, via gh auth token

If you are signed in with gh auth login, this already works and there is nothing to configure:

gh auth status

GH_TOKEN and GITHUB_TOKEN are the escape hatch for CI and for anyone who prefers a token they manage themselves:

GH_TOKEN=$(gh auth token) gx review

A token needs no scopes beyond reading the repository and writing a comment. The default gh auth login token is enough.

Skipping it

gx review --no-comment

Without a token

Review still runs and still prints its report. Posting the comment is skipped and nothing fails — the token is a convenience for the PR surface, not a requirement for review.

The same is true in reverse: gx review on a repository with no GitHub remote, or on a branch with no pull request, reviews normally and says nothing about posting.

What gets posted

The comment is the --md shape of the report: the verdict, the findings split into blocking and advisory lanes, and the fix plan.

gx review --md        # print exactly what would be posted, without posting it

See the CLI reference for the full flag list.