feat(skills): browse + select nested GitHub-repo skills for a pack #243
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code Review | |
| on: | |
| # Runs automatically on every push to an open PR (synchronize), and is also | |
| # re-runnable ON DEMAND via the Actions tab / `gh workflow run` against a PR | |
| # number (workflow_dispatch) — for when you want a fresh review without | |
| # pushing a new commit. | |
| pull_request: | |
| types: [opened, synchronize, ready_for_review, reopened] | |
| branches: [staging, main] | |
| workflow_dispatch: | |
| inputs: | |
| pr_number: | |
| description: "PR number to review" | |
| required: true | |
| type: string | |
| # One review per PR head — a new push (or dispatch) cancels the review of the | |
| # stale diff. | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number || inputs.pr_number }} | |
| cancel-in-progress: true | |
| jobs: | |
| claude-review: | |
| # Drafts get reviewed when marked ready (ready_for_review) or dispatched | |
| # manually, not on every WIP push. | |
| if: ${{ github.event_name == 'workflow_dispatch' || !github.event.pull_request.draft }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # lets the review reference CI results | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| # pull_request: default (the merge SHA). workflow_dispatch: the PR head. | |
| ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/pull/{0}/head', inputs.pr_number) || github.sha }} | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | |
| plugins: 'code-review@claude-code-plugins' | |
| # The plugin and its subagents need gh + the inline-comment MCP tool; | |
| # without --comment the plugin reviews but never posts. | |
| claude_args: '--allowedTools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),mcp__github_inline_comment__create_inline_comment"' | |
| prompt: | | |
| /code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number || inputs.pr_number }} --comment | |
| Repo-specific review focus for Harness: | |
| - Secrets: agent credentials must stay write-only — plaintext only | |
| transits FastAPI (AES-GCM); it must never reach the browser, | |
| Convex documents (ciphertext only), sandbox disk (launcher | |
| scripts especially), or logs. | |
| - Convex: schema changes must be additive/optional; public | |
| queries/mutations must check ctx.auth identity and never expose | |
| ciphertext; internal functions are deploy-key-only. | |
| - ACP gateway (packages/fastapi/app/services/agents): watch for | |
| session-lifecycle races (park/adopt/steal/revive), event-stream | |
| replay hazards (seq cursors, JSON-RPC id collisions), and relay | |
| requests that could execute more than once. | |
| - Frontend: chat components are shared between the basic chat and | |
| workspaces routes — changes must work in both; biome formatting | |
| and the harness/session chatConfigScope semantics apply. | |
| # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md | |
| # or https://code.claude.com/docs/en/cli-reference for available options |