ci: add comment-triggered Claude PR review workflow

Add a PR comment and workflow_dispatch triggered review workflow that calls Claude, validates inline comments against added diff lines, and posts review results through the GitHub API.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: Zachary-wW

.github/scripts/claude-review.py

@@ -0,0 +1,185 @@
+#!/usr/bin/env python3
+# Copyright 2026 The LoongForge Authors.
+# SPDX-License-Identifier: Apache-2.0
+"""Call Claude API to review a PR diff, then post inline review comments."""
+import json
+import os
+import re
+import subprocess
+import sys
+import urllib.request
+
+
+def call_claude(api_key, base_url, model, prompt):
+    payload = {
+        "model": model,
+        "max_tokens": 8192,
+        "messages": [{"role": "user", "content": prompt}],
+    }
+
+    req = urllib.request.Request(
+        f"{base_url}/v1/messages",
+        data=json.dumps(payload).encode(),
+        headers={
+            "x-api-key": api_key,
+            "anthropic-version": "2023-06-01",
+            "content-type": "application/json",
+        },
+    )
+
+    with urllib.request.urlopen(req, timeout=180) as resp:
+        result = json.loads(resp.read())
+
+    for block in result.get("content", []):
+        if block.get("type") == "text" and "text" in block:
+            return block["text"]
+
+    print(
+        f"Claude response did not include a text content block: {json.dumps(result)[:1000]}",
+        file=sys.stderr,
+    )
+    raise RuntimeError("Claude response missing text content block")
+
+
+def parse_diff_files(diff_text):
+    """Extract file paths and their line ranges from a unified diff."""
+    files = {}
+    current_file = None
+    current_line = 0
+
+    for line in diff_text.split("\n"):
+        if line.startswith("+++ b/"):
+            current_file = line[6:]
+            files[current_file] = set()
+        elif line.startswith("@@ "):
+            match = re.search(r"\+(\d+)", line)
+            if match:
+                current_line = int(match.group(1)) - 1
+        elif current_file:
+            if line.startswith("+") and not line.startswith("+++"):
+                current_line += 1
+                files[current_file].add(current_line)
+            elif line.startswith("-"):
+                pass
+            else:
+                current_line += 1
+
+    return files
+
+
+def main():
+    api_key = os.environ.get("ANTHROPIC_API_KEY")
+    base_url = os.environ.get("ANTHROPIC_BASE_URL", "https://api.anthropic.com")
+    model = os.environ.get("CLAUDE_MODEL", "Claude Sonnet 4.6")
+    skill_path = os.environ.get("SKILL_PATH", "skills/loongforge-review/SKILL.md")
+    diff_path = os.environ.get("DIFF_PATH", "/tmp/pr-diff.txt")
+    pr_title = os.environ.get("PR_TITLE", "")
+    pr_author = os.environ.get("PR_AUTHOR", "")
+    pr_number = os.environ.get("PR_NUMBER", "")
+    repo = os.environ.get("GITHUB_REPOSITORY", "")
+
+    if not api_key:
+        print("ERROR: ANTHROPIC_API_KEY not set", file=sys.stderr)
+        sys.exit(1)
+
+    with open(skill_path, "r") as f:
+        skill = f.read()
+
+    with open(diff_path, "r") as f:
+        diff = f.read()
+
+    truncated = len(diff) > 80000
+    diff_trimmed = diff[:80000]
+
+    prompt = f"""{skill}
+
+## PR Information
+
+- Title: {pr_title}
+- Author: {pr_author}
+
+## Diff
+
+```diff
+{diff_trimmed}
+```
+
+{"⚠️ Note: The diff was truncated to 80,000 characters. Review may be incomplete." if truncated else ""}
+
+## Output Requirements
+
+You MUST respond with a valid JSON object (no markdown fencing, no extra text). The JSON must have this exact structure:
+
+{{
+  "verdict": "APPROVE" | "REQUEST_CHANGES" | "COMMENT",
+  "summary": "1-3 sentence overall assessment",
+  "inline_comments": [
+    {{
+      "path": "relative/path/to/file.py",
+      "line": 42,
+      "body": "Issue description with severity prefix: [Critical] or [Warning] or [Suggestion]"
+    }}
+  ]
+}}
+
+Rules for inline_comments:
+- "path" must be a file path that appears in the diff (after +++ b/)
+- "line" must be a line number within a ADDED (+) hunk of the diff
+- "body" should start with [Critical], [Warning], or [Suggestion] followed by the issue
+- Only comment on lines that are CHANGED in this diff, not pre-existing code
+- Keep each comment actionable and concise
+
+Now review this pull request and respond with ONLY the JSON object."""
+
+    try:
+        response = call_claude(api_key, base_url, model, prompt)
+    except urllib.error.HTTPError as e:
+        body = e.read().decode()
+        print(f"API Error ({e.code}): {body}", file=sys.stderr)
+        sys.exit(1)
+    except Exception as e:
+        print(f"Error: {e}", file=sys.stderr)
+        sys.exit(1)
+
+    # Parse JSON from response (handle possible markdown fencing)
+    text = response.strip()
+    if text.startswith("```"):
+        text = re.sub(r"^```(?:json)?\n?", "", text)
+        text = re.sub(r"\n?```$", "", text)
+
+    try:
+        review = json.loads(text)
+    except json.JSONDecodeError:
+        print(f"Failed to parse Claude response as JSON:\n{response[:500]}", file=sys.stderr)
+        # Fall back to posting raw response as comment
+        with open("/tmp/review-result.json", "w") as f:
+            json.dump({"verdict": "COMMENT", "summary": response[:2000], "inline_comments": []}, f)
+        sys.exit(0)
+
+    # Validate inline comments against actual diff
+    diff_files = parse_diff_files(diff)
+    valid_comments = []
+    for comment in review.get("inline_comments", []):
+        path = comment.get("path", "")
+        line = comment.get("line", 0)
+        if path in diff_files and line in diff_files[path]:
+            valid_comments.append(comment)
+        elif path in diff_files:
+            # Line not in diff hunks, try to find nearest valid line
+            valid_lines = sorted(diff_files[path])
+            if valid_lines:
+                nearest = min(valid_lines, key=lambda x: abs(x - line))
+                comment["line"] = nearest
+                comment["body"] = f"{comment['body']} (originally flagged at line {line})"
+                valid_comments.append(comment)
+
+    review["inline_comments"] = valid_comments
+
+    with open("/tmp/review-result.json", "w") as f:
+        json.dump(review, f, ensure_ascii=False)
+
+    print(f"Review complete: {review['verdict']}, {len(valid_comments)} inline comments")
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/claude-review.yml

