ci(common): configure Claude workflow with Opus model, custom prompt, and tool permissions (#1831)

* ci(common): configure Claude workflow to use Opus model

Add --model opus flag to claude_args to ensure the workflow uses
Claude Opus instead of the default Sonnet model. Using the model
alias 'opus' ensures automatic use of the latest Opus version.

* ci(common): configure Claude workflow with custom system prompt and permissions

- Use Opus model by default via --model opus flag
- Override system prompt to show only PR metadata (no verbose body)
- Enable uv, gh, git tools for pr-review skill compatibility
- Custom prompt builder extracts PR context from GitHub webhook
- Supports both pull_request and issue_comment events

The pr-review skill can now:
- Use uv run scripts/gh_pr.py for PR operations
- Post real GitHub reviews with inline comments
- Use gh CLI for all GitHub operations

* fix(ci): resolve security and shellcheck issues in workflow

- Pass GitHub context variables via env to prevent script injection
- Use block redirect for GITHUB_ENV writes (SC2129)
- Quote all variable references to prevent word splitting (SC2086)
- Addresses security concerns from GitHub Actions linter

Author: enitrat

.github/workflows/claude.yml

@@ -58,6 +58,96 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.CLAUDE_ACCESS_TOKEN }}
 
+      - name: Build custom system prompt
+        id: custom_prompt
+        run: |
+          # Extract PR metadata from webhook payload
+          if [[ "$EVENT_NAME" == "pull_request" ]] || [[ -n "$ISSUE_PR_URL" ]]; then
+            # For pull_request events
+            if [[ "$EVENT_NAME" == "pull_request" ]]; then
+              PR_TITLE="$PR_TITLE_INPUT"
+              PR_AUTHOR="$PR_AUTHOR_INPUT"
+              PR_HEAD="$PR_HEAD_INPUT"
+              PR_BASE="$PR_BASE_INPUT"
+              PR_STATE="$PR_STATE_INPUT"
+              PR_ADDITIONS="$PR_ADDITIONS_INPUT"
+              PR_DELETIONS="$PR_DELETIONS_INPUT"
+              PR_COMMITS="$PR_COMMITS_INPUT"
+              PR_FILES="$PR_FILES_INPUT"
+            else
+              # For issue_comment on PRs - need to fetch PR data
+              PR_NUMBER="$ISSUE_NUMBER_INPUT"
+              PR_DATA=$(gh pr view "$PR_NUMBER" --json title,author,headRefName,baseRefName,state,additions,deletions,commits)
+              PR_TITLE=$(echo "$PR_DATA" | jq -r '.title')
+              PR_AUTHOR=$(echo "$PR_DATA" | jq -r '.author.login')
+              PR_HEAD=$(echo "$PR_DATA" | jq -r '.headRefName')
+              PR_BASE=$(echo "$PR_DATA" | jq -r '.baseRefName')
+              PR_STATE=$(echo "$PR_DATA" | jq -r '.state')
+              PR_ADDITIONS=$(echo "$PR_DATA" | jq -r '.additions')
+              PR_DELETIONS=$(echo "$PR_DATA" | jq -r '.deletions')
+              PR_COMMITS=$(echo "$PR_DATA" | jq -r '.commits | length')
+              PR_FILES=$(gh pr view "$PR_NUMBER" --json files | jq '.files | length')
+            fi
+
+            # Build formatted context
+            FORMATTED_CONTEXT="PR Title: ${PR_TITLE}
+          PR Author: ${PR_AUTHOR}
+          PR Branch: ${PR_HEAD} -> ${PR_BASE}
+          PR State: ${PR_STATE^^}
+          PR Additions: ${PR_ADDITIONS}
+          PR Deletions: ${PR_DELETIONS}
+          Total Commits: ${PR_COMMITS}
+          Changed Files: ${PR_FILES} files"
+
+            # Build system prompt
+            SYSTEM_PROMPT="You are Claude, an AI assistant designed to help with GitHub issues and pull requests. Think carefully as you analyze the context and respond appropriately. Here's the context for your current task:
+
+          <formatted_context>
+          ${FORMATTED_CONTEXT}
+          </formatted_context>"
+          else
+            # For issues
+            ISSUE_TITLE="$ISSUE_TITLE_INPUT"
+            ISSUE_AUTHOR="$ISSUE_AUTHOR_INPUT"
+            ISSUE_STATE="$ISSUE_STATE_INPUT"
+
+            FORMATTED_CONTEXT="Issue Title: ${ISSUE_TITLE}
+          Issue Author: ${ISSUE_AUTHOR}
+          Issue State: ${ISSUE_STATE^^}"
+
+            SYSTEM_PROMPT="You are Claude, an AI assistant designed to help with GitHub issues and pull requests. Think carefully as you analyze the context and respond appropriately. Here's the context for your current task:
+
+          <formatted_context>
+          ${FORMATTED_CONTEXT}
+          </formatted_context>"
+          fi
+
+          # Save to environment file for next step (using block redirect)
+          {
+            echo "CUSTOM_SYSTEM_PROMPT<<EOF"
+            echo "$SYSTEM_PROMPT"
+            echo "EOF"
+          } >> "$GITHUB_ENV"
+        env:
+          GH_TOKEN: ${{ secrets.CLAUDE_ACCESS_TOKEN }}
+          EVENT_NAME: ${{ github.event_name }}
+          ISSUE_PR_URL: ${{ github.event.issue.pull_request }}
+          # Pull request event variables
+          PR_TITLE_INPUT: ${{ github.event.pull_request.title }}
+          PR_AUTHOR_INPUT: ${{ github.event.pull_request.user.login }}
+          PR_HEAD_INPUT: ${{ github.event.pull_request.head.ref }}
+          PR_BASE_INPUT: ${{ github.event.pull_request.base.ref }}
+          PR_STATE_INPUT: ${{ github.event.pull_request.state }}
+          PR_ADDITIONS_INPUT: ${{ github.event.pull_request.additions }}
+          PR_DELETIONS_INPUT: ${{ github.event.pull_request.deletions }}
+          PR_COMMITS_INPUT: ${{ github.event.pull_request.commits }}
+          PR_FILES_INPUT: ${{ github.event.pull_request.changed_files }}
+          # Issue event variables
+          ISSUE_NUMBER_INPUT: ${{ github.event.issue.number }}
+          ISSUE_TITLE_INPUT: ${{ github.event.issue.title }}
+          ISSUE_AUTHOR_INPUT: ${{ github.event.issue.user.login }}
+          ISSUE_STATE_INPUT: ${{ github.event.issue.state }}
+
       - name: Run Claude Code
         uses: anthropics/claude-code-action@a017b830c03e23789b11fb69ed571ea61c12e45c # 2026-01-16
         with:
@@ -68,3 +158,7 @@ jobs:
             zama-developer@zama-marketplace
           # Prompt: empty string for comments (action extracts text after @claude)
           prompt: ""
+          claude_args: |
+            --model opus
+            --allowedTools "Bash(uv),Bash(gh),Bash(git),Read,Edit,Write,Glob,Grep,Task"
+            --system-prompt "${{ env.CUSTOM_SYSTEM_PROMPT }}"