claude-code-review.yml

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize, ready_for_review, reopened]

# A called workflow can only narrow the caller's permissions, never widen them.
# Without this block the run fails at startup before any job is created.
permissions:
  contents: read
  pull-requests: write
  issues: write
  id-token: write
  actions: read

jobs:
  review:
    # Standard lives in superhighfives/control-room so every repo reviews the
    # same way. Repo-specific rules go in CLAUDE.md.
    #
    # No verify_commands: the review reads the diff and doesn't build. An Xcode
    # build outlives the review agent's per-command timeout, gets backgrounded,
    # and the agent stalls waiting for it — finishing a green check without ever
    # posting a review. tests.yml already builds and runs the suite (~90s), so
    # the review doesn't need to. Reading-only, it runs fast on the default
    # ubuntu runner and posts every time.
    uses: superhighfives/control-room/.github/workflows/review.yml@main
    secrets:
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}