mirror of
https://github.com/abhigyanpatwari/GitNexus.git
synced 2026-09-23 00:41:36 +00:00
df429ea60c
Bumps [actions/github-script](https://github.com/actions/github-script) from 7.0.1 to 9.0.0. - [Release notes](https://github.com/actions/github-script/releases) - [Commits](https://github.com/actions/github-script/compare/v7.0.1...3a2844b7e9c422d3c10d287c895573f7108da1b3) --- updated-dependencies: - dependency-name: actions/github-script dependency-version: 9.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
96 lines
3.8 KiB
YAML
96 lines
3.8 KiB
YAML
name: Claude Code Review
|
|
|
|
# Uses pull_request_target so the workflow runs as defined on the default branch,
|
|
# which allows access to secrets for posting review comments on fork PRs.
|
|
# SECURITY: The checkout pins the fork's HEAD SHA (not the branch name) to
|
|
# prevent TOCTOU races (force-push between trigger and checkout). The
|
|
# claude-code-action sandboxes execution — it does NOT run arbitrary code
|
|
# from the checked-out source.
|
|
|
|
on:
|
|
# Trigger only when explicitly requested:
|
|
# - Add the "claude-review" label to a PR, OR
|
|
# - Comment "@claude" or "/review" on a PR
|
|
pull_request_target:
|
|
types: [labeled]
|
|
issue_comment:
|
|
types: [created]
|
|
|
|
# Concurrency convention: see CONTRIBUTING.md → "GitHub Actions — Concurrency Convention".
|
|
# Serialize per-PR to avoid racing review comments.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.issue.number || github.event.pull_request.number }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
claude-review:
|
|
# Run only when:
|
|
# 1. The "claude-review" label is added to a non-draft PR by a trusted contributor, OR
|
|
# 2. A trusted contributor comments "@claude" or "/review" on a PR
|
|
if: |
|
|
(
|
|
github.event_name == 'pull_request_target' &&
|
|
github.event.label.name == 'claude-review' &&
|
|
github.event.pull_request.draft == false &&
|
|
(github.event.pull_request.author_association == 'OWNER' ||
|
|
github.event.pull_request.author_association == 'MEMBER' ||
|
|
github.event.pull_request.author_association == 'COLLABORATOR')
|
|
) ||
|
|
(
|
|
github.event_name == 'issue_comment' &&
|
|
github.event.issue.pull_request &&
|
|
(contains(github.event.comment.body, '@claude') ||
|
|
contains(github.event.comment.body, '/review')) &&
|
|
(github.event.comment.author_association == 'OWNER' ||
|
|
github.event.comment.author_association == 'MEMBER' ||
|
|
github.event.comment.author_association == 'COLLABORATOR')
|
|
)
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: read
|
|
id-token: write
|
|
|
|
steps:
|
|
# For issue_comment triggers, resolve the PR number, head SHA, and fork repo
|
|
- name: Resolve PR context
|
|
id: pr
|
|
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v7
|
|
with:
|
|
script: |
|
|
let pr;
|
|
if (context.eventName === 'issue_comment') {
|
|
const resp = await github.rest.pulls.get({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
pull_number: context.payload.issue.number,
|
|
});
|
|
pr = resp.data;
|
|
} else {
|
|
pr = context.payload.pull_request;
|
|
}
|
|
core.setOutput('number', pr.number);
|
|
core.setOutput('sha', pr.head.sha);
|
|
core.setOutput('repo', pr.head.repo.full_name);
|
|
core.setOutput('branch', pr.head.ref);
|
|
|
|
- name: Checkout PR head
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
repository: ${{ steps.pr.outputs.repo }}
|
|
ref: ${{ steps.pr.outputs.sha }}
|
|
fetch-depth: 1
|
|
|
|
- name: Run Claude Code Review
|
|
id: claude-review
|
|
uses: anthropics/claude-code-action@9469d113c6afd29550c402740f22d1a97dd1209b # v1
|
|
with:
|
|
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
github_token: ${{ secrets.GITHUB_TOKEN }}
|
|
allowed_non_write_users: '*'
|
|
show_full_output: true
|
|
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
|
|
plugins: 'code-review@claude-code-plugins'
|
|
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ steps.pr.outputs.number }}'
|