mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-08-28 05:25:25 +00:00
fa9ba8925c
claude-code-action fetches branches by name from origin, which fails for fork PRs since the branch only exists on the fork remote. Work around by detecting fork PRs and temporarily pushing the branch to origin before the action runs, then cleaning up afterwards. Also changed trigger from automatic (every push) to on-demand only (label "claude-review" or comment "@claude" / "/review").
97 lines
4 KiB
YAML
97 lines
4 KiB
YAML
name: Claude Code Review
|
|
|
|
# Uses pull_request_target so the workflow runs as defined on the default branch,
|
|
# which allows access to secrets for posting review comments on fork PRs.
|
|
# SECURITY: The checkout below uses the PR head SHA to review the correct code.
|
|
# The claude-code-action sandboxes execution — it does NOT run arbitrary code
|
|
# from the checked-out source.
|
|
|
|
on:
|
|
# Trigger only when explicitly requested:
|
|
# - Add the "claude-review" label to a PR, OR
|
|
# - Comment "@claude" or "/review" on a PR
|
|
pull_request_target:
|
|
types: [labeled]
|
|
issue_comment:
|
|
types: [created]
|
|
|
|
jobs:
|
|
claude-review:
|
|
# Run only when:
|
|
# 1. The "claude-review" label is added to a non-draft PR by a trusted contributor, OR
|
|
# 2. A trusted contributor comments "@claude" or "/review" on a PR
|
|
if: |
|
|
(
|
|
github.event_name == 'pull_request_target' &&
|
|
github.event.label.name == 'claude-review' &&
|
|
github.event.pull_request.draft == false &&
|
|
(github.event.pull_request.author_association == 'OWNER' ||
|
|
github.event.pull_request.author_association == 'MEMBER' ||
|
|
github.event.pull_request.author_association == 'COLLABORATOR')
|
|
) ||
|
|
(
|
|
github.event_name == 'issue_comment' &&
|
|
github.event.issue.pull_request &&
|
|
(contains(github.event.comment.body, '@claude') ||
|
|
contains(github.event.comment.body, '/review')) &&
|
|
(github.event.comment.author_association == 'OWNER' ||
|
|
github.event.comment.author_association == 'MEMBER' ||
|
|
github.event.comment.author_association == 'COLLABORATOR')
|
|
)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: write # needed to push fork branch to origin
|
|
pull-requests: write
|
|
issues: read
|
|
id-token: write
|
|
|
|
steps:
|
|
# For issue_comment triggers, resolve the PR number, head SHA, and branch name
|
|
- name: Resolve PR context
|
|
id: pr
|
|
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
|
|
with:
|
|
script: |
|
|
let pr;
|
|
if (context.eventName === 'issue_comment') {
|
|
const resp = await github.rest.pulls.get({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.payload.issue.number,
|
|
});
|
|
pr = resp.data;
|
|
} else {
|
|
pr = context.payload.pull_request;
|
|
}
|
|
core.setOutput('number', pr.number);
|
|
core.setOutput('sha', pr.head.sha);
|
|
core.setOutput('branch', pr.head.ref);
|
|
core.setOutput('is_fork', String(pr.head.repo.full_name !== pr.base.repo.full_name));
|
|
|
|
- name: Checkout PR head
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
with:
|
|
ref: ${{ steps.pr.outputs.sha }}
|
|
fetch-depth: 1
|
|
|
|
# claude-code-action fetches branches by name from origin, which fails
|
|
# for fork PRs. Work around by pushing the fork branch to origin so
|
|
# the action can find it. Cleaned up in the post step below.
|
|
- name: Push fork branch to origin
|
|
if: steps.pr.outputs.is_fork == 'true'
|
|
run: git push origin HEAD:refs/heads/${{ steps.pr.outputs.branch }}
|
|
|
|
- name: Run Claude Code Review
|
|
id: claude-review
|
|
uses: anthropics/claude-code-action@9469d113c6afd29550c402740f22d1a97dd1209b # v1
|
|
with:
|
|
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
|
|
plugins: 'code-review@claude-code-plugins'
|
|
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ steps.pr.outputs.number }}'
|
|
|
|
# Clean up the temporary branch we pushed for fork PRs
|
|
- name: Delete fork branch from origin
|
|
if: always() && steps.pr.outputs.is_fork == 'true'
|
|
run: git push origin --delete refs/heads/${{ steps.pr.outputs.branch }} || true
|