claude-code-review.yml

# AI PR review using @uniswap/review-cli (private GitHub Packages).
#
# Replaces the previous call into the Uniswap/ai-toolkit reusable
# workflow (`_claude-code-review.yml`). Derived from the upstream
# template (packages/review-cli/templates/workflows/review.yml in
# Uniswap/internal-tools) and the shape already running in
# Uniswap/backend, Uniswap/universe, and Uniswap/tjar, then adapted to
# preserve this repo's extra behavior: automated-PR classification and
# the skipped-review notice.
#
# Four triggers, three jobs:
#
#   pull_request                ┐
#   issue_comment               ├──▶ triage (gate) ──▶ review
#   pull_request_review_comment │                  └──▶ review-skipped
#   workflow_dispatch           ┘
#
# Gate, trigger-phrase, and reaction logic live in the cli
# (`review-cli triage` / `react` / `reply`). This file is a thin adapter.
# No `${{ github.event.* }}` interpolation reaches any `run:` block —
# that is a command-injection sink when the field is user-controlled
# (comment body, branch name, PR title). The cli reads those values as
# data from GITHUB_EVENT_PATH, never as shell tokens.
#
# The workflow `name:` is unchanged so the documented
# `gh workflow run "Claude Code Review"` invocation keeps working.
#
# That is NOT what makes this safe for branch protection. Required status
# checks match check-run / job names, not workflow names, and this rewrite
# renames every job. Verified separately against the live ruleset
# (`repos/Uniswap/uniswap-ai/rulesets/12307596`): the required contexts are
# Socket Security, Check Eval Coverage, Run Evaluations, semgrep, docs-check,
# Vercel, and Security Analysis (zizmor) — none from this workflow. Do not
# generalize "the workflow name didn't change" into a rule; check the
# ruleset.

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

  # Comment trigger: "@request-claude-review" on a PR forces a fresh
  # review. Works for both top-level PR comments and inline review
  # comments.
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

  # Manual trigger, for forcing a review without pushing code.
  #   gh workflow run "Claude Code Review" -f pr_number=123
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'Pull request number to review'
        required: true
        type: string
      force_review:
        description: "Force a full review even if the code hasn't changed (bypasses change detection)"
        required: false
        type: boolean
        default: true

permissions: {}

concurrency:
  group: claude-review-${{ github.event.pull_request.number || github.event.issue.number || inputs.pr_number || github.run_id }}
  # `cancel-in-progress` is evaluated against the INCOMING run's event, so
  # this reads: a push cancels whatever is in flight for this PR; a comment
  # trigger or manual fire queues behind it instead of cancelling.
  #
  # This differs from the old workflow, which used `false` and never
  # cancelled. The change is deliberate — reviewing code that a newer push
  # has already replaced spends budget on a stale answer — but it is
  # asymmetric on purpose and has one consequence worth naming: a push CAN
  # cancel a review a human just asked for by comment. That is handled
  # rather than ignored, in the finalization steps at the end of the review
  # job, which report `cancelled` as its own terminal state rather than
  # folding it into "failed".
  #
  # Deliberately ONE group across all trigger types, not one per type.
  # Splitting the group would stop pushes from cancelling comment runs, but
  # would then let two reviews run concurrently against the same sticky
  # comment. Serialization is worth more than avoiding the cancellation.
  #
  # The predicate mirrors the first clause of the triage gate below, so a
  # cancellation only happens for events that will actually produce a
  # replacement review. A bare `github.event_name == 'pull_request'` also
  # fired for pushes this repo refuses to review (a human's draft, a fork),
  # cancelling a comment-triggered review that nothing then replaced. Note
  # this repo DOES review claude[bot] drafts, so the draft test cannot be a
  # bare `draft == false`.
  #
  # Folded scalar with continuation lines at matching indent, so YAML
  # collapses this to one line before Actions parses the expression.
  cancel-in-progress: >-
    ${{ github.event_name == 'pull_request'
    && github.event.pull_request.head.repo.fork == false
    && (github.event.pull_request.draft == false
    || github.event.action == 'ready_for_review'
    || github.event.pull_request.user.login == 'claude[bot]') }}

