name: claude-mention

# @claude mention handler on PR conversation comments, inline review
# comments, and review bodies. See the header comment in
# claude-review.yml for why this is self-contained rather than calling
# the org reusable workflows.
#
# Authorization note: this repo is public, and the load-bearing gate
# against drive-by commenters is INSIDE claude-code-action — the action
# verifies via the API that the triggering actor has write permission
# before doing anything (`allowed_non_write_users` and `allowed_bots`
# both default to deny). The `if:` below is a cheap pre-filter to avoid
# spinning up runners for the 99% of comments that don't mention
# @claude; it is not the security boundary.

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]

permissions:
  contents: read
  pull-requests: write
  issues: write
  actions: read
  # Required for claude-code-action's GitHub App token exchange.
  id-token: write

jobs:
  mention:
    # Skip comments/reviews that don't mention @claude, non-PR issue
    # comments, and events from claude[bot] itself (its review prose
    # often quotes "@claude" and must not retrigger the workflow).
    if: >
      (
        (github.event_name == 'issue_comment' &&
          github.event.issue.pull_request != null &&
          contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review_comment' &&
          contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review' &&
          contains(github.event.review.body, '@claude'))
      ) &&
      github.actor != 'claude[bot]'

    runs-on: ubuntu-latest
    timeout-minutes: 20

    concurrency:
      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: false

    steps:
      - name: ⬇️ Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 1

      - name: 🤖 Claude
        uses: anthropics/claude-code-action@459ad358ae43fea66bfefd0a1f8d840b4b9791fb # v1.0.194
        env:
          ANTHROPIC_BASE_URL: https://agentgateway.k1.prod.bsky.dev
        with:
          # Agent Gateway service keys use Authorization: Bearer, the wire
          # shape emitted by the action's OAuth-token input.
          claude_code_oauth_token: ${{ secrets.AGENT_GATEWAY_CLAUDE_GH_REVIEW_KEY }}
          additional_permissions: |
            actions: read
          track_progress: true
          claude_args: |
            --model claude-opus-4-8:api
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"