fix(docker): resolve KICS alerts on lido-governance-monitor Dockerfile #6101
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code Review | |
| on: | |
| pull_request: | |
| types: [opened, edited, synchronize, ready_for_review, reopened] | |
| paths: | |
| - "**/*.js" | |
| - "**/*.jsx" | |
| - "**/*.ts" | |
| - "**/*.tsx" | |
| - "**/*.java" | |
| - "**/*.kt" | |
| - "**/*.go" | |
| - "**/*.py" | |
| - "**/*.rs" | |
| - "**/*.sol" | |
| - "**/*.zkasm" | |
| - "**/*.lisp" | |
| - "**/Makefile" | |
| - "**/*.mk" | |
| - "**/Dockerfile" | |
| - "**/Dockerfile.*" | |
| - "**/*.dockerfile" | |
| - "**/*.sh" | |
| - "**/*.bash" | |
| - "**/*.gradle" | |
| - "**/*.gradle.kts" | |
| - "**/gradlew" | |
| - "**/gradle.properties" | |
| - "**/settings.gradle" | |
| - "**/settings.gradle.kts" | |
| jobs: | |
| claude-review: | |
| # Only run when '@claude-review' is present in the PR description | |
| # and the author is a repo owner, member, or collaborator (i.e. team member) | |
| if: | | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| contains(github.event.pull_request.body, '@claude-review') && | |
| ( | |
| github.event.pull_request.author_association == 'OWNER' || | |
| github.event.pull_request.author_association == 'MEMBER' || | |
| github.event.pull_request.author_association == 'COLLABORATOR' | |
| ) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@521136812280ae7ef256e06045655b9da02793f0 #v1.0.158 | |
| env: | |
| ANTHROPIC_BASE_URL: ${{ vars.LITELLM_BASE_URL }} | |
| with: | |
| anthropic_api_key: ${{ secrets.LITELLM_KEY_CLAUDE_PR_REVIEW }} | |
| # The pinned action's inline-comment classifier calls api.anthropic.com | |
| # directly, ignoring ANTHROPIC_BASE_URL. Disable it so review traffic | |
| # stays on the LiteLLM-routed Claude Code path. | |
| classify_inline_comments: "false" | |
| # use_sticky_comment: false | |
| direct_prompt: | | |
| You are a senior software engineer performing a thorough code review on PR #${{ github.event.pull_request.number }} in ${{ github.repository }}. | |
| Review ONLY changed files with the following extensions or names: | |
| .js .jsx .ts .tsx .java .kt .go .py .rs .sol .sh .bash .gradle .gradle.kts .mk .dockerfile .zkasm .lisp | |
| Makefile gradlew gradle.properties settings.gradle settings.gradle.kts Dockerfile Dockerfile.* | |
| For each issue you find, post an inline pull request review comment on the exact file and line where the problem occurs. | |
| Focus on: | |
| - Bugs and logic errors | |
| - Security vulnerabilities (injection, unsafe deserialization, improper auth, etc.) | |
| - Performance problems | |
| - Code quality, readability, and maintainability issues | |
| - Incorrect or missing error handling | |
| Be specific, actionable, and constructive. Do NOT post a general top-level PR summary comment. | |