env:
  # vars.REVIEW_CLI_VERSION is the authoritative pin — set it in repo
  # settings to roll forward without a commit. Declared once here so the
  # two install blocks below cannot drift onto different versions.
  # Fallback matches what Uniswap/universe runs today.
  REVIEW_CLI_VERSION: ${{ vars.REVIEW_CLI_VERSION || '1.10.6' }}
  # The Claude Code binary the SDK shells out to. install.sh accepts
  # `stable | latest | X.Y.Z`, so pin it rather than floating: an
  # unpinned install makes the review non-reproducible run-to-run for no
  # benefit. The installer verifies the binary's SHA256 against
  # downloads.claude.ai's per-version manifest and hard-fails on
  # mismatch, so integrity is already covered; this is about determinism.
  CLAUDE_CODE_VERSION: ${{ vars.CLAUDE_CODE_VERSION || '2.1.212' }}
  # Matches `packageManager` in the root package.json. vars.BUN_VERSION
  # is documented in .github/workflows/CLAUDE.md but is not currently set
  # on the repo, so the fallback is load-bearing.
  BUN_VERSION: ${{ vars.BUN_VERSION || '1.3.13' }}

jobs:
  triage:
    name: Triage
    runs-on: ubuntu-latest
    # Coarse event-level gate. `review-cli triage` below is the
    # authoritative policy lookup; this `if:` avoids paying runner
    # startup for events that obviously don't apply, AND is the trust
    # boundary for comment triggers: only OWNER / MEMBER / COLLABORATOR
    # comments may start a run. That matters because the review job
    # checks out PR head code in a job holding an LLM credential, so an
    # outside contributor must not be able to trigger it by commenting.
    #
    # The draft condition reproduces the outgoing workflow exactly:
    # drafts are skipped, EXCEPT the event that marks one ready, and
    # EXCEPT drafts opened by claude[bot] (this repo's agent opens draft
    # PRs and wants them reviewed — both currently-open PRs are
    # claude-authored). `.claude/review.yml` sets `skip.drafts: false` so
    # the cli defers the draft decision to this expression rather than
    # applying its own default, which would drop the claude[bot] case.
    if: |
      (github.event_name == 'pull_request'
        && !github.event.pull_request.head.repo.fork
        && (github.event.pull_request.draft == false
            || github.event.action == 'ready_for_review'
            || github.event.pull_request.user.login == 'claude[bot]')) ||
      (github.event_name == 'issue_comment'
        && github.event.issue.pull_request != null
        && contains(github.event.comment.body, '@request-claude-review')
        && github.event.comment.user.type != 'Bot'
        && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
      (github.event_name == 'pull_request_review_comment'
        && !github.event.pull_request.head.repo.fork
        && contains(github.event.comment.body, '@request-claude-review')
        && github.event.comment.user.type != 'Bot'
        && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
      github.event_name == 'workflow_dispatch'
    permissions:
      contents: read # sparse checkout of the base-branch review policy
      packages: read # pull @uniswap/review-cli from GitHub Packages
      issues: write # 👀 reaction on issue_comment
      pull-requests: write # 👀 reaction on pull_request_review_comment
    outputs:
      run: ${{ steps.gate.outputs.run }}
      pr_number: ${{ steps.gate.outputs.pr_number }}
      comment_id: ${{ steps.gate.outputs.comment_id }}
      trigger_source: ${{ steps.gate.outputs.trigger_source }}
      note: ${{ steps.gate.outputs.note }}
      commenter: ${{ steps.gate.outputs.commenter }}
      thread_anchor: ${{ steps.gate.outputs.thread_anchor }}
      reply_id: ${{ steps.post_reply.outputs.id }}
      is_automated: ${{ steps.automated.outputs.is_automated }}
      category: ${{ steps.automated.outputs.category }}
      skip_reason: ${{ steps.automated.outputs.skip_reason }}
    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: ${{ env.BUN_VERSION }}

