[polewskm]

tools/Enable-CodeReview.ps1 -SkipBedrock now skips only prompting for and setting the Bedrock key: the repositories in -Repo still get access to the existing AWS_BEARER_TOKEN_BEDROCK org secret. When the organization has no such secret yet, the script says it skipped it. -Repo splits on commas, as Set-RepositoryBaseline.ps1 -RequireChecks does, so pwsh -File ... -Repo a,b works. The help and README now say that changing who can read an org secret needs admin:org (gh auth refresh -h github.com -s admin:org). Both failure messages for setting a secret and granting access to one give that hint too.

New test/enable-code-review.test.ts runs the script with pwsh -File. The only gh on its PATH is a stand-in that records each call. These tests failed on the old script and pass on this one, on Windows and on Linux. I ran the Linux check in a container.

Decisions

• I kept the -SkipBedrock name and changed what it does, rather than renaming it.
• I turned off positional binding (PositionalBinding = $false). Before, pwsh -File ... -Repo a, b bound b to -AppPrivateKeyPath, and the script only failed after it had already changed the repositories. Now the call fails before any change.
• -UpdateBedrockKey together with -SkipBedrock is refused.
• The test is a node:test file that runs a real pwsh process, because the repository has no PowerShell test pattern. Existing tests already run real processes. CI's npm test on ubuntu-latest, which has pwsh, runs it, so CI needed no change. If pwsh is missing, the test is skipped.
• PSScriptAnalyzer reports two warnings, both already there before this change and left as they are: PSUseShouldProcessForStateChangingFunctions and PSShouldProcess, both on Set-OrgSecret.

Closes #34

[ncode-review]

🤖 NCode Review at 6d1175a: 8 new findings on the changed lines.

[ncode-review]

🤖 Review complete

Verdict: 💬 Comment — This PR adds test/enable-code-review.test.ts, which runs tools/Enable-CodeReview.ps1 in a real pwsh process with a fake gh that logs each call. The tests cover how -SkipBedrock handles the Bedrock key, how -Repo binds comma-separated values under pwsh -File, refusing conflicting flags, and stopping on errors. The harness is well isolated: it strips PATH and tokens, forces skips to fail in CI, and checks for an empty call log when the script should exit before changing anything. The one finding is a formatting nit.

5 reviewers run — 1 finding (run details)

Reviewer	Model	Findings	Top
synthesis	opus-5-5	1	🟡
conventions	sonnet-5-5	0	🟢
correctness	sonnet-5-5	0	🟢
hygiene	haiku-5-5	1	🟡
rule-check	sonnet-5-5	0	🟢
security	sonnet-5-5	0	🟢

Skipped: api-compat, architecture, completeness, data-model, infrastructure, intent, performance, tests

Findings

• 🟡 F1 test/enable-code-review.test.ts:208: Test file has no trailing newline

_{Trial: findings are posted as review threads and in the check run. $0.36 on Amazon Bedrock, 40s, at c21b557. (how to interact)}

[polewskm]

/review

[ncode-review]

🤖 NCode Review at c21b557: 1 new finding on the changed lines.