name: claude-review

# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
# long-lived tokens). Self-contained: this intentionally uses upstream
# claude-code-action defaults rather than the org reusable workflows in
# bluesky-social/.github (which a public repo cannot call, and whose
# customizations added no value over upstream).
#
# Review guidance lives in .github/claude-review-prompt.md.

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: write
  actions: read
  id-token: write

jobs:
  review:
    # Internal PRs only. This repo is public: fork PRs are the bulk of
    # community traffic and MUST NOT trigger reviews (no Bedrock spend on
    # unvetted code, and fork PRs can't mint the OIDC token anyway —
    # belt-and-braces with this explicit guard). Branch PRs can only be
    # created by people with write access, i.e. org members.
    # Bot-authored PRs (dependabot, changesets) are also skipped.
    if: >
      github.event.pull_request.draft == false &&
      github.event.pull_request.head.repo.full_name == github.repository &&
      github.event.pull_request.user.type != 'Bot'

    runs-on: ubuntu-latest
    timeout-minutes: 20

    concurrency:
      group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
      cancel-in-progress: true

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 1

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
          aws-region: us-east-2

      - name: Claude review
        uses: anthropics/claude-code-action@v1
        with:
          use_bedrock: 'true'
          additional_permissions: |
            actions: read
          track_progress: true
          claude_args: |
            --model global.anthropic.claude-opus-4-8
            --allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            Read .github/claude-review-prompt.md in the checked-out repo
            and review this pull request following its guidance.