      # Install BEFORE any checkout, for two independent reasons:
      #
      # 1. Nothing is on disk yet, so dependency resolution cannot be
      #    steered by repository content.
      # 2. The reaction / reply steps below must be able to report a
      #    terminal state even when a later step fails, and they need
      #    `steps.install.outputs.bin`.
      #
      # review-cli is published only to GitHub Packages, so the @uniswap
      # scope must be routed there — and only for this install. The repo's
      # own bunfig.toml pins @uniswap to registry.npmjs.org (correctly:
      # that is where this repo's public packages live). Bun supports
      # per-scope but not per-package registry overrides, so the install
      # runs from a scratch directory under $RUNNER_TEMP with its own
      # bunfig, and BUN_CONFIG_FILE points at it explicitly so neither
      # the repo's bunfig nor any other on disk can steer it.
      #
      # That isolation also sidesteps the repo bunfig's
      # `minimumReleaseAge = 259200` (3 days), which would otherwise
      # block a freshly published review-cli patch release.
      - name: Install review-cli
        id: install
        env:
          GH_PACKAGES_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          install_dir="$RUNNER_TEMP/review-cli-install"
          mkdir -p "$install_dir"
          cat > "$install_dir/bunfig.toml" <<EOF
          [install.scopes]
          "@uniswap" = { url = "https://npm.pkg.github.com", token = "$GH_PACKAGES_TOKEN" }
          EOF
          cd "$install_dir"
          export BUN_CONFIG_FILE="$install_dir/bunfig.toml"
          bun init -y > /dev/null
          # A 403 here means the package grant is missing, not that the
          # workflow is wrong. Say so, rather than leaving the next reader
          # to decode a bare `- 403` out of the raw log.
          if ! bun add "@uniswap/review-cli@${REVIEW_CLI_VERSION}" 2> "$RUNNER_TEMP/bun-add.err"; then
            cat "$RUNNER_TEMP/bun-add.err" >&2
            if grep -q '403' "$RUNNER_TEMP/bun-add.err"; then
              echo "::error::403 from GitHub Packages. $GITHUB_REPOSITORY has no read access to @uniswap/review-cli. Fix: Uniswap/internal-tools -> Packages -> review-cli -> Package settings -> Manage Actions access -> add this repository. This is a per-repo grant; no workflow change can confer it."
            fi
            exit 1
          fi
          # The bunfig holds GITHUB_TOKEN in cleartext and is no longer
          # needed once the package is resolved. Remove it rather than
          # leaving it under $RUNNER_TEMP for the rest of the job — in the
          # review job that means it would otherwise sit on disk while the
          # untrusted PR tree is being analyzed.
          rm -f "$install_dir/bunfig.toml" "$RUNNER_TEMP/bun-add.err"
          echo "bin=$install_dir/node_modules/.bin/review-cli" >> "$GITHUB_OUTPUT"

      # Gate policy and the automated-PR classifier are read from the
      # DEFAULT BRANCH, never from the PR. Two reasons:
      #
      # 1. A PR must not be able to edit the rules that decide whether it
      #    gets reviewed, or supply the shell that classifies it. A bare
      #    `actions/checkout` on a `pull_request` event resolves to
      #    `refs/pull/N/merge` — the PR author's tree — which is how the
      #    outgoing workflow ended up running the PR's own copy of
      #    `.github/actions/check-automated-pr`.
      # 2. Only these two paths are fetched, so the repo's root
      #    bunfig.toml / .npmrc never land on disk in this job.
      - name: Checkout gate policy from the default branch
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.repository.default_branch || github.ref_name }}
          sparse-checkout: |
            .claude/review.yml
            .github/actions/check-automated-pr
          sparse-checkout-cone-mode: false
          persist-credentials: false
          fetch-depth: 1

