Skip to content

Commit dafe7e5

Browse files
theMickstertheMickster
authored
[PM-26935]
Craft a reusable workflow to consolidating Claude business logic into one place
1 parent be38f10 commit dafe7e5

File tree

2 files changed

+149
-143
lines changed

2 files changed

+149
-143
lines changed

‎.github/workflows/_review-code.yml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: Code Review
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
AZURE_SUBSCRIPTION_ID:
7+
required: true
8+
AZURE_TENANT_ID:
9+
required: true
10+
AZURE_CLIENT_ID:
11+
required: true
12+
13+
jobs:
14+
validation:
15+
name: Validation
16+
runs-on: ubuntu-24.04
17+
permissions:
18+
contents: read
19+
outputs:
20+
should_review: ${{ steps.validate.outputs.should_review }}
21+
22+
steps:
23+
- name: Check PR requirements
24+
id: check-pr
25+
env:
26+
IS_DRAFT: ${{ github.event.pull_request.draft }}
27+
run: |
28+
if [ "$IS_DRAFT" == "true" ]; then
29+
echo "⚠️ Validation: PR is a draft - skipping review"
30+
echo "pr_valid=false" >> $GITHUB_OUTPUT
31+
else
32+
echo "✅ Validation: PR is ready for review"
33+
echo "pr_valid=true" >> $GITHUB_OUTPUT
34+
fi
35+
36+
- name: Check if prompt file exists using GitHub CLI
37+
id: check-prompt
38+
env:
39+
GH_TOKEN: ${{ github.token }}
40+
REPO: ${{ github.repository }}
41+
REF: ${{ github.event.pull_request.head.sha }}
42+
FILE_PATH: ".claude/prompts/review-code.md"
43+
run: |
44+
if gh api "repos/$REPO/contents/$FILE_PATH?ref=$REF" --silent 2>/dev/null; then
45+
echo "prompt_exists=true" >> $GITHUB_OUTPUT
46+
echo "✅ Found $FILE_PATH in $REPO"
47+
else
48+
echo "prompt_exists=false" >> $GITHUB_OUTPUT
49+
echo "⚠️ Validation: No $FILE_PATH found - skipping Claude review"
50+
fi
51+
52+
- name: Set validation result
53+
id: validate
54+
env:
55+
PR_VALID: ${{ steps.check-pr.outputs.pr_valid }}
56+
PROMPT_EXISTS: ${{ steps.check-prompt.outputs.prompt_exists }}
57+
run: |
58+
if [ "$PR_VALID" == "true" ] && \
59+
[ "$PROMPT_EXISTS" == "true" ]; then
60+
echo "should_review=true" >> $GITHUB_OUTPUT
61+
echo "✅ Validation passed - code review will proceed"
62+
else
63+
echo "should_review=false" >> $GITHUB_OUTPUT
64+
echo "⚠️ Validation failed - code review will be skipped"
65+
fi
66+
67+
review:
68+
name: Review
69+
runs-on: ubuntu-24.04
70+
needs: validation
71+
if: needs.validation.outputs.should_review == 'true'
72+
permissions:
73+
contents: read
74+
id-token: write
75+
pull-requests: write
76+
77+
steps:
78+
- name: Check out repo
79+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
80+
with:
81+
fetch-depth: 0
82+
ref: ${{ github.event.pull_request.head.sha }}
83+
persist-credentials: false
84+
85+
- name: Log in to Azure
86+
uses: bitwarden/gh-actions/azure-login@main
87+
with:
88+
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
89+
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
90+
client_id: ${{ secrets.AZURE_CLIENT_ID }}
91+
92+
- name: Get Azure Key Vault secrets
93+
id: get-kv-secrets
94+
uses: bitwarden/gh-actions/get-keyvault-secrets@main
95+
with:
96+
keyvault: gh-org-bitwarden
97+
secrets: "ANTHROPIC-API-KEY"
98+
99+
- name: Log out from Azure
100+
uses: bitwarden/gh-actions/azure-logout@main
101+
102+
- name: Build review prompt
103+
id: build-prompt
104+
env:
105+
PR_REPO: ${{ github.repository }}
106+
PR_NUMBER: ${{ github.event.pull_request.number }}
107+
PR_TITLE: ${{ github.event.pull_request.title }}
108+
PR_BODY: ${{ github.event.pull_request.body }}
109+
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
110+
PR_COMMIT: ${{ github.event.pull_request.head.sha }}
111+
run: |
112+
PROMPT_FILE=".claude/prompts/review-code.md"
113+
114+
# Build the full prompt with GitHub context + repo's prompt
115+
{
116+
printf "REPO: %s\n" "$PR_REPO"
117+
printf "PR NUMBER: %s\n" "$PR_NUMBER"
118+
printf "TITLE: %s\n" "$PR_TITLE"
119+
printf "BODY: %s\n" "$PR_BODY"
120+
printf "AUTHOR: %s\n" "$PR_AUTHOR"
121+
printf "COMMIT: %s\n" "$PR_COMMIT"
122+
printf "\n"
123+
printf "Note: The PR branch is already checked out in the current working directory.\n"
124+
printf "\n---\n\n"
125+
cat "$PROMPT_FILE"
126+
} > /tmp/review-prompt.md
127+
128+
# Output the prompt
129+
{
130+
echo 'FINAL_PROMPT<<EOF'
131+
cat /tmp/review-prompt.md
132+
echo 'EOF'
133+
} >> "$GITHUB_OUTPUT"
134+
135+
- name: Review with Claude Code
136+
uses: anthropics/claude-code-action@e8bad572273ce919ba15fec95aef0ce974464753 # v1.0.13
137+
with:
138+
anthropic_api_key: ${{ steps.get-kv-secrets.outputs.ANTHROPIC-API-KEY }}
139+
track_progress: true
140+
use_sticky_comment: true
141+
prompt: ${{ steps.build-prompt.outputs.FINAL_PROMPT }}
142+
claude_args: |
143+
--allowedTools "mcp__github_comment__update_claude_comment,mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*)"

