Skip to content

ci: let PR comments trigger a Claude review reconcile round #361

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Troublor merged 1 commit into from
Jul 31, 2026
Merged

ci: let PR comments trigger a Claude review reconcile round #361

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,14 +51,17 @@ jobs:

pr-review:
concurrency:
group: claude-pr-review-${{ github.event.pull_request.number }}
group: claude-pr-review-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: false
if: |
github.event_name == 'pull_request' &&
(github.event.action == 'opened' ||
github.event.action == 'synchronize' ||
github.event.action == 'ready_for_review' ||
github.event.action == 'reopened')
(github.event_name == 'pull_request' &&
(github.event.action == 'opened' ||
github.event.action == 'synchronize' ||
github.event.action == 'ready_for_review' ||
github.event.action == 'reopened')) ||
(github.event_name == 'issue_comment' &&
github.event.issue.pull_request != null &&
github.event.comment.user.login != 'mega-maxwell[bot]')
Comment on lines +62 to +64

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Trigger reconciliation for inline review replies

When a user replies directly to an inline Claude finding, GitHub emits pull_request_review_comment, not issue_comment; although this workflow subscribes to that event at lines 5–6, the new pr-review condition only accepts pull_request and issue_comment. Consequently, the common action of answering a finding in its review thread never starts the intended reconcile round; include the review-comment event while retaining the reviewer-bot guard to prevent self-triggering.

Useful? React with 👍 / 👎.

Comment on lines +62 to +64

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Route @claude comments to only one job

When a trusted member posts a top-level PR comment containing @claude, the existing interactive condition at lines 17–21 and this new unconditional PR-comment branch both evaluate true, so the workflow launches claude-interactive and a full claude-pr-review concurrently for the same comment. This doubles model usage and allows two write-capable jobs to post or reconcile feedback against the same PR; exclude interactive trigger comments from this branch or otherwise route each comment to exactly one job.

Useful? React with 👍 / 👎.

runs-on: ubuntu-24.04
timeout-minutes: 30
permissions:
Expand All @@ -80,6 +83,7 @@ jobs:

- uses: actions/checkout@v4
with:
ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/head', github.event.issue.number) || '' }}

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid privileged checkout of untrusted fork heads

For a fork PR, an issue_comment workflow runs in the base repository context, so this job can access CLAUDE_CODE_OAUTH_TOKEN, MEGA_CI_APP_PK, and the generated repository app token; this new ref then checks out the contributor-controlled PR head before invoking claude-pr-review. Because the condition at lines 62–64 permits any commenter except mega-maxwell[bot], an untrusted user can trigger a secret-bearing AI job over attacker-controlled repository content, unlike the existing pull_request path where fork-triggered runs do not receive repository secrets. Avoid checking out the PR head in this privileged event, or restrict the trigger and fork handling to a trusted workflow design.

Useful? React with 👍 / 👎.

token: ${{ steps.app-token.outputs.token }}
persist-credentials: false
submodules: recursive
Expand Down
Loading