      # review-cli's loadConfig() returns its DEFAULT config when
      # `.claude/review.yml` is missing OR unparseable — silently, by
      # design. Those defaults are precisely the skip policy this repo must
      # NOT inherit: `authors: ["*[bot]"]` stops reviewing claude[bot] and
      # Dependabot PRs, and `drafts: true` drops claude[bot] drafts. So a
      # typo in the sparse-checkout pattern above, or a YAML error in the
      # config, would quietly restore the behavior this migration exists to
      # prevent. Fail loudly instead.
      - name: Verify gate policy is on disk and parseable
        run: |
          set -euo pipefail
          if [ ! -s .claude/review.yml ]; then
            echo "::error::.claude/review.yml is missing or empty after the sparse checkout. review-cli would silently fall back to its default skip policy, which skips bot-authored and Dependabot PRs. Refusing to run with unknown gate policy."
            exit 1
          fi
          python3 -c 'import sys,yaml; yaml.safe_load(open(".claude/review.yml"))' || {
            echo "::error::.claude/review.yml is not valid YAML. review-cli would silently fall back to its default skip policy. Refusing to run with unknown gate policy."
            exit 1
          }
          echo ".claude/review.yml present and parseable ($(wc -c < .claude/review.yml) bytes)"

      # Same shared composite action the outgoing workflow used, and the
      # same one ci-pr-checks.yml and ci-check-pr-title.yml use, so
      # automated-PR classification has exactly one definition. It is a
      # pure string match over the branch name and PR title — no repo
      # access, no network. Only meaningful for `pull_request`; comment
      # and manual triggers are explicit human requests and are never
      # classified as automated (matching the outgoing workflow, which
      # documented "Comment triggers bypass automated PR checks — if you
      # explicitly request a review, you get one").
      - name: Check for automated PR
        id: automated
        if: github.event_name == 'pull_request'
        uses: ./.github/actions/check-automated-pr
        with:
          branch_name: ${{ github.head_ref }}
          pr_title: ${{ github.event.pull_request.title }}

      # Reads GITHUB_EVENT_NAME + GITHUB_EVENT_PATH itself and writes the
      # decision to GITHUB_OUTPUT. Config IS loaded (no --skip-config):
      # `.claude/review.yml` sets `skip.authors: []` and
      # `skip.drafts: false` to switch off cli defaults that would
      # otherwise silently drop bot-authored and draft PRs — both of
      # which this repo reviews today. See that file for the reasoning.
      #
      # BUN_CONFIG_FILE is pinned here too. Nothing untrusted is on disk in
      # this job — the sparse checkout is verified above to bring only the
      # two default-branch paths — but that safety currently rests entirely
      # on those patterns staying narrow. Pinning it removes the coupling,
      # matching what the review job does after its PR-head checkout.
      - name: Decide whether to run
        id: gate
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: '"$REVIEW_CLI" triage --from-github-actions'

      - name: Acknowledge comment trigger (👀)
        if: |
          steps.gate.outputs.run == 'true' &&
          steps.gate.outputs.comment_id != ''
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ steps.gate.outputs.comment_id }}
          EVENT_NAME: ${{ github.event_name }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
        run: |
          "$REVIEW_CLI" react \
            --repo "$GH_REPO" \
            --comment-id "$COMMENT_ID" \
            --event "$EVENT_NAME" \
            --reaction ack

      # A visible "working on it" reply under the trigger comment. The 👀
      # is glanceable; this carries the run URL. Best-effort.
      - name: Post running-state reply
        id: post_reply
        if: |
          steps.gate.outputs.run == 'true' &&
          steps.gate.outputs.comment_id != ''
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ steps.gate.outputs.pr_number }}
          COMMENT_ID: ${{ steps.gate.outputs.comment_id }}
          EVENT_NAME: ${{ github.event_name }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          REPLY_BODY: |
            ↻ **Reviewing now** · [view run ↗](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})

            This comment will update when the review completes. Findings will appear in the sticky summary above.
        run: |
          OUT="$RUNNER_TEMP/reply-id.txt"
          "$REVIEW_CLI" reply \
            --repo "$GH_REPO" \
            --pr "$PR_NUMBER" \
            --event "$EVENT_NAME" \
            --in-reply-to "$COMMENT_ID" \
            --body "$REPLY_BODY" \
            --out-id "$OUT"
          if [ -s "$OUT" ]; then
            echo "id=$(cat "$OUT")" >> "$GITHUB_OUTPUT"
          fi

