|  | 
|  | 1 | +name: Claude Code Review | 
|  | 2 | + | 
|  | 3 | +on: | 
|  | 4 | +  # For PRs from the same repository (fast path) | 
|  | 5 | +  pull_request: | 
|  | 6 | +    types: | 
|  | 7 | +      - opened | 
|  | 8 | +      - synchronize | 
|  | 9 | +      - ready_for_review | 
|  | 10 | +  # For PRs from forked repositories (secure path with secrets) | 
|  | 11 | +  pull_request_target: | 
|  | 12 | +    types: | 
|  | 13 | +      - opened | 
|  | 14 | +      - synchronize | 
|  | 15 | +      - ready_for_review | 
|  | 16 | + | 
|  | 17 | +jobs: | 
|  | 18 | +  # Job for same-repo PRs (can use OIDC if needed) | 
|  | 19 | +  claude-review-same-repo: | 
|  | 20 | +    if: | | 
|  | 21 | +      github.event_name == 'pull_request' && | 
|  | 22 | +      github.event.pull_request.head.repo.full_name == github.repository && | 
|  | 23 | +      github.event.pull_request.draft == false | 
|  | 24 | +
 | 
|  | 25 | +    runs-on: ubuntu-latest | 
|  | 26 | +    permissions: | 
|  | 27 | +      contents: read | 
|  | 28 | +      pull-requests: read | 
|  | 29 | +      issues: read | 
|  | 30 | +      id-token: write | 
|  | 31 | + | 
|  | 32 | +    steps: | 
|  | 33 | +      - name: Checkout repository | 
|  | 34 | +        uses: actions/checkout@v4 | 
|  | 35 | +        with: | 
|  | 36 | +          fetch-depth: 1 | 
|  | 37 | + | 
|  | 38 | +      - name: Checkout PR branch | 
|  | 39 | +        env: | 
|  | 40 | +          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | 
|  | 41 | +        run: | | 
|  | 42 | +          echo "Checking out PR #${{ github.event.pull_request.number }}" | 
|  | 43 | +          gh pr checkout ${{ github.event.pull_request.number }} | 
|  | 44 | +          echo "✅ PR branch checked out successfully" | 
|  | 45 | +
 | 
|  | 46 | +      - name: Run Claude Code Review | 
|  | 47 | +        id: claude-review | 
|  | 48 | +        uses: anthropics/claude-code-action@v1 | 
|  | 49 | +        with: | 
|  | 50 | +          github_token: ${{ secrets.GITHUB_TOKEN }} | 
|  | 51 | +          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | 
|  | 52 | +          prompt: | | 
|  | 53 | +            REPO: ${{ github.repository }} | 
|  | 54 | +            PR NUMBER: ${{ github.event.pull_request.number }} | 
|  | 55 | +
 | 
|  | 56 | +            Please review this pull request and provide feedback on: | 
|  | 57 | +            - Code quality and best practices | 
|  | 58 | +            - Potential bugs or issues | 
|  | 59 | +            - Performance considerations | 
|  | 60 | +            - Security concerns | 
|  | 61 | +            - Test coverage | 
|  | 62 | +
 | 
|  | 63 | +            # Steps to run a Review: | 
|  | 64 | +              1) Check if previous review is already done by Claude. If so, perform a re-reivew with the latest changes referring previous review. | 
|  | 65 | +              2) If no previous review is found, perform a new review with the latest changes. | 
|  | 66 | +
 | 
|  | 67 | +            Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. | 
|  | 68 | +
 | 
|  | 69 | +            Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR. | 
|  | 70 | +
 | 
|  | 71 | +          claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"' | 
|  | 72 | + | 
|  | 73 | +  # Job for forked PRs (no OIDC, token-based only) | 
|  | 74 | +  claude-review-forked: | 
|  | 75 | +    if: | | 
|  | 76 | +      github.event_name == 'pull_request_target' && | 
|  | 77 | +      github.event.pull_request.head.repo.full_name != github.repository && | 
|  | 78 | +      github.event.pull_request.draft == false | 
|  | 79 | +
 | 
|  | 80 | +    runs-on: ubuntu-latest | 
|  | 81 | +    permissions: | 
|  | 82 | +      contents: read | 
|  | 83 | +      pull-requests: write | 
|  | 84 | +      issues: read | 
|  | 85 | +      # Explicitly disable id-token to avoid OIDC flow | 
|  | 86 | + | 
|  | 87 | +    steps: | 
|  | 88 | +      - name: Checkout repository (no credentials persisted) | 
|  | 89 | +        uses: actions/checkout@v4 | 
|  | 90 | +        with: | 
|  | 91 | +          fetch-depth: 1 | 
|  | 92 | +          persist-credentials: false | 
|  | 93 | + | 
|  | 94 | +      - name: Checkout PR branch (forked PR) | 
|  | 95 | +        env: | 
|  | 96 | +          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | 
|  | 97 | +        run: | | 
|  | 98 | +          echo "⚠️  Forked PR detected - running in secure mode" | 
|  | 99 | +          echo "PR from: ${{ github.event.pull_request.head.repo.full_name }}" | 
|  | 100 | +          echo "Base repo: ${{ github.repository }}" | 
|  | 101 | +          echo "Checking out PR #${{ github.event.pull_request.number }}" | 
|  | 102 | +          gh pr checkout ${{ github.event.pull_request.number }} | 
|  | 103 | +          echo "✅ PR branch checked out successfully" | 
|  | 104 | +
 | 
|  | 105 | +      - name: Run Claude Code Review | 
|  | 106 | +        id: claude-review | 
|  | 107 | +        uses: anthropics/claude-code-action@v1 | 
|  | 108 | +        with: | 
|  | 109 | +          github_token: ${{ secrets.GITHUB_TOKEN }} | 
|  | 110 | +          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | 
|  | 111 | +          prompt: | | 
|  | 112 | +            REPO: ${{ github.repository }} | 
|  | 113 | +            PR NUMBER: ${{ github.event.pull_request.number }} | 
|  | 114 | +
 | 
|  | 115 | +            Please review this pull request and provide feedback on: | 
|  | 116 | +            - Code quality and best practices | 
|  | 117 | +            - Potential bugs or issues | 
|  | 118 | +            - Performance considerations | 
|  | 119 | +            - Security concerns | 
|  | 120 | +            - Test coverage | 
|  | 121 | +
 | 
|  | 122 | +            # Steps to run a Review: | 
|  | 123 | +              1) Check if previous review is already done by Claude. If so, perform a re-reivew with the latest changes referring previous review. | 
|  | 124 | +              2) If no previous review is found, perform a new review with the latest changes. | 
|  | 125 | +
 | 
|  | 126 | +            Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. | 
|  | 127 | +
 | 
|  | 128 | +            Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR. | 
|  | 129 | +
 | 
|  | 130 | +          claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"' | 
0 commit comments