claude-code-review.yml

# Copy to .github/workflows/claude-code-review.yml in your repo.
# NOTE: requires either CLAUDE_CODE_OAUTH_TOKEN (Claude Max plan) or
# ANTHROPIC_API_KEY (direct API / GitHub App via /install-github-app). Pass
# secrets explicitly (below) rather than via `secrets: inherit`: GitHub only
# inherits secrets into a reusable workflow owned by the same org/user, so a
# cross-owner caller (e.g. a UCD-SERG-org repo calling this d-morrison
# user-owned workflow) inherits an empty token and the run fails env-validation.
# The workflow_dispatch path lets claude.yml re-dispatch a review after an
# @claude run pushes commits — keep the file named claude-code-review.yml (or
# set claude.yml's review-workflow-file to match).
name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'Pull request number to review'
        required: true
        type: string

jobs:
  review:
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write
      actions: read   # lets the reviewer read CI status (github_ci MCP server)
    uses: Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v2
    secrets:
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}   # Max-plan OAuth; empty when using API key
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}               # direct API key; empty when using OAuth
      SUBMODULES_TOKEN: ${{ secrets.SUBMODULES_TOKEN }}   # optional; empty when unset
    with:
      # Wires the workflow_dispatch input through so claude.yml can re-dispatch
      # a review on Claude's commits; empty (and ignored) for pull_request runs.
      pr-number: ${{ inputs.pr_number }}
    # with:
    #   checkout-submodules: true   # SUBMODULES_TOKEN secret only for private submodules
    #   allowed-bots: 'github-actions[bot],claude'   # accept more bot actors (default: github-actions[bot])
    #   prompt-addendum: |
    #     Repo-specific review guidance (e.g. Quarto/R conventions to enforce).