  review:
    name: AI review
    needs: triage
    # Automated PRs are skipped EXCEPT dependency bumps. Those are worth
    # reviewing on their own merits (supply-chain risk, breaking changes in
    # a transitive major), and `.claude/review.yml` staffs
    # dependency-upgrade-reviewer for them. `is_automated` is empty for
    # comment and manual triggers (the classifier step is skipped), so
    # those always proceed.
    if: |
      needs.triage.outputs.run == 'true' &&
      (needs.triage.outputs.is_automated != 'true' || needs.triage.outputs.category == 'deps')
    runs-on: ubuntu-latest
    # contents:write (not read) is required for the resolveReviewThread
    # GraphQL mutation; pull-requests:write alone returns "Resource not
    # accessible by integration".
    # https://github.com/orgs/community/discussions/44650
    permissions:
      contents: write # resolveReviewThread GraphQL mutation (see above)
      packages: read # pull @uniswap/review-cli from GitHub Packages
      pull-requests: write # post the review, inline threads, and reactions
      issues: write # reactions and replies on top-level PR comments
    # The outgoing workflow passed timeout_minutes: 20 to the reusable
    # workflow. 30 here because review-cli fans out to several reviewer
    # agents rather than making one pass, and the budget caps in
    # .claude/review.yml are the real cost limiter.
    timeout-minutes: 30
    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: ${{ env.BUN_VERSION }}

      # Install first — same two reasons as in triage, and here the
      # second one has teeth: the finalization steps at the bottom of this
      # job run on every terminal state (two gated `!cancelled()`, the
      # third `cancelled()`) under `continue-on-error: true`. If
      # install ran after the guards below and a guard failed, those
      # steps would find `steps.install.outputs.bin` empty, silently
      # no-op, and a rejected trigger comment would keep its 👀 and
      # "Reviewing now" reply forever — indistinguishable from a hung
      # review.
      - name: Install review-cli
        id: install
        env:
          GH_PACKAGES_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          install_dir="$RUNNER_TEMP/review-cli-install"
          mkdir -p "$install_dir"
          cat > "$install_dir/bunfig.toml" <<EOF
          [install.scopes]
          "@uniswap" = { url = "https://npm.pkg.github.com", token = "$GH_PACKAGES_TOKEN" }
          EOF
          cd "$install_dir"
          export BUN_CONFIG_FILE="$install_dir/bunfig.toml"
          bun init -y > /dev/null
          # A 403 here means the package grant is missing, not that the
          # workflow is wrong. Say so, rather than leaving the next reader
          # to decode a bare `- 403` out of the raw log.
          if ! bun add "@uniswap/review-cli@${REVIEW_CLI_VERSION}" 2> "$RUNNER_TEMP/bun-add.err"; then
            cat "$RUNNER_TEMP/bun-add.err" >&2
            if grep -q '403' "$RUNNER_TEMP/bun-add.err"; then
              echo "::error::403 from GitHub Packages. $GITHUB_REPOSITORY has no read access to @uniswap/review-cli. Fix: Uniswap/internal-tools -> Packages -> review-cli -> Package settings -> Manage Actions access -> add this repository. This is a per-repo grant; no workflow change can confer it."
            fi
            exit 1
          fi
          # The bunfig holds GITHUB_TOKEN in cleartext and is no longer
          # needed once the package is resolved. Remove it rather than
          # leaving it under $RUNNER_TEMP for the rest of the job — in the
          # review job that means it would otherwise sit on disk while the
          # untrusted PR tree is being analyzed.
          rm -f "$install_dir/bunfig.toml" "$RUNNER_TEMP/bun-add.err"
          echo "bin=$install_dir/node_modules/.bin/review-cli" >> "$GITHUB_OUTPUT"

      # Defense in depth for the `ref:` on the PR-head checkout below.
      # pr_number originates from an integer field in the event payload,
      # but it reaches this job as a string job output, so assert it is
      # digits before it can reach actions/checkout as a ref fragment.
      - name: Validate PR number
        env:
          PR_NUMBER: ${{ needs.triage.outputs.pr_number }}
        run: |
          case "$PR_NUMBER" in
            '' | *[!0-9]*)
              echo "::error::Refusing to proceed: pr_number is not numeric."
              exit 1
              ;;
          esac
          echo "pr_number validated: $PR_NUMBER"

