Replace broken @claude workflow with Bedrock-based claude-review/mention (#10880)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-06-11 21:36:10 -07:00
parent bce0b51c2e
commit 6c04170734
4 changed files with 207 additions and 54 deletions
@@ -0,0 +1,68 @@
+name: claude-review
+
+# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
+# long-lived tokens). Self-contained: this intentionally uses upstream
+# claude-code-action defaults rather than the org reusable workflows in
+# bluesky-social/.github (which a public repo cannot call, and whose
+# customizations added no value over upstream).
+#
+# Review guidance lives in .github/claude-review-prompt.md.
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+  id-token: write
+
+jobs:
+  review:
+    # Internal PRs only. This repo is public: fork PRs are the bulk of
+    # community traffic and MUST NOT trigger reviews (no Bedrock spend on
+    # unvetted code, and fork PRs can't mint the OIDC token anyway —
+    # belt-and-braces with this explicit guard). Branch PRs can only be
+    # created by people with write access, i.e. org members.
+    # Bot-authored PRs (dependabot, changesets) are also skipped.
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.user.type != 'Bot'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude review
+        uses: anthropics/claude-code-action@v1
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Read .github/claude-review-prompt.md in the checked-out repo
+            and review this pull request following its guidance.