Sync rustwright-cloud changes to rustwright (#27) #42
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code Review | |
| # Automated PR review by Claude, on every opened/updated pull request. | |
| # Requires a repository secret CLAUDE_CODE_OAUTH_TOKEN (create with `claude setup-token`). | |
| # If the secret is not set, the review is skipped (the job still succeeds) instead of failing. | |
| # The review prompt is loaded from the BASE branch so untrusted PRs cannot alter | |
| # review behavior by editing the prompt file in the same PR. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize] | |
| jobs: | |
| claude-review: | |
| # Skip PRs opened by Claude itself or by GitHub Actions to avoid review loops. | |
| if: | | |
| !contains(fromJSON('["claude","claude[bot]","github-actions[bot]"]'), github.event.pull_request.user.login) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: read | |
| id-token: write | |
| steps: | |
| - name: Check for Claude token | |
| id: gate | |
| env: | |
| CLAUDE_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| run: | | |
| if [ -n "$CLAUDE_TOKEN" ]; then | |
| echo "enabled=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "enabled=false" >> "$GITHUB_OUTPUT" | |
| echo "::notice::CLAUDE_CODE_OAUTH_TOKEN is not set — skipping Claude review. Add it with 'gh secret set CLAUDE_CODE_OAUTH_TOKEN'." | |
| fi | |
| - name: Checkout repository | |
| if: steps.gate.outputs.enabled == 'true' | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 1 | |
| - name: Delete previous Claude review comment | |
| if: steps.gate.outputs.enabled == 'true' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| # Remove any prior review comment (identified by the marker) so each | |
| # push replaces the review instead of stacking comments. | |
| gh api "repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments" \ | |
| --jq '.[] | select(.body | contains("<!-- claude-code-review -->")) | .id' \ | |
| | while read -r id; do | |
| if [ -n "$id" ]; then | |
| echo "Deleting previous Claude review comment: $id" | |
| gh api "repos/${{ github.repository }}/issues/comments/$id" -X DELETE | |
| fi | |
| done | |
| - name: Load review prompt from base branch | |
| if: steps.gate.outputs.enabled == 'true' | |
| id: prompt | |
| run: | | |
| # Load the prompt from the PR's BASE commit (trusted), not the PR head. | |
| git fetch --no-tags --depth=1 origin "${{ github.event.pull_request.base.sha }}" | |
| BASE="${{ github.event.pull_request.base.sha }}" | |
| DELIM="PROMPT_EOF_$(openssl rand -hex 16)" | |
| { | |
| printf 'content<<%s\n' "$DELIM" | |
| git show "${BASE}:.github/prompts/code-review.md" | |
| printf '%s\n' "$DELIM" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Run Claude Code Review | |
| if: steps.gate.outputs.enabled == 'true' | |
| uses: anthropics/claude-code-action@ff9acae5886d41a99ed4ec14b7dc147d55834722 # v1.0.77 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| allowed_bots: "dependabot[bot],github-actions[bot],renovate[bot]" | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| ${{ steps.prompt.outputs.content }} | |
| # Read-only review: Claude may inspect the repo and the PR, and post one comment. | |
| claude_args: >- | |
| --max-turns 30 | |
| --allowed-tools "Read,Glob,Grep,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh issue view:*)" |