      # Authoritative fork guard, for every trigger.
      #
      # `issue_comment` payloads have no `pull_request` object at all, so the
      # triage `if:` cannot express a head-repo check for that event. (The
      # other two comment-ish events can, and now do — but only this step
      # covers `issue_comment` and `workflow_dispatch`, which takes an
      # arbitrary PR number.) All of those run the base-ref workflow *with*
      # repository secrets, unlike a fork `pull_request`, which gets none.
      #
      # Without this, a MEMBER commenting the trigger phrase on a fork PR
      # would reach the `refs/pull/N/head` checkout below in a job holding
      # contents:write and the LLM credential, and review-cli reads
      # `.claude/` from the checked-out tree as agent policy. That is the
      # Cantina #655 / #692 shape.
      #
      # Failure modes, all closed, but by two different mechanisms:
      #   - API error / rate limit / 404: the command substitution's
      #     non-zero status propagates and `set -e` aborts.
      #   - Deleted head repo: `.head.repo` is null. jq would print the
      #     STRING "null" and exit 0 — `set -e` does NOT fire here. The
      #     `// ""` plus the emptiness check below is what catches it, not
      #     the exit status. Keep both; they cover different cases.
      - name: Refuse fork PRs
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ needs.triage.outputs.pr_number }}
        run: |
          set -euo pipefail
          HEAD_REPO=$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" --jq '.head.repo.full_name // ""')
          if [ -z "$HEAD_REPO" ]; then
            echo "::error::Could not resolve the head repository for PR #$PR_NUMBER (deleted fork, or unexpected API response). Refusing to proceed."
            exit 1
          fi
          if [ "$HEAD_REPO" != "$GH_REPO" ]; then
            echo "::error::Refusing to review a fork PR (head=$HEAD_REPO). Fork code must not run in a job holding repository secrets."
            exit 1
          fi
          echo "same-repo PR confirmed (head=$HEAD_REPO)"

      - name: Verify an LLM credential is present
        env:
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |
          if [ -z "$CLAUDE_CODE_OAUTH_TOKEN" ] && [ -z "$ANTHROPIC_API_KEY" ]; then
            echo "::error::No LLM credential. Set CLAUDE_CODE_OAUTH_TOKEN (preferred) or ANTHROPIC_API_KEY as a repo secret."
            exit 1
          fi

      # The SDK looks for a per-platform Claude Code binary shipped via
      # optional deps; Bun on Linux extracts only the host variant while
      # the SDK probes the musl path first. The official installer
      # sidesteps that. Version is pinned (see CLAUDE_CODE_VERSION above)
      # and install.sh verifies the download's SHA256 against the
      # per-version manifest itself.
      - name: Install Claude Code binary
        run: |
          set -euo pipefail
          curl -fsSL https://claude.ai/install.sh | bash -s -- "$CLAUDE_CODE_VERSION"
          for candidate in "$HOME/.local/bin/claude" "$HOME/.claude/bin/claude" "$HOME/.npm-global/bin/claude"; do
            [ -x "$candidate" ] && { CLAUDE_BIN="$candidate"; break; }
          done
          [ -z "${CLAUDE_BIN:-}" ] && CLAUDE_BIN="$(command -v claude || true)"
          [ -z "$CLAUDE_BIN" ] && { echo "::error::claude binary not found"; exit 1; }
          echo "CLAUDE_CODE_EXECUTABLE_PATH=$CLAUDE_BIN" >> "$GITHUB_ENV"
          dirname "$CLAUDE_BIN" >> "$GITHUB_PATH"

      # The ONLY checkout of PR-author content in this workflow, and it is
      # explicitly pinned to the PR head rather than left to default (a
      # bare checkout resolves to refs/pull/N/merge on pull_request, and
      # to the default branch on comment events — the latter silently
      # reviews main instead of the PR).
      #
      # Everything from here runs with untrusted files in the working
      # directory, so every subsequent step that can invoke bun sets
      # BUN_CONFIG_FILE=/dev/null: bun auto-loads ./bunfig.toml from CWD
      # and executes its `preload` array in-process, which is the
      # mechanism behind Cantina #655. This repo genuinely has a root
      # bunfig.toml, so that neutralization is load-bearing here rather
      # than theoretical. The install above already completed against its
      # own pinned bunfig, before any of this was on disk.
      - name: Checkout PR head
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
          ref: refs/pull/${{ needs.triage.outputs.pr_number }}/head

