feat: add Claude Code review GitHub Action (#34)

Adds automated PR review workflow that:
- Triggers on all PRs (open/push) and manual @claude-review comments
- Gates manual trigger to OWNER/MEMBER/COLLABORATOR only
- Pins claude-code-action to immutable SHA for supply-chain safety
- Posts inline comments, deduplicates, and resolves stale threads


Committed-By-Agent: claude

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: jagtejsodhi

.github/workflows/claude.yml

@@ -0,0 +1,55 @@
+name: Claude Code Review
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize]
+
+jobs:
+  claude-review:
+    if: |
+      (github.event_name == 'issue_comment' &&
+       github.event.issue.pull_request &&
+       contains(github.event.comment.body, '@claude-review') &&
+       contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
+      (github.event_name == 'pull_request_target' &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
+       !github.event.pull_request.draft &&
+       !startsWith(github.event.pull_request.head.ref, 'release-please--') &&
+       !contains(github.event.pull_request.body, 'no-claude-review'))
+
+    concurrency:
+      group: claude-review-${{ github.event.pull_request.number || github.event.issue.number }}
+      cancel-in-progress: true
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Run Claude Code Review
+        uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ github.token }}
+          claude_args: "--allowedTools mcp__github_inline_comment__create_inline_comment,mcp__github_comment__update_claude_comment,Read,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api graphql:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
+
+            Review this PR using the skill at .claude/skills/review-pr/SKILL.md.
+
+            Rules:
+            - Post each finding as an inline comment on the exact line using `mcp__github_inline_comment__create_inline_comment` (confirmed: true)
+            - Post one top-level summary comment via `mcp__github_comment__update_claude_comment`: a bulleted summary of findings only, max 3-5 bullets, nothing more.
+            - Before posting inline comments, check if the same finding already exists as an inline comment from a previous run (filter by `author.login == "github-actions[bot]"` in review threads). Do NOT re-post duplicate findings. Only post net-new findings for changes since the last review.
+            - Resolve stale inline comment threads whose findings have been fixed. To resolve a thread, first get the thread's node_id from the PR's review threads using `gh api graphql -f query='{ repository(owner:"OWNER", name:"REPO") { pullRequest(number:PR_NUM) { reviewThreads(first:100) { nodes { id isResolved comments(first:1) { nodes { body author { login } } } } } } }'`, then resolve it with `gh api graphql -f query='mutation { resolveReviewThread(input:{threadId:"THREAD_NODE_ID"}) { thread { isResolved } } }'`. Only resolve threads authored by github-actions[bot].
+            - Only comment on lines with real issues — do not comment for the sake of it