‎.github/workflows/review-code.yml‎

Lines changed: 6 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -4,152 +4,15 @@ on:
44
pull_request:
55
types: [opened, synchronize, reopened, ready_for_review]
66

7-
permissions:
8-
contents: read
9-
pull-requests: write
10-
117
jobs:
12-
validation:
13-
name: Validation
14-
runs-on: ubuntu-24.04
15-
permissions:
16-
contents: read
17-
outputs:
18-
should_review: ${{ steps.validate.outputs.should_review }}
19-
20-
steps:
21-
- name: Check PR requirements
22-
id: check-pr
23-
run: |
24-
if [ "${{ github.event.pull_request.draft }}" == "true" ]; then
25-
echo "⚠️ Validation: PR is a draft - skipping review"
26-
echo "pr_valid=false" >> $GITHUB_OUTPUT
27-
else
28-
echo "✅ Validation: PR is ready for review"
29-
echo "pr_valid=true" >> $GITHUB_OUTPUT
30-
fi
31-
32-
- name: Check for Azure credentials
33-
id: check-azure-secret
34-
env:
35-
_AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
36-
_AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
37-
_AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
38-
run: |
39-
if [ -n "$_AZURE_SUBSCRIPTION_ID" ] && [ -n "$_AZURE_TENANT_ID" ] && [ -n "$_AZURE_CLIENT_ID" ]; then
40-
echo "credentials_valid=true" >> $GITHUB_OUTPUT
41-
echo "✅ Validation: Azure credentials available"
42-
else
43-
echo "credentials_valid=false" >> $GITHUB_OUTPUT
44-
echo "⚠️ Validation: Azure credentials not available"
45-
echo "This is expected for external contributors or forks"
46-
fi
47-
48-
- name: Check if prompt file exists
49-
id: check-prompt
50-
env:
51-
GH_TOKEN: ${{ github.token }}
52-
run: |
53-
# Use GitHub API to check file existence WITHOUT checkout
54-
FILE_PATH=".claude/prompts/review-code.md"
55-
REPO="${{ github.repository }}"
56-
REF="${{ github.event.pull_request.head.sha }}"
57-
58-
# Check if file exists via API
59-
if gh api "repos/$REPO/contents/$FILE_PATH?ref=$REF" --silent 2>/dev/null; then
60-
echo "prompt_exists=true" >> $GITHUB_OUTPUT
61-
echo "✅ Found $FILE_PATH in $REPO"
62-
else
63-
echo "prompt_exists=false" >> $GITHUB_OUTPUT
64-
echo "⚠️ Validation: No $FILE_PATH found - skipping Claude review"
65-
fi
66-
67-
- name: Set validation result
68-
id: validate
69-
run: |
70-
if [ "${{ steps.check-pr.outputs.pr_valid }}" == "true" ] && \
71-
[ "${{ steps.check-azure-secret.outputs.credentials_valid }}" == "true" ] && \
72-
[ "${{ steps.check-prompt.outputs.prompt_exists }}" == "true" ]; then
73-
echo "should_review=true" >> $GITHUB_OUTPUT
74-
echo "✅ Validation passed - code review will proceed"
75-
else
76-
echo "should_review=false" >> $GITHUB_OUTPUT
77-
echo "⚠️ Validation failed - code review will be skipped"
78-
fi
79-
808
review:
819
name: Review
82-
runs-on: ubuntu-24.04
83-
needs: validation