      - name: Pre — running sticky placeholder
        continue-on-error: true
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ needs.triage.outputs.pr_number }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: '"$REVIEW_CLI" post "$PR_NUMBER" --repo "$GH_REPO" --pre'

      # Trigger context flows in via env vars, never shell interpolation,
      # so a malicious comment body cannot break out.
      #
      # Change-detection bypass, precisely. `pipelines/analyze.ts` derives
      # `isExplicitRerun = triggerSource in (comment, review_comment,
      # manual)` and skips only when `!changed && !force && !isExplicitRerun`.
      # So all three human-initiated paths already re-review regardless of
      # change detection, purely from `--trigger-source`, which is always
      # passed below.
      #
      # `--force` therefore does not control the bypass; it additionally
      # lifts the per-agent size/turn guards. REVIEW_FORCE maps
      # workflow_dispatch's `force_review: true` onto it, which is the
      # closest equivalent to the old input.
      #
      # Honest note on parity: because `manual` is in `isExplicitRerun`, a
      # dispatch with `force_review: false` still re-reviews rather than
      # honoring the cache. That is more eager than the old workflow, not
      # less, so it loses no coverage — but it is not exact parity.
      - name: Analyze
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          REVIEW_NOTE: ${{ needs.triage.outputs.note }}
          REVIEW_TRIGGER_SOURCE: ${{ needs.triage.outputs.trigger_source }}
          REVIEW_COMMENTER: ${{ needs.triage.outputs.commenter }}
          REVIEW_THREAD_ANCHOR: ${{ needs.triage.outputs.thread_anchor }}
          REVIEW_FORCE: ${{ (github.event_name == 'workflow_dispatch' && inputs.force_review) && '1' || '' }}
          # Pin the artifact paths so the upload steps below can read them
          # back; the cli default is ./ which would land inside the PR
          # checkout.
          REVIEW_CLI_ARTIFACT_PATH: ${{ runner.temp }}/review-cli-output.json
          REVIEW_CLI_TOKENS_ARTIFACT_PATH: ${{ runner.temp }}/agent-tokens.jsonl
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ needs.triage.outputs.pr_number }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: |
          "$REVIEW_CLI" review "$PR_NUMBER" \
            --repo "$GH_REPO" \
            --trigger-source "$REVIEW_TRIGGER_SOURCE" \
            ${REVIEW_NOTE:+--note "$REVIEW_NOTE"} \
            ${REVIEW_COMMENTER:+--commenter "$REVIEW_COMMENTER"} \
            ${REVIEW_THREAD_ANCHOR:+--thread-anchor "$REVIEW_THREAD_ANCHOR"} \
            ${REVIEW_FORCE:+--force} \
            --live

      - name: Post
        if: success() || failure()
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          PR_NUMBER: ${{ needs.triage.outputs.pr_number }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: '"$REVIEW_CLI" post "$PR_NUMBER" --repo "$GH_REPO"'

      - name: Upload run artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: review-cli-run-${{ needs.triage.outputs.pr_number }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/review-cli-output.json
          if-no-files-found: warn
          retention-days: 30

      # Name MUST be exactly `agent-tokens` so the agent-scorecard
      # aggregator finds it across consumer repos.
      - name: Upload agent-tokens artifact
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: agent-tokens
          path: ${{ runner.temp }}/agent-tokens.jsonl
          if-no-files-found: ignore
          retention-days: 30
          overwrite: true

