@@ -10,63 +10,68 @@ jobs:
1010 permissions :
1111 contents : read
1212 pull-requests : write
13- issues : write
13+ issues : read
1414 actions : read
1515 id-token : write
1616
1717 steps :
18- - name : Install unzip (required by bun setup)
19- run : |
20- sudo apt-get update
21- sudo apt-get install -y unzip
22-
23- # IMPORTANT: checkout BASE repo only (safe on forks)
24- - name : Checkout base repo (safe)
18+ - name : Checkout PR head (fork)