claude-code.yml

## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Consumer wrapper. Docs live in the reusable:
## https://github.com/org-ai-assisted/developer-meta-files/blob/master/.github/workflows/reusable-claude-code-review.yml

name: Claude Code Review

on:
  pull_request:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  workflow_dispatch:

permissions:
  contents: read

## issue_comment / pull_request_review_comment fire with
## github.ref = default branch (NOT the PR head ref). Plain
## ${{ github.ref }} would queue unrelated PRs' comment-triggered
## runs into the same group. The PR/issue-number fallback chain
## isolates per-PR.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
  cancel-in-progress: true

jobs:
  review:
    uses: org-ai-assisted/developer-meta-files/.github/workflows/reusable-claude-code-review.yml@master
    ## Explicit secret forwarding (NOT 'secrets: inherit'). With
    ## inherit, every caller-side secret would flow into the
    ## reusable; the explicit map caps the reusable's secrets
    ## context to exactly ANTHROPIC_API_KEY.
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write