ai-toolkit/.github/workflows/claude-docs-check.yml at 4b3ce0ff93b8dadd833da97028f7745a86252890 · Uniswap/ai-toolkit · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
name: "Claude Docs Check"

# Validates that PR documentation is properly updated
#
# This workflow checks:
# - CLAUDE.md files are updated when code changes
# - README.md files reflect current state
# - Plugin versions are bumped when plugin code changes
#
# Trigger: Runs on all PRs and can be triggered manually
#
# For more information, see:
# https://github.com/Uniswap/ai-toolkit/blob/main/.github/workflows/CLAUDE.md

on:
  pull_request:
    types: [opened, synchronize, reopened]

  # Manual trigger for re-running on specific PRs
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to check"
        required: true
        type: string
      suggestion_mode:
        description: "How to provide suggestions"
        required: false
        type: choice
        options:
          - suggest
          - branch
          - auto
          - check
        default: suggest
      auto_commit:
        description: "Automatically commit and push suggestions to the PR branch"
        required: false
        type: boolean
        default: false

# Prevent concurrent runs on the same PR
permissions: {}

concurrency:
  group: docs-check-${{ github.event.pull_request.number || github.event.inputs.pr_number }}
  cancel-in-progress: true

jobs:
  docs-check:
    # Skip bots and fork PRs (fork code is attacker-controlled)
    # workflow_dispatch fork check is handled inside _claude-docs-check.yml
    if: |
      github.event_name == 'workflow_dispatch' ||
      (
        github.event_name == 'pull_request' &&
        !contains(github.event.pull_request.user.login, '[bot]') &&
        github.event.pull_request.head.repo.full_name == github.repository
      )
    permissions:
      id-token: write
      contents: write
      pull-requests: write
      issues: read
      actions: read
    uses: ./.github/workflows/_claude-docs-check.yml
    with:
      pr_number: ${{ github.event.pull_request.number || github.event.inputs.pr_number }}
      suggestion_mode: ${{ github.event.inputs.suggestion_mode || 'suggest' }}
      auto_commit: ${{ github.event.inputs.auto_commit == 'true' }}
      # Use sonnet for faster, cheaper checks
      model: "claude-sonnet-5"
      # Fail if plugin versions aren't bumped
      fail_on_missing_version: true
      # Don't fail on missing docs (just warn)
      fail_on_missing_docs: false
      # Pin to main rather than the trigger ref. ${{ github.head_ref || github.ref_name }}
      # would let any PR author point the worker at action.yml / post-*.ts script
      # content from their own branch — the worker then downloads and executes
      # that content with the workflow's secrets (RCE-with-secrets via supply
      # chain). Self-testing changes to worker scripts is now done by landing
      # them to `next` first and verifying there, or by invoking the
      # workflow_dispatch entrypoint with an explicit SHA in the allowlist.
      #
      # External repos copying this file as a template: keep this as 'main'.
      # The reusable worker's toolkit_ref allowlist now blocks fork-branch
      # values, but `next` is permitted and would pick up untested worker
      # changes; pinning to 'main' avoids that.
      toolkit_ref: 'main'
    secrets:
      # Use OAuth token (Pro/Max) instead of API key
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
      # PAT for branch creation
      WORKFLOW_PAT: ${{ secrets.WORKFLOW_PAT }}