@@ -10,68 +10,63 @@ jobs:
1010 permissions :
1111 contents : read
1212 pull-requests : write
13- issues : read
13+ issues : write
1414 actions : read
1515 id-token : write
1616
1717 steps :
18- - name : Checkout PR head (fork)
18+ - name : Install unzip (required by bun setup)
19+ run : |
20+ sudo apt-get update
21+ sudo apt-get install -y unzip
22+
23+ # IMPORTANT: checkout BASE repo only (safe on forks)
24+ - name : Checkout base repo (safe)
1925 uses : actions/checkout@v4
2026 with :
21- ref : ${{ github.event.pull_request.head.sha }}
2227 fetch-depth : 1
2328
2429 - name : Run Claude Code Review
25- id : claude-review
2630 uses : anthropics/claude-code-action@v1
2731 with :
2832 claude_code_oauth_token : ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
2933 github_token : ${{ github.token }}
3034
31- plugin_marketplaces : ' https://github.com/anthropics/claude-code.git'
32- plugins : ' code-review@claude-code-plugins'
35+ plugin_marketplaces : " https://github.com/anthropics/claude-code.git"
36+ plugins : " code-review@claude-code-plugins"
3337
38+ # NOTE: do NOT use --dangerouslyDisableSandbox (it can crash the CLI).
39+ # This flag is for non-interactive CI runs (bypasses approval prompts).
3440 claude_args : >
35- --dangerouslyDisableSandbox
36- --max-turns 10
41+ --dangerously-skip-permissions
42+ --max-turns 90
3743 --allowedTools
38- "Bash(gh pr view:*)"
39- "Bash(gh pr diff:*)"
40- "Bash(gh pr comment:*)"
41- "Bash(gh api repos/*/pulls/*:*)"
42- "Bash(gh api repos/*/issues/*/comments:*)"
43- "Bash(cat:*)"
44- "Bash(ls:*)"
45- "Bash(grep:*)"
46- "Bash(find:*)"
44+ "Bash"
4745
4846 prompt : |
49- /code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}
47+ You are running in pull_request_target.
48+ DO NOT read or inspect any checked-out PR/fork code. Review ONLY using GitHub API/gh commands.
5049
51- Always use the numeric PR form with --repo, e.g.:
52- - gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} ...
53- - gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }} ...
54- - gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} ...
50+ You may read local guidance ONLY from:
51+ - ./CLAUDE.md (root) if present
52+ - ./.claude/rules/*.md if present (max 10 files)
5553
56- Output requirements (even if no issues):
57- - Start with: files changed count + list up to 15 changed file paths
58- - Then: a short summary of what the PR changes (3–6 bullets)
59- - Then: findings:
60- - If issues: list them with file path + line numbers when possible
61- - If no issues: list at least 3 concrete "improvement opportunities" with file paths
54+ Keep tool calls minimal and in this order:
55+ 1) ls -1 .claude/rules 2>/dev/null || true
56+ 2) cat CLAUDE.md 2>/dev/null || true
57+ 3) find .claude/rules -maxdepth 1 -name "*.md" -print | head -n 10 | xargs -I{} cat "{}" 2>/dev/null || true
58+ 4) gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --json title,body,files,changedFiles,additions,deletions,headRefOid
59+ 5) gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }}
60+ 6) Post ONE top-level PR comment titled "Claude Code Review", then STOP.
6261
63- Post the results as ONE top-level PR comment titled "Claude Code Review".
64- If you cannot access the diff/files, say exactly what is blocked.
65- If posting a PR comment is blocked, write the full review to the GitHub Actions job summary instead.
62+ Output format:
63+ - Head SHA
64+ - Files changed count + list up to 10 file paths
65+ - Summary (3–6 bullets, minimal)
66+ - Findings with file + line numbers when possible
67+ - If no issues: 0–3 improvement opportunities (only if confident)
6668
67- IMPORTANT:
68- - Do NOT stop just because a previous "Claude Code Review" comment exists.
69- - If a prior Claude review exists, post a NEW comment titled "Claude Code Review (updated)" that includes:
70- - current head SHA: ${{ github.event.pull_request.head.sha }}
71- - files changed count + up to 15 file paths
72- - 3–6 bullet summary of changes
73- - findings or at least 3 improvement opportunities with file paths
74- Post as ONE top-level PR comment.
69+ If posting is blocked, write the full review to the GitHub Actions job summary instead, then STOP.
7570
7671 additional_permissions : |
7772 actions: read
0 commit comments