|
| 1 | +name: Claude Code PR Review |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_run: |
| 5 | + workflows: ["WordPress Plugin Test"] |
| 6 | + types: [completed] |
| 7 | + issue_comment: |
| 8 | + types: [created] |
| 9 | + |
| 10 | +permissions: |
| 11 | + contents: read |
| 12 | + pull-requests: write |
| 13 | + issues: write |
| 14 | + id-token: write |
| 15 | + |
| 16 | +jobs: |
| 17 | + # CI 全パス後の自動レビュー（同一リポジトリのPRのみ） |
| 18 | + setup: |
| 19 | + if: | |
| 20 | + github.event_name == 'workflow_run' && |
| 21 | + github.event.workflow_run.conclusion == 'success' && |
| 22 | + github.event.workflow_run.event == 'pull_request' && |
| 23 | + github.event.workflow_run.head_repository.full_name == github.repository |
| 24 | + runs-on: ubuntu-latest |
| 25 | + outputs: |
| 26 | + pr_number: ${{ steps.pr.outputs.number }} |
| 27 | + steps: |
| 28 | + - name: Checkout repository |
| 29 | + uses: actions/checkout@v4 |
| 30 | + - name: Get PR number |
| 31 | + id: pr |
| 32 | + run: | |
| 33 | + PR_NUMBER=$(gh pr list --head "${{ github.event.workflow_run.head_branch }}" --json number --jq '.[0].number') |
| 34 | + echo "number=$PR_NUMBER" >> $GITHUB_OUTPUT |
| 35 | + env: |
| 36 | + GH_TOKEN: ${{ github.token }} |
| 37 | + |
| 38 | + auto-review: |
| 39 | + needs: setup |
| 40 | + if: needs.setup.outputs.pr_number != '' |
| 41 | + uses: tarosky/workflows/.github/workflows/claude-review.yml@main |
| 42 | + with: |
| 43 | + plugin_name: hamelp |
| 44 | + ci_checks: "PHPUnit (PHP 7.4/8.3 × WP latest/6.6), PHPCS, PHPStan, PHP lint, JS/CSS lint, JS unit test" |
| 45 | + pr_number: ${{ fromJSON(needs.setup.outputs.pr_number) }} |
| 46 | + head_sha: ${{ github.event.workflow_run.head_sha }} |
| 47 | + custom_focus: | |
| 48 | + - AI Overview / FAQ 生成でユーザー入力を LLM に渡す箇所のプロンプトインジェクション対策 |
| 49 | + - AI の入力・出力のサニタイズとエスケープ（特にHTML出力時） |
| 50 | + - REST API エンドポイントの permission_callback / 権限チェック |
| 51 | + - 設定画面・FAQ生成処理の nonce / capability チェック |
| 52 | + - 翻訳文字列のテキストドメイン統一（i18n） |
| 53 | + secrets: inherit |
| 54 | + |
| 55 | + # "@claude auto-review" で手動レビュー（メンバーのみ、PRコメントのみ） |
| 56 | + manual-setup: |
| 57 | + if: | |
| 58 | + github.event_name == 'issue_comment' && |
| 59 | + contains(github.event.comment.body, '@claude auto-review') && |
| 60 | + github.event.issue.pull_request && |
| 61 | + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) |
| 62 | + runs-on: ubuntu-latest |
| 63 | + outputs: |
| 64 | + pr_number: ${{ steps.pr.outputs.number }} |
| 65 | + head_sha: ${{ steps.pr.outputs.head_sha }} |
| 66 | + steps: |
| 67 | + - name: Get PR info |
| 68 | + id: pr |
| 69 | + env: |
| 70 | + GH_TOKEN: ${{ github.token }} |
| 71 | + run: | |
| 72 | + PR_NUMBER=${{ github.event.issue.number }} |
| 73 | + HEAD_SHA=$(gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" --json headRefOid --jq '.headRefOid') |
| 74 | + echo "number=$PR_NUMBER" >> $GITHUB_OUTPUT |
| 75 | + echo "head_sha=$HEAD_SHA" >> $GITHUB_OUTPUT |
| 76 | +
|
| 77 | + manual-review: |
| 78 | + needs: manual-setup |
| 79 | + if: needs.manual-setup.outputs.pr_number != '' |
| 80 | + uses: tarosky/workflows/.github/workflows/claude-review.yml@main |
| 81 | + with: |
| 82 | + plugin_name: hamelp |
| 83 | + ci_checks: "PHPUnit (PHP 7.4/8.3 × WP latest/6.6), PHPCS, PHPStan, PHP lint, JS/CSS lint, JS unit test" |
| 84 | + pr_number: ${{ fromJSON(needs.manual-setup.outputs.pr_number) }} |
| 85 | + head_sha: ${{ needs.manual-setup.outputs.head_sha }} |
| 86 | + is_manual: true |
| 87 | + custom_focus: | |
| 88 | + - AI Overview / FAQ 生成でユーザー入力を LLM に渡す箇所のプロンプトインジェクション対策 |
| 89 | + - AI の入力・出力のサニタイズとエスケープ（特にHTML出力時） |
| 90 | + - REST API エンドポイントの permission_callback / 権限チェック |
| 91 | + - 設定画面・FAQ生成処理の nonce / capability チェック |
| 92 | + - 翻訳文字列のテキストドメイン統一（i18n） |
| 93 | + secrets: inherit |
0 commit comments