The old claude.yml authenticated with a CLAUDE_CODE_OAUTH_TOKEN secret
and had no review prompt wired up. Replace it with the self-contained
Bedrock (OIDC) workflow pair from bluesky-social/atproto#5079:
automatic PR review plus @claude mention handling, gated to same-repo
branch PRs only — fork PRs never trigger (no Bedrock spend on unvetted
code; fork PRs also cannot mint the OIDC token). The load-bearing
authorization check for mentions is upstream claude-code-action's
write-permission API gate.
Review guidance lives in .github/claude-review-prompt.md, written for
this codebase (cross-platform RN, Lingui, ALF, TanStack Query,
moderation surfaces).
ROAST_SKIP rationale: the gate's recurring findings on this exact YAML
(checkout@v6, configure-aws-credentials@v6, global.anthropic
inference profile "nonexistent") are stale-training-data false
positives, verified real and adjudicated on the atproto changeover.
--no-verify: husky hooks lint app code; this commit is YAML/markdown.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Austin McKinley
838b48311b