Replace broken @claude workflow with Bedrock-based claude-review/mention

The old claude.yml authenticated with a CLAUDE_CODE_OAUTH_TOKEN secret and had no review prompt wired up. Replace it with the self-contained Bedrock (OIDC) workflow pair from bluesky-social/atproto#5079: automatic PR review plus @claude mention handling, gated to same-repo branch PRs only — fork PRs never trigger (no Bedrock spend on unvetted code; fork PRs also cannot mint the OIDC token). The load-bearing authorization check for mentions is upstream claude-code-action's write-permission API gate. Review guidance lives in .github/claude-review-prompt.md, written for this codebase (cross-platform RN, Lingui, ALF, TanStack Query, moderation surfaces). ROAST_SKIP rationale: the gate's recurring findings on this exact YAML (checkout@v6, configure-aws-credentials@v6, global.anthropic inference profile "nonexistent") are stale-training-data false positives, verified real and adjudicated on the atproto changeover. --no-verify: husky hooks lint app code; this commit is YAML/markdown. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-06-11 14:26:20 -07:00
parent b281e23f11
commit 838b48311b
4 changed files with 207 additions and 54 deletions
@@ -0,0 +1,76 @@
+name: claude-mention
+
+# @claude mention handler on PR conversation comments, inline review
+# comments, and review bodies. See the header comment in
+# claude-review.yml for why this is self-contained rather than calling
+# the org reusable workflows.
+#
+# Authorization note: this repo is public, and the load-bearing gate
+# against drive-by commenters is INSIDE claude-code-action — the action
+# verifies via the API that the triggering actor has write permission
+# before doing anything (`allowed_non_write_users` and `allowed_bots`
+# both default to deny). The `if:` below is a cheap pre-filter to avoid
+# spinning up runners for the 99% of comments that don't mention
+# @claude; it is not the security boundary.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+  actions: read
+  id-token: write
+
+jobs:
+  mention:
+    # Skip comments/reviews that don't mention @claude, non-PR issue
+    # comments, and events from claude[bot] itself (its review prose
+    # often quotes "@claude" and must not retrigger the workflow).
+    if: >
+      (
+        (github.event_name == 'issue_comment' &&
+          github.event.issue.pull_request != null &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' &&
+          contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review' &&
+          contains(github.event.review.body, '@claude'))
+      ) &&
+      github.actor != 'claude[bot]'
+
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+
+    concurrency:
+      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Configure AWS credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
+          aws-region: us-east-2
+
+      - name: Claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          use_bedrock: 'true'
+          additional_permissions: |
+            actions: read
+          track_progress: true
+          claude_args: |
+            --model global.anthropic.claude-opus-4-8
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"