Trigger security review on PR approval, fail on findings

- Trigger on pull_request_review (approved) instead of pull_request
- Add step to fail the job if findings > 0
- Works with branch protection bypass for false positives

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mfo

.github/workflows/claude-code-security-review.yml

@@ -1,26 +1,30 @@
 name: Claude Code Security Review
 
 on:
-  pull_request:
-    branches: [main]
+  pull_request_review:
+    types: [submitted]
 
 permissions:
   contents: read
   pull-requests: write
 
 jobs:
   security-review:
+    if: github.event.review.state == 'approved'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 2
 
       - uses: anthropics/claude-code-security-review@main
+        id: scan
         with:
           claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
-          upload-results: 'false'
-          run-every-commit: 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+
+      - name: Fail if security findings
+        if: steps.scan.outputs.findings-count > 0
+        run: |
+          echo "::error::Security review found ${{ steps.scan.outputs.findings-count }} finding(s). Review the comments on this PR."
+          exit 1