Sync upstream (main) #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: claude-mention | |
| # @claude mention handler on PR conversation comments, inline review | |
| # comments, and review bodies. See the header comment in | |
| # claude-review.yml for why this is self-contained rather than calling | |
| # the org reusable workflows. | |
| # | |
| # Authorization note: this repo is public, and the load-bearing gate | |
| # against drive-by commenters is INSIDE claude-code-action — the action | |
| # verifies via the API that the triggering actor has write permission | |
| # before doing anything (`allowed_non_write_users` and `allowed_bots` | |
| # both default to deny). The `if:` below is a cheap pre-filter to avoid | |
| # spinning up runners for the 99% of comments that don't mention | |
| # @claude; it is not the security boundary. | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| pull_request_review: | |
| types: [submitted] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| actions: read | |
| id-token: write | |
| jobs: | |
| mention: | |
| # Skip comments/reviews that don't mention @claude, non-PR issue | |
| # comments, and events from claude[bot] itself (its review prose | |
| # often quotes "@claude" and must not retrigger the workflow). | |
| if: > | |
| ( | |
| (github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request != null && | |
| contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && | |
| contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && | |
| contains(github.event.review.body, '@claude')) | |
| ) && | |
| github.actor != 'claude[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| concurrency: | |
| group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 1 | |
| - name: Configure AWS credentials (OIDC) | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }} | |
| aws-region: us-east-2 | |
| - name: Claude | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| use_bedrock: 'true' | |
| additional_permissions: | | |
| actions: read | |
| track_progress: true | |
| claude_args: | | |
| --model global.anthropic.claude-opus-4-8 | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)" |