@@ -0,0 +1,144 @@
+name: Claude PR Review
+
+permissions:
+  contents: read
+  pull-requests: write
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: "PR number to review"
+        required: true
+        type: string
+
+jobs:
+  auto-review:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request &&
+        github.event.comment.body == '/claude-review' &&
+        (
+          contains(fromJSON('["OWNER","MEMBER","COLLABORATOR","CONTRIBUTOR"]'), github.event.comment.author_association) ||
+          github.event.comment.user.login == github.event.issue.user.login
+        )
+      )
+    runs-on: [self-hosted, macOS, ARM64]
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Determine PR number
+        id: pr
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "number=${{ inputs.pr_number }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "number=${{ github.event.issue.number }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Get PR diff
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh pr diff ${{ steps.pr.outputs.number }} > /tmp/pr-diff.txt
+          [ -s /tmp/pr-diff.txt ] || { echo "Empty diff"; exit 1; }
+
+      - name: Get PR metadata
+        id: meta
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh pr view ${{ steps.pr.outputs.number }} --json title,author --jq '"title=" + .title' >> "$GITHUB_OUTPUT"
+          gh pr view ${{ steps.pr.outputs.number }} --json author --jq '"author=" + .author.login' >> "$GITHUB_OUTPUT"
+
+      - name: Run Claude review
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}
+          CLAUDE_MODEL: "Claude Sonnet 4.6"
+          SKILL_PATH: "skills/loongforge-review/SKILL.md"
+          DIFF_PATH: "/tmp/pr-diff.txt"
+          PR_TITLE: ${{ steps.meta.outputs.title }}
+          PR_AUTHOR: ${{ steps.meta.outputs.author }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
+        run: |
+          python3 .github/scripts/claude-review.py
+
+      - name: Delete previous bot reviews
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          gh api "repos/${REPO}/pulls/${PR_NUMBER}/reviews" --jq \
+            '.[] | select(.user.login == "github-actions[bot]") | .id' | \
+          while read -r review_id; do
+            echo "Dismissing old review: $review_id"
+            gh api "repos/${REPO}/pulls/${PR_NUMBER}/reviews/${review_id}" \
+              --method DELETE 2>/dev/null || true
+          done
+
+      - name: Post review with inline comments
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          python3 << 'PYEOF'
+          import json
+          import subprocess
+          import os
+
+          with open("/tmp/review-result.json", "r") as f:
+              review = json.load(f)
+
+          verdict = review.get("verdict", "COMMENT")
+          summary = review.get("summary", "")
+          comments = review.get("inline_comments", [])
+
+          body = "## 🤖 Claude Code Review\n\n"
+          body += f"**Verdict: {verdict}**\n\n"
+          body += f"{summary}\n\n"
+          if comments:
+              body += f"📝 {len(comments)} inline comment(s) posted below.\n\n"
+          body += "---\n*Automated review by Claude Sonnet 4.6 · [Review Skill](skills/loongforge-review/SKILL.md)*"
+
+          pr_number = os.environ["PR_NUMBER"]
+          repo = os.environ["REPO"]
+
+          # Use COMMENT event to avoid blocking merges
+          payload = {
+              "event": "COMMENT",
+              "body": body,
+              "comments": [
+                  {"path": c["path"], "line": c["line"], "body": c["body"]}
+                  for c in comments
+              ],
+          }
+
+          payload_json = json.dumps(payload)
+          result = subprocess.run(
+              ["gh", "api", f"repos/{repo}/pulls/{pr_number}/reviews",
+               "--method", "POST", "--input", "-"],
+              input=payload_json.encode(),
+              capture_output=True,
+          )
+
+          if result.returncode != 0:
+              print(f"Failed to post review: {result.stderr.decode()}")
+              # Fallback: post as simple comment
+              subprocess.run(
+                  ["gh", "pr", "comment", pr_number, "--body", body],
+                  check=True,
+              )
+          else:
+              print("Review posted successfully with inline comments")
+          PYEOF