84-
if: needs.validation.outputs.should_review == 'true'
10+
uses: bitwarden/gh-actions/.github/workflows/_review-code.yml@main
11+
secrets:
12+
AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
13+
AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
14+
AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
8515
permissions:
8616
contents: read
87-
id-token: write
8817
pull-requests: write
89-
90-
steps:
91-
- name: Check out repo
92-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
93-
with:
94-
fetch-depth: 0
95-
persist-credentials: false
96-
97-
- name: Log in to Azure
98-
uses: bitwarden/gh-actions/azure-login@main
99-
with:
100-
subscription_id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
101-
tenant_id: ${{ secrets.AZURE_TENANT_ID }}
102-
client_id: ${{ secrets.AZURE_CLIENT_ID }}
103-
104-
- name: Get Azure Key Vault secrets
105-
id: get-kv-secrets
106-
uses: bitwarden/gh-actions/get-keyvault-secrets@main
107-
with:
108-
keyvault: gh-org-bitwarden
109-
secrets: "ANTHROPIC-API-KEY"
110-
111-
- name: Log out from Azure
112-
uses: bitwarden/gh-actions/azure-logout@main
113-
114-
- name: Build review prompt
115-
id: build-prompt
116-
env:
117-
PR_REPO: ${{ github.repository }}
118-
PR_NUMBER: ${{ github.event.pull_request.number }}
119-
PR_TITLE: ${{ github.event.pull_request.title }}
120-
PR_BODY: ${{ github.event.pull_request.body }}
121-
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
122-
PR_COMMIT: ${{ github.event.pull_request.head.sha }}
123-
run: |
124-
PROMPT_FILE=".claude/prompts/review-code.md"
125-
126-
# Build the full prompt with GitHub context + repo's prompt
127-
{
128-
printf "REPO: %s\n" "$PR_REPO"
129-
printf "PR NUMBER: %s\n" "$PR_NUMBER"
130-
printf "TITLE: %s\n" "$PR_TITLE"
131-
printf "BODY: %s\n" "$PR_BODY"
132-
printf "AUTHOR: %s\n" "$PR_AUTHOR"
133-
printf "COMMIT: %s\n" "$PR_COMMIT"
134-
printf "\n"
135-
printf "Note: The PR branch is already checked out in the current working directory.\n"
136-
printf "\n---\n\n"
137-
cat "$PROMPT_FILE"
138-
} > /tmp/review-prompt.md
139-
140-
# Output the prompt
141-
{
142-
echo 'FINAL_PROMPT<<EOF'
143-
cat /tmp/review-prompt.md
144-
echo 'EOF'
145-
} >> "$GITHUB_OUTPUT"
146-
147-
- name: Review with Claude Code
148-
uses: anthropics/claude-code-action@e8bad572273ce919ba15fec95aef0ce974464753 # v1.0.13
149-
with:
150-
anthropic_api_key: ${{ steps.get-kv-secrets.outputs.ANTHROPIC-API-KEY }}
151-
track_progress: true
152-
use_sticky_comment: true
153-
prompt: ${{ steps.build-prompt.outputs.FINAL_PROMPT }}
154-
claude_args: |
155-
--allowedTools "mcp__github_comment__update_claude_comment,mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*)"
18+
id-token: write

0 commit comments

Comments
 (0)