Austin McKinley
838b48311b
The old claude.yml authenticated with a CLAUDE_CODE_OAUTH_TOKEN secret and had no review prompt wired up. Replace it with the self-contained Bedrock (OIDC) workflow pair from bluesky-social/atproto#5079: automatic PR review plus @claude mention handling, gated to same-repo branch PRs only — fork PRs never trigger (no Bedrock spend on unvetted code; fork PRs also cannot mint the OIDC token). The load-bearing authorization check for mentions is upstream claude-code-action's write-permission API gate. Review guidance lives in .github/claude-review-prompt.md, written for this codebase (cross-platform RN, Lingui, ALF, TanStack Query, moderation surfaces). ROAST_SKIP rationale: the gate's recurring findings on this exact YAML (checkout@v6, configure-aws-credentials@v6, global.anthropic inference profile "nonexistent") are stale-training-data false positives, verified real and adjudicated on the atproto changeover. --no-verify: husky hooks lint app code; this commit is YAML/markdown. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
69 lines
2.4 KiB
YAML
69 lines
2.4 KiB
YAML
name: claude-review
|
|
|
|
# Automatic Claude review on PR creation/update, via Bedrock (OIDC, no
|
|
# long-lived tokens). Self-contained: this intentionally uses upstream
|
|
# claude-code-action defaults rather than the org reusable workflows in
|
|
# bluesky-social/.github (which a public repo cannot call, and whose
|
|
# customizations added no value over upstream).
|
|
#
|
|
# Review guidance lives in .github/claude-review-prompt.md.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
actions: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
review:
|
|
# Internal PRs only. This repo is public: fork PRs are the bulk of
|
|
# community traffic and MUST NOT trigger reviews (no Bedrock spend on
|
|
# unvetted code, and fork PRs can't mint the OIDC token anyway —
|
|
# belt-and-braces with this explicit guard). Branch PRs can only be
|
|
# created by people with write access, i.e. org members.
|
|
# Bot-authored PRs (dependabot, changesets) are also skipped.
|
|
if: >
|
|
github.event.pull_request.draft == false &&
|
|
github.event.pull_request.head.repo.full_name == github.repository &&
|
|
github.event.pull_request.user.type != 'Bot'
|
|
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
|
|
concurrency:
|
|
group: claude-review-${{ github.repository }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Configure AWS credentials (OIDC)
|
|
uses: aws-actions/configure-aws-credentials@v6
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Claude review
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
use_bedrock: 'true'
|
|
additional_permissions: |
|
|
actions: read
|
|
track_progress: true
|
|
claude_args: |
|
|
--model global.anthropic.claude-opus-4-8
|
|
--allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
|
|
prompt: |
|
|
REPO: ${{ github.repository }}
|
|
PR NUMBER: ${{ github.event.pull_request.number }}
|
|
|
|
Read .github/claude-review-prompt.md in the checked-out repo
|
|
and review this pull request following its guidance.
|