feat(ci): review agent on Sonnet 5 with structured, linked reviews (#2570)
Some checks are pending
CodeQL / Analyze (javascript-typescript) (push) Waiting to run
CodeQL / Analyze (python) (push) Waiting to run
Gitleaks / gitleaks (push) Waiting to run
Publish / Classify release event (push) Waiting to run
Publish / RC guard (marker + release-PR skip) (push) Blocked by required conditions
Publish / ci (push) Blocked by required conditions
Publish / Publish to npm (push) Blocked by required conditions
Publish / Build & Push RC Docker images (push) Blocked by required conditions
Scorecard / Scorecard analysis (push) Waiting to run
Skill copy sync / shipped skills drift guard (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-cli) (push) Waiting to run
Trivy Image Scan / Trivy (gitnexus-web) (push) Waiting to run

Bump the pinned review model from claude-sonnet-4-5-20250929 to
claude-sonnet-5 (verified against the pinned Claude Code 2.1.214 with
subscription auth and --json-schema structured output).

Restructure the published review body: verdict-first summary, findings
ordered by severity, fixed section order, and every file or symbol
reference as a GitHub permalink pinned to the analyzed head SHA (or the
merge-base SHA for deleted and rename-old paths) instead of bare
path:line text, so references are clickable and render inline previews.


Claude-Session: https://claude.ai/code/session_01Va5uu9Ar3e45QZ5xFsG4AZ

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Gergő Magyar 2026-07-19 17:45:35 +01:00 committed by GitHub
parent b3826d6b0e
commit 94a528f577
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -1175,11 +1175,20 @@ jobs:
gate. Adapt the skill's checkout/index steps to this pre-aligned environment.
Return one structured field named body containing the complete Markdown
review: prioritized findings with file:line evidence, change and blast-radius
summary, coverage and residual risk, and the skill's verdict wording. Do not
review, structured exactly as: first a short opening paragraph that leads
with the skill's verdict wording and a plain-language summary of what the
PR does; then "### Findings" ordered by severity (CRITICAL, HIGH, MEDIUM,
LOW), one bold-severity bullet per finding stating the one-sentence claim
followed by an indented evidence line; then "### Change summary and blast
radius"; then "### Coverage and residual risk". Every file, line, or symbol
reference anywhere in the body must be a clickable Markdown link — never
bare `path:line` text. Link head files as
https://github.com/${{ github.repository }}/blob/${{ steps.context.outputs.head_sha }}/PATH#L10-L20
(exact analyzed head SHA, real line range) and deleted or rename-old paths
as the same URL shape at ${{ steps.inputs.outputs.merge_base }}. Do not
include an HTML publication marker and do not mention users or teams.
claude_args: |
--model claude-sonnet-4-5-20250929
--model claude-sonnet-5
--add-dir "${{ runner.temp }}/gitnexus-review-pr-target"
--setting-sources user
--disable-slash-commands