stateless-validator/.github/workflows/claude.yml at main · megaeth-labs/stateless-validator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
name: Claude Code
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened, labeled, unlabeled]
  issues:
    types: [opened]

jobs:
  interactive:
    if: |
      (github.event_name == 'issue_comment' &&
       contains(github.event.comment.body, '@claude') &&
       (github.event.comment.author_association == 'MEMBER' ||
        github.event.comment.author_association == 'COLLABORATOR' ||
        github.event.comment.author_association == 'OWNER'))  ||
      (github.event_name == 'pull_request_review_comment' &&
       contains(github.event.comment.body, '@claude') &&
       (github.event.comment.author_association == 'MEMBER' ||
        github.event.comment.author_association == 'COLLABORATOR' ||
        github.event.comment.author_association == 'OWNER')) ||
      (github.event_name == 'pull_request_review' &&
       contains(github.event.review.body, '@claude') &&
       (github.event.review.author_association == 'MEMBER' ||
        github.event.review.author_association == 'COLLABORATOR' ||
        github.event.review.author_association == 'OWNER'))
    runs-on: ubuntu-24.04
    timeout-minutes: 45
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write
      actions: read
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 1

      - uses: megaeth-labs/.github/.github/actions/claude-interactive@main
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          allowed_bots: "mega-putin"
          extra_allowed_tools: "Bash(cargo:*)"

  pr-review:
    # Serialize reviews per PR: a new push queues behind an in-flight review
    # rather than cancelling it, so a partial run never leaves comments/threads
    # in an inconsistent state.
    concurrency:
      group: claude-pr-review-${{ github.event.pull_request.number || github.event.issue.number }}
      cancel-in-progress: false
    if: |
      (github.event_name == 'pull_request' &&
       (github.event.action == 'opened' ||
        github.event.action == 'synchronize' ||
        github.event.action == 'ready_for_review' ||
        github.event.action == 'reopened')) ||
      (github.event_name == 'issue_comment' &&
       github.event.issue.pull_request != null &&
       github.event.comment.user.login != 'mega-maxwell[bot]')
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    permissions:
      contents: read
      pull-requests: write
      id-token: write
      actions: read
    steps:
      # Review under the CI app identity rather than the job token: it is what
      # lets the action resolve stale review threads (the shared action gates
      # --resolve-threads on github_identity_token being non-empty).
      - uses: actions/create-github-app-token@v3
        id: app-token
        with:
          app-id: ${{ vars.CI_APP_ID }}
          private-key: ${{ secrets.MEGA_CI_APP_PK }}
          owner: megaeth-labs
          repositories: stateless-validator

      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/head', github.event.issue.number) || '' }}
          token: ${{ steps.app-token.outputs.token }}
          persist-credentials: false
          submodules: recursive
          fetch-depth: 1

      - uses: megaeth-labs/.github/.github/actions/claude-pr-review@main
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          github_identity_token: ${{ steps.app-token.outputs.token }}
          allowed_bots: "mega-putin"

  label-check:
    if: |
      github.event_name == 'pull_request' &&
      (github.event.action == 'opened' ||
       github.event.action == 'reopened' ||
       github.event.action == 'labeled' ||
       github.event.action == 'unlabeled') &&
      github.actor != 'github-actions[bot]'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - name: Debounce
        run: sleep 15

      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 1

      - uses: megaeth-labs/.github/.github/actions/claude-label-check@main
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          allowed_bots: "mega-putin"

  issue-triage:
    if: github.event_name == 'issues'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    permissions:
      contents: read
      issues: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 1

      - uses: megaeth-labs/.github/.github/actions/claude-issue-triage@main
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          allowed_bots: "mega-putin"