diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml new file mode 100644 index 00000000..c880092b --- /dev/null +++ b/.github/workflows/claude-review.yml @@ -0,0 +1,29 @@ +name: Claude Auto Review + +# Thin caller for the org-wide review workflow in source-cooperative/.github. +# Only the trigger, permissions, and the token live here; the prompt, plugins, +# concurrency, and action version are shared. See that repo's README. +on: + pull_request: + # No ready_for_review: drafts are already reviewed on opened/synchronize, so + # flipping to ready re-runs the same review against an unchanged diff. + types: [opened, synchronize, reopened] + # Skip when a PR touches workflow files: the action can't validate/run + # against modified workflows and fails with "401 Unauthorized - Workflow + # validation failed". + paths-ignore: + - '.github/workflows/**' + +jobs: + review: + uses: source-cooperative/.github/.github/workflows/claude-pr-review.yml@main + # Granted here because a called workflow can only maintain or reduce the + # caller's token permissions, never elevate them. + permissions: + contents: read + pull-requests: write + id-token: write + # Mapped explicitly rather than `secrets: inherit` so the review job gets + # only this token, not every secret this repo holds. + secrets: + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} diff --git a/.github/workflows/pr-review-comprehensive.yml b/.github/workflows/pr-review-comprehensive.yml deleted file mode 100644 index 0a7c4e58..00000000 --- a/.github/workflows/pr-review-comprehensive.yml +++ /dev/null @@ -1,64 +0,0 @@ -name: Claude Auto Review -on: - pull_request: - types: [opened, synchronize, reopened] - # Skip when a PR touches workflow files: the action can't validate/run - # against modified workflows and fails with "401 Unauthorized - Workflow - # validation failed". - paths-ignore: - - '.github/workflows/**' - -# Cancel an in-flight review when a new commit is pushed: the latest commit is -# the only one worth reviewing, and all runs share one sticky comment anyway. -concurrency: - group: claude-review-${{ github.event.pull_request.number }} - cancel-in-progress: true - -jobs: - review: - if: github.event.pull_request.user.type != 'Bot' - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - id-token: write - steps: - - uses: actions/checkout@v6 - with: - fetch-depth: 1 - - - uses: anthropics/claude-code-action@v1 - with: - claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - # Allow the github-actions bot to trigger the review so that - # Claude-authored PRs get reviewed. Without this, the action - # aborts on bot actors ("Workflow initiated by non-human - # actor"). - allowed_bots: "github-actions" - # Deliver the review as ONE sticky PR comment that updates in place each - # run. track_progress forces tag mode (a single tracking comment the - # action owns and updates with the final result on these pull_request - # events); use_sticky_comment makes it the SAME comment across pushes. - # Replaces the prior formal-review approach, which left multiple reviews - # per run and accumulated undismissable COMMENTED reviews across runs - # (GitHub can't dismiss or delete a submitted COMMENTED review). - track_progress: true - use_sticky_comment: true - prompt: | - REPO: ${{ github.repository }} - PR: ${{ github.event.pull_request.number }} - - Review this pull request's diff for correctness bugs, security issues, - and clear best-practice problems. Skip nits and anything the linter or - formatter already enforces. - - Your final message is delivered as the PR review comment automatically — - do NOT post any comment or review yourself. Just produce the review: - - Start with a single bold verdict line: `**✅ No blocking issues — safe - to merge.**` when nothing is blocking, or `**❌ Changes requested — see - findings below.**` when there are blocking issues. - - Follow with a short bullet list of findings, each citing `path:line` - and, where a concrete fix exists, a fenced code block with the fix. - - If nothing is blocking, say so briefly; do not pad. - claude_args: | - --allowedTools "Bash(gh pr diff:*),Bash(gh pr view:*)"