Merge pull request #84 from scality/feat/add-dependency-review-workflow

Add dependency bump review workflow

Author: dvasilas

.github/workflows/claude-code-dependency-review.yml

@@ -0,0 +1,64 @@
+name: Claude Code Dependency Review
+
+on:
+  workflow_call:
+    secrets:
+      GCP_WORKLOAD_IDENTITY_PROVIDER:
+        required: true
+        description: GCP Workload Identity Provider for Vertex AI
+      GCP_SERVICE_ACCOUNT:
+        required: true
+        description: GCP Service Account for Vertex AI
+      ANTHROPIC_VERTEX_PROJECT_ID:
+        required: true
+        description: GCP project ID for Vertex AI
+      CLOUD_ML_REGION:
+        required: true
+        description: GCP region for Vertex AI
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      pull-requests: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Install dependencies
+        id: install-deps
+        if: hashFiles('yarn.lock') != ''
+        continue-on-error: true
+        run: yarn install --frozen-lockfile
+
+      - name: Warn on failed dependency install
+        if: steps.install-deps.outcome == 'failure'
+        run: echo "::warning::yarn install failed — dependency review will run without node_modules. This may happen if the project uses private registries requiring authentication."
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+
+      - name: Run Claude Code Dependency Review
+        id: dependency-review
+        continue-on-error: true
+        uses: anthropics/claude-code-action@v1
+        with:
+          github_token: ${{ github.token }}
+          use_vertex: "true"
+          plugin_marketplaces: https://github.com/scality/agent-hub
+          plugins: scality-skills@scality-agent-hub
+          prompt: "/review-dependency-bump REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}"
+          claude_args: |
+            --allowedTools "Read" "Grep" "WebFetch" "Bash(gh repo view *)" "Bash(gh pr view *)" "Bash(gh pr comment *)" "Bash(gh pr review *)" "Bash(gh api *)"
+            --model "claude-opus-4-6"
+        env:
+          ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.ANTHROPIC_VERTEX_PROJECT_ID }}
+          CLOUD_ML_REGION: ${{ secrets.CLOUD_ML_REGION }}

.github/workflows/review.yml

@@ -6,9 +6,19 @@ on:
 
 jobs:
   review:
+    if: github.actor != 'dependabot[bot]'
     uses: ./.github/workflows/claude-code-review.yml
     secrets:
       GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
       GCP_SERVICE_ACCOUNT: ${{ secrets.GCP_SERVICE_ACCOUNT }}
       ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.ANTHROPIC_VERTEX_PROJECT_ID }}
       CLOUD_ML_REGION: ${{ secrets.CLOUD_ML_REGION }}
+
+  review-dependency-bump:
+    if: github.actor == 'dependabot[bot]'
+    uses: ./.github/workflows/claude-code-dependency-review.yml
+    secrets:
+      GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+      GCP_SERVICE_ACCOUNT: ${{ secrets.GCP_SERVICE_ACCOUNT }}
+      ANTHROPIC_VERTEX_PROJECT_ID: ${{ secrets.ANTHROPIC_VERTEX_PROJECT_ID }}
+      CLOUD_ML_REGION: ${{ secrets.CLOUD_ML_REGION }}