      # `!cancelled()` runs on success and failure but not cancellation,
      # which is what we want: a cancelled run is not a failed one, so
      # leaving the 👀 in place is accurate rather than overwriting it with 👎
      # and telling the commenter their request broke.
      #
      # Gated by the status-check function, NOT by comparing `job.status` in
      # bash. `job.status` is documented to be one of success / failure /
      # cancelled, but nothing specifies that it interpolates to `cancelled`
      # for a step of the job currently being cancelled, so a bash comparison
      # against it is an unverified assumption.
      - name: Update reaction (👍 / 👎) on comment trigger
        if: |
          !cancelled() &&
          needs.triage.outputs.comment_id != ''
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OUTCOME: ${{ job.status }}
          GH_REPO: ${{ github.repository }}
          COMMENT_ID: ${{ needs.triage.outputs.comment_id }}
          EVENT_NAME: ${{ github.event_name }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: |
          REACTION=$([ "$OUTCOME" = "success" ] && echo "success" || echo "failure")
          "$REVIEW_CLI" react \
            --repo "$GH_REPO" \
            --comment-id "$COMMENT_ID" \
            --event "$EVENT_NAME" \
            --reaction "$REACTION" \
            --clear-prior-ack

      # Success and failure only. Cancellation is the step after this one,
      # gated on `cancelled()` — see the note there.
      - name: Update threaded reply with terminal state
        if: |
          !cancelled() &&
          needs.triage.outputs.reply_id != ''
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          OUTCOME: ${{ job.status }}
          GH_REPO: ${{ github.repository }}
          REPLY_ID: ${{ needs.triage.outputs.reply_id }}
          EVENT_NAME: ${{ github.event_name }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: |
          if [ "$OUTCOME" = "success" ]; then
            BODY="✅ **Reviewed** · [view run ↗](${RUN_URL}) · scroll up for the full summary."
          else
            BODY="⚠ **Review failed** · [view run ↗](${RUN_URL}) · scroll up for the partial state, or comment \`@request-claude-review\` to retry."
          fi
          "$REVIEW_CLI" reply \
            --repo "$GH_REPO" \
            --event "$EVENT_NAME" \
            --edit-reply "$REPLY_ID" \
            --body "$BODY"

      # Cancellation is a third terminal state, not a kind of failure. It
      # gets its own step because `cancelled()` is the only documented way to
      # detect it; the previous version branched on `job.status` inside the
      # step above, which may never have matched.
      #
      # The copy reports the observable fact and hedges the cause. The
      # earlier wording asserted a supersede, but a manual cancel from the
      # Actions UI produces the same state with no newer review behind it, so
      # that stated a cause we cannot know. It also dropped the retry hint,
      # which matters most on exactly that path, because nothing else is
      # coming.
      - name: Update threaded reply when the run is cancelled
        if: |
          cancelled() &&
          needs.triage.outputs.reply_id != ''
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_REPO: ${{ github.repository }}
          REPLY_ID: ${{ needs.triage.outputs.reply_id }}
          EVENT_NAME: ${{ github.event_name }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          REVIEW_CLI: ${{ steps.install.outputs.bin }}
          BUN_CONFIG_FILE: /dev/null
        run: |
          # Cancellation can land before the install step finished, in which
          # case there is no binary to post with. Exit clean rather than
          # failing a step whose job is already cancelled.
          if [ -z "${REVIEW_CLI:-}" ] || [ ! -x "$REVIEW_CLI" ]; then
            echo "review-cli not installed (cancelled early); leaving the reply as-is"
            exit 0
          fi
          BODY="⏹ **Cancelled** · this run was cancelled before finishing — most often because a newer push to this PR started a fresh review · [view run ↗](${RUN_URL}) · comment \`@request-claude-review\` if you still need one."
          "$REVIEW_CLI" reply \
            --repo "$GH_REPO" \
            --event "$EVENT_NAME" \
            --edit-reply "$REPLY_ID" \
            --body "$BODY"

  # Explains in the checks UI why an automated PR got no review, so a
  # missing review reads as "deliberately skipped" rather than "broken".
  # Preserved from the outgoing workflow.
  review-skipped:
    name: Review skipped
    needs: triage
    if: |
      needs.triage.outputs.is_automated == 'true' &&
      needs.triage.outputs.category != 'deps'
    runs-on: ubuntu-latest
    # No token needed: this job only writes a ::notice:: annotation.
    permissions: {}
    steps:
      - uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3 # v0.8.4

      - name: Report skipped review
        env:
          SKIP_REASON: ${{ needs.triage.outputs.skip_reason }}
        run: |
          echo "::notice::Code review skipped for automated PR: $SKIP_REASON"
          echo "✅ Automated PR detected - code review is not required for this PR type."