ci: let PR comments trigger a Claude review reconcile round - #166
Conversation
Extend the pr-review job to run on issue_comment events on PRs so the shared claude-pr-review action can reconcile open review questions and findings. Skips the bot's own comments, keys concurrency off the issue number, and checks out the PR head when triggered by a comment. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GCc8MLBBAp5jAxc2x19swa
Claude review status
🛠️ Review did not finish Attempted head This round did not publish: MODEL_ACTION_FAILED in phase review_retry. Anything listed below is from the last round that did. Re-run the workflow or push a new commit to try again. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d1487c1f6c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| (github.event_name == 'issue_comment' && | ||
| github.event.issue.pull_request != null && | ||
| github.event.comment.user.login != 'mega-maxwell[bot]') |
There was a problem hiding this comment.
For a comment on a fork-based PR, issue_comment runs the trusted default-branch workflow with repository secrets available, and this condition lets any commenter trigger the job; the subsequent checkout loads the fork's mutable PR head before invoking Claude with both the OAuth secret and a repository installation token. A fork author can therefore place hostile agent instructions in the branch and post an ordinary comment to make the privileged agent process them, bypassing the secret withholding that protects normal pull_request runs from forks. Gate this path on a trusted author association, or run fork reconciliation without privileged credentials and write access.
Useful? React with 👍 / 👎.
| (github.event_name == 'issue_comment' && | ||
| github.event.issue.pull_request != null && | ||
| github.event.comment.user.login != 'mega-maxwell[bot]') |
There was a problem hiding this comment.
When a member, collaborator, or owner posts a top-level PR comment containing @claude, it satisfies both the existing interactive condition and this new unconditional PR-comment branch. The jobs have no shared concurrency, and the interactive job has contents: write, so a request that edits the branch can race with pr-review checking out and reviewing the old head, producing stale findings in addition to running two paid agents for one comment. Exclude interactive-command comments from this branch, or serialize the review after the interactive job.
Useful? React with 👍 / 👎.
2 participants
Summary
Extends the Claude pr-review job in
.github/workflows/claude.ymlto supportissue_comment-triggered reconciliation of open review questions/findings, using the sharedclaude-pr-reviewaction's new support for this (see megaeth-labs/.github#8).The
on:block already deliversissue_comment: [created]; this change wires those events into the pr-review job. Three changes, everything else preserved:if:— the existingpull_requestcondition is kept verbatim (wrapped in parens) and OR'd with anissue_commentbranch that only fires on PR comments and skips the bot's own comments (mega-maxwell[bot]).github.event.issue.numberwhengithub.event.pull_request.numberis absent (comment events), so a comment-triggered run serializes against the same PR.refs/pull/<n>/headwhen triggered by a comment, so the review runs against the PR head.No other job and the
on:block are unchanged.🤖 Generated with Claude Code