a024830127
Switch both review workflows from pull_request to pull_request_target so they run with base repo permissions and can access secrets when reviewing fork PRs. Changes: - claude-code-review.yml: pull_request → pull_request_target - opencode-review.yml: pull_request → pull_request_target - Both now explicitly checkout PR head commit for review - Added security comments explaining the approach This allows the workflows to run successfully after maintainer approval for external contributor PRs.
87 lines
3.9 KiB
YAML
87 lines
3.9 KiB
YAML
name: Claude Code Review
|
|
|
|
on:
|
|
# Using pull_request_target to run with base repo permissions (access to secrets)
|
|
# This allows the workflow to run for fork PRs after maintainer approval
|
|
# Security: This workflow only READS PR code for review, it does NOT execute it
|
|
pull_request_target:
|
|
types: [opened, synchronize]
|
|
# Skip review for documentation and config-only changes
|
|
paths-ignore:
|
|
- "**/*.md"
|
|
- ".github/**"
|
|
- ".gitignore"
|
|
- "pyproject.toml"
|
|
|
|
# Cancel in-progress runs for the same PR to avoid duplicate reviews
|
|
concurrency:
|
|
group: claude-code-review-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
claude-review:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: read
|
|
issues: read
|
|
id-token: write
|
|
|
|
steps:
|
|
- name: Calculate total changes
|
|
id: calc
|
|
run: |
|
|
additions=${{ github.event.pull_request.additions }}
|
|
deletions=${{ github.event.pull_request.deletions }}
|
|
total=$((additions + deletions))
|
|
echo "total=$total" >> $GITHUB_OUTPUT
|
|
- name: Checkout PR code for review
|
|
# Only review substantial changes (5+ files OR 20+ lines changed)
|
|
if: |
|
|
github.event.pull_request.changed_files >= 5 ||
|
|
steps.calc.outputs.total >= 20
|
|
uses: actions/checkout@v4
|
|
with:
|
|
# Checkout the PR head commit (pull_request_target defaults to base branch)
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
fetch-depth: 1
|
|
|
|
- name: Run Claude Code Review
|
|
# Only review substantial changes (5+ files OR 20+ lines changed)
|
|
if: |
|
|
github.event.pull_request.changed_files >= 5 ||
|
|
steps.calc.outputs.total >= 20
|
|
id: claude-review
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
prompt: |
|
|
REPO: ${{ github.repository }}
|
|
PR NUMBER: ${{ github.event.pull_request.number }}
|
|
|
|
Please review this pull request and provide feedback on:
|
|
- Code quality and best practices
|
|
- Potential bugs or issues
|
|
- Performance considerations
|
|
- Security concerns
|
|
- Test coverage
|
|
|
|
NOTE: review the other comments on the pull request - including yours.
|
|
If you are reviewing changes or enhancements beyond the first creation of the pull request,
|
|
make sure your comments are consistent with your previous reviews, or are
|
|
referring to them in a consistent way.
|
|
|
|
IMPORTANT FORMATTING NOTE: The use of the number symbol, '#', has a specific meaning in GitHub. It creates a link to an existing GitHub
|
|
Issue or PR. If you plan to make that link, feel free to use # as a symbole in text. However, if you're simply referring to a numbered item
|
|
in your own text, do not use the # symbol because it will link to an issue or PR which isn't related. Just write 'Number' or "No.".
|
|
|
|
There's no need to repeat information unless it is critical and not
|
|
being reflected in comments or code. Be aware of your prior reviews and that the new file information
|
|
may reflect changes because of previous reviews.
|
|
|
|
Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.
|
|
Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.
|
|
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
|
|
# or https://docs.claude.com/en/docs/claude-code/cli-reference for available options
|
|
claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'
|
|
|