workflows/claude-code-review.yml

CI / automation

# REFERENCE-ONLY: GitHub Actions secrets referenced below are illustrative.
# Do not inject real credentials. See your CI/CD provider for proper secret management.
name: Claude Code Review

on:
  # For PRs from the same repository
  pull_request:
    types:
      - opened
      - synchronize
      - ready_for_review
  # Manual trigger
  workflow_dispatch:
    inputs:
      pr_number:
        description: 'PR number to review'
        required: true
        type: number

jobs:
  claude-review:
    if: |
      (github.event_name == 'pull_request' && github.event.pull_request.draft == false) ||
      github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Check PR and checkout branch
        id: check-pr
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
            PR_NUMBER="${{ github.event.inputs.pr_number }}"
          else
            PR_NUMBER="${{ github.event.pull_request.number }}"
          fi

          echo "Checking PR #$PR_NUMBER"

          # Check if it's a forked PR
          PR_INFO=$(gh pr view $PR_NUMBER --json isCrossRepository,headRepositoryOwner,headRepository 2>/dev/null || echo '{}')
          IS_FORK=$(echo "$PR_INFO" | jq -r '.isCrossRepository // false')
          HEAD_REPO=$(echo "$PR_INFO" | jq -r '.headRepository.nameWithOwner // ""')

          # Skip (don't fail) forked PRs on automatic triggers, but allow manual triggers
          if [ "${{ github.event_name }}" == "pull_request" ] && ([ "$IS_FORK" = "true" ] || [ "$HEAD_REPO" != "${{ github.repository }}" ]); then
            echo "⏭️  Skipping review: PR #$PR_NUMBER is from a forked repository"
            echo "Forked PRs are skipped for automatic reviews. Use workflow_dispatch to manually trigger a review."
            echo "skip_review=true" >> $GITHUB_OUTPUT
            exit 0
          fi

          echo "Checking out PR #$PR_NUMBER"
          gh pr checkout $PR_NUMBER
          echo "✅ PR branch checked out successfully"
          echo "skip_review=false" >> $GITHUB_OUTPUT

      - name: Run Claude Code Review
        if: steps.check-pr.outputs.skip_review != 'true'
        id: claude-review
        uses: anthropics/claude-code-action@v1
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.pr_number || github.event.pull_request.number }}

            Please review this pull request and provide feedback on:
            - Code quality and best practices
            - Potential bugs or issues
            - Performance considerations
            - Security concerns
            - Test coverage

            # Steps to run a Review:
              1) Check if previous review is already done by Claude. If so, perform a re-reivew with the latest changes referring previous review.
              2) If no previous review is found, perform a new review with the latest changes.

            Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.

            Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.

          claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'