dependabot[bot]
7d4b91dd38
Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
77 lines
2.8 KiB
YAML
77 lines
2.8 KiB
YAML
name: claude-mention
|
|
|
|
# @claude mention handler on PR conversation comments, inline review
|
|
# comments, and review bodies. See the header comment in
|
|
# claude-review.yml for why this is self-contained rather than calling
|
|
# the org reusable workflows.
|
|
#
|
|
# Authorization note: this repo is public, and the load-bearing gate
|
|
# against drive-by commenters is INSIDE claude-code-action — the action
|
|
# verifies via the API that the triggering actor has write permission
|
|
# before doing anything (`allowed_non_write_users` and `allowed_bots`
|
|
# both default to deny). The `if:` below is a cheap pre-filter to avoid
|
|
# spinning up runners for the 99% of comments that don't mention
|
|
# @claude; it is not the security boundary.
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_review_comment:
|
|
types: [created]
|
|
pull_request_review:
|
|
types: [submitted]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
actions: read
|
|
id-token: write
|
|
|
|
jobs:
|
|
mention:
|
|
# Skip comments/reviews that don't mention @claude, non-PR issue
|
|
# comments, and events from claude[bot] itself (its review prose
|
|
# often quotes "@claude" and must not retrigger the workflow).
|
|
if: >
|
|
(
|
|
(github.event_name == 'issue_comment' &&
|
|
github.event.issue.pull_request != null &&
|
|
contains(github.event.comment.body, '@claude')) ||
|
|
(github.event_name == 'pull_request_review_comment' &&
|
|
contains(github.event.comment.body, '@claude')) ||
|
|
(github.event_name == 'pull_request_review' &&
|
|
contains(github.event.review.body, '@claude'))
|
|
) &&
|
|
github.actor != 'claude[bot]'
|
|
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
|
|
concurrency:
|
|
group: claude-mention-${{ github.repository }}-${{ github.event.issue.number || github.event.pull_request.number }}
|
|
cancel-in-progress: false
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Configure AWS credentials (OIDC)
|
|
uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
|
|
with:
|
|
role-to-assume: ${{ secrets.AWS_BEDROCK_REVIEW_ROLE_ARN }}
|
|
aws-region: us-east-2
|
|
|
|
- name: Claude
|
|
uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1.0.171
|
|
with:
|
|
use_bedrock: 'true'
|
|
additional_permissions: |
|
|
actions: read
|
|
track_progress: true
|
|
claude_args: |
|
|
--model global.anthropic.claude-opus-4-8
|
|
--allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__github_ci__get_ci_status,mcp__github_ci__download_job_log,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
|