claude-review.yml

name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
  issue_comment:
    types: [created]

env:
  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

jobs:
  claude-review:
    name: Claude Review
    if: github.event_name == 'pull_request'
    continue-on-error: true
    runs-on: ubuntu-latest
    outputs:
      claude_ok: ${{ steps.claude_review.outcome == 'success' }}
    permissions:
      contents: read
      pull-requests: write
      statuses: write
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Claude Code Review
        id: claude_review
        if: ${{ env.ANTHROPIC_API_KEY != '' }}
        continue-on-error: true
        uses: anthropics/claude-code-action@ea5a04005c9fd4deed2ed803c15a64d0e6eb65d0 # v1
        with:
          anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }}
          allowed_bots: 'trunk-io,dependabot[bot],github-actions[bot]'
          prompt: |
            Review this PR for the Random Timer app. This is a native mobile project:
            - Android: Kotlin + Jetpack Compose (native-android/)
            - iOS: Swift + SwiftUI (native-ios/)
            - CI/CD: GitHub Actions (.github/workflows/)

            CRITICAL CHECKS (fail the review if violated):
            1. No secrets, API keys, credentials, or google-services.json in code
            2. No hardcoded colors — use theme constants
            3. Named exports only (no default exports in shared code)
            4. Kotlin: no !! (non-null assertions) without justification
            5. Swift: no force-unwraps without justification

            ARCHITECTURE CHECKS:
            - Android follows MVVM with Compose
            - iOS follows SwiftUI + Observable patterns
            - Shared logic should not be duplicated across platforms unnecessarily

            SECURITY CHECKS:
            - No .env files, keystores, or provisioning profiles committed
            - No hardcoded URLs to internal/staging services
            - Proper input validation at system boundaries

            Output your review as a structured PR review:
            - Start with overall assessment (APPROVE, REQUEST_CHANGES, or COMMENT)
            - List specific issues with file:line references
            - Provide fix suggestions for each issue
          claude_args: '--max-turns 10'

      - name: Advisory mode notice when secret is unavailable
        if: ${{ env.ANTHROPIC_API_KEY == '' }}
        run: |
          echo "ANTHROPIC_API_KEY is not available for this run."
          echo "Claude Review remains advisory and non-blocking."

      - name: Warn when Claude review crashes
        if: steps.claude_review.outcome != 'success'
        run: |
          echo "Claude review action failed/crashed; leaving non-blocking warning."

  ai-auto-approve:
    name: AI Auto-Approve
    needs: claude-review
    if: |
      github.event_name == 'pull_request' &&
      needs.claude-review.outputs.claude_ok == 'true' &&
      !github.event.pull_request.draft &&
      github.event.pull_request.head.repo.full_name == github.repository
    continue-on-error: true
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Auto-approve PR
        continue-on-error: true
        uses: hmarr/auto-approve-action@f0939ea97e9205ef24d872e76833fa908a770363 # v4.0.0
        with:
          review-message: "Auto-approved: Claude AI review passed, all CI checks green."

  claude-assist:
    name: Claude Assist
    if: |
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '@claude')
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v6

      - name: Claude Code Assist
        if: ${{ env.ANTHROPIC_API_KEY != '' }}
        uses: anthropics/claude-code-action@ea5a04005c9fd4deed2ed803c15a64d0e6eb65d0 # v1
        with:
          anthropic_api_key: ${{ env.ANTHROPIC_API_KEY }}
          github_token: ${{ github.token }}
          allowed_bots: 'trunk-io,dependabot[bot],github-actions[bot]'
          prompt: |
            A reviewer mentioned @claude with the following comment:

            ${{ github.event.comment.body }}

            Context: This is a native mobile app (Random Timer) with:
            - Android: Kotlin + Jetpack Compose (native-android/)
            - iOS: Swift + SwiftUI (native-ios/)
            - Package: com.iganapolsky.randomtimer

            Respond helpfully to their request. If they're asking for code changes,
            explain what needs to be done and where. Be specific with file paths.
          claude_args: |
            --max-turns 5
            --setting-sources user

      - name: Advisory mode notice when secret is unavailable
        if: ${{ env.ANTHROPIC_API_KEY == '' }}
        run: |
          echo "ANTHROPIC_API_KEY is not available for this run."
          echo "Claude Assist remains advisory and non-blocking."