name: claude-mention

# @claude mention handler on PR conversation comments, inline review
# comments, and review bodies. See the header comment in
# claude-review.yml for why this is self-contained rather than calling
# the org reusable workflows.
#
# Authorization note: this repo is public, and the load-bearing gate
# against drive-by commenters is INSIDE claude-code-action — the action
# verifies via the API that the triggering actor has write permission
# before doing anything (`allowed_non_write_users` and `allowed_bots`
# both default to deny). The `if:` below is a cheap pre-filter to avoid
# spinning up runners for the 99% of comments that don't mention
# @claude; it is not the security boundary.

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]

permissions:
  contents: read
  pull-requests: write
  issues: write
  actions: read
  id-token: write

jobs:
  mention:
    # Skip comments/reviews that don't mention @claude, non-PR issue
    # comments, and events from claude[bot] itself (its review prose
    # often quotes "@claude" and must not retrigger the workflow).
    if: >
      (
        (github.event_name == 'issue_comment' &&
          github.event.issue.pull_request != null &&
          contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review_comment' &&
          contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review' &&
          contains(github.event.review.body, '@claude'))
      ) &&
      github.actor != 'claude[bot]'

    runs-on: ubuntu-latest
    timeout-minutes: 20

    concurrency:
      group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
      cancel-in-progress: false

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
          aws-region: us-east-2

      - name: Claude
        uses: anthropics/claude-code-action@v1
        with:
          use_bedrock: 'true'
          additional_permissions: |
            actions: read
          track_progress: true
          claude_args: |
            --model global.anthropic.claude-opus-4-8
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"