| 1 | name: Claude PR Review |
| 2 | |
| 3 | # Advisory AI code review by Claude (anthropics/claude-code-action) on every |
| 4 | # non-draft PR. CODEOWNERS (@Hmbown) stays the human owner — this review posts |
| 5 | # alongside it, it does not replace approval. |
| 6 | # |
| 7 | # Setup: add a CLAUDE_CODE_OAUTH_TOKEN repository secret |
| 8 | # 1. Run `claude setup-token` locally (Pro/Max subscription) to mint a token. |
| 9 | # 2. Settings -> Secrets and variables -> Actions -> New repository secret. |
| 10 | # Until the secret exists the job no-ops with a notice (stays green), so this |
| 11 | # workflow is safe to merge before the token is configured. |
| 12 | |
| 13 | on: |
| 14 | pull_request: |
| 15 | types: [opened, synchronize, reopened, ready_for_review] |
| 16 | branches: [master, main] |
| 17 | |
| 18 | concurrency: |
| 19 | group: claude-review-${{ github.event.pull_request.number }} |
| 20 | cancel-in-progress: true |
| 21 | |
| 22 | jobs: |
| 23 | claude-review: |
| 24 | name: Claude review |
| 25 | if: github.event.pull_request.draft == false |
| 26 | runs-on: ubuntu-latest |
| 27 | env: |
| 28 | HAS_OAUTH: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN != '' }} |
| 29 | permissions: |
| 30 | contents: read |
| 31 | pull-requests: write |
| 32 | id-token: write |
| 33 | steps: |
| 34 | - name: Skip when token is unset |
| 35 | if: env.HAS_OAUTH != 'true' |
| 36 | run: echo "::notice::CLAUDE_CODE_OAUTH_TOKEN is not set — skipping Claude review. Add the secret to enable it." |
| 37 | |
| 38 | - name: Checkout repository |
| 39 | if: env.HAS_OAUTH == 'true' |
| 40 | uses: actions/checkout@v7 |
| 41 | with: |
| 42 | fetch-depth: 1 |
| 43 | |
| 44 | - name: Claude code review |
| 45 | if: env.HAS_OAUTH == 'true' |
| 46 | uses: anthropics/claude-code-action@v1 |
| 47 | with: |
| 48 | claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
| 49 | track_progress: true |
| 50 | prompt: | |
| 51 | REPO: ${{ github.repository }} |
| 52 | PR NUMBER: ${{ github.event.pull_request.number }} |
| 53 | |
| 54 | You are reviewing a pull request against CodeWhale, a Rust workspace |
| 55 | (an agentic coding TUI/runtime). The PR branch is already checked out |
| 56 | in the current working directory. |
| 57 | |
| 58 | Review the diff and report findings in this priority order: |
| 59 | 1. Correctness bugs: logic errors, panics, unwrap/expect on fallible |
| 60 | paths, race conditions, incorrect error handling, off-by-one, and |
| 61 | non-exhaustive matches that could break compilation. |
| 62 | 2. Provider/model/route safety (v0.8.65 EPIC #2608 invariant): a |
| 63 | provider-prefixed model string (e.g. `deepseek-ai/`, `deepseek/`, |
| 64 | `anthropic/`, `openai/`, `qwen/`) is a wire id or namespace hint, |
| 65 | never proof of provider selection. Flag any code that infers a |
| 66 | provider/model switch from such a prefix or from freeform prompt |
| 67 | text rather than from explicit user choice, config, Fleet policy, |
| 68 | capability requirements, or fallback policy. |
| 69 | 3. Reuse and simplification: duplicated logic, dead code, needless |
| 70 | allocation/cloning, or reimplementing something the workspace |
| 71 | already provides. |
| 72 | 4. Tests: missing coverage for new behavior and edge cases. |
| 73 | 5. Security: secret handling, shell/exec policy, input validation. |
| 74 | |
| 75 | Be specific and concise. Use inline comments for line-specific issues |
| 76 | and one top-level comment for the summary. Note genuinely good choices |
| 77 | briefly. Do not nitpick style that `cargo fmt` / `clippy` already |
| 78 | enforce. |
| 79 | |
| 80 | claude_args: | |
| 81 | --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(git log:*),Bash(git diff:*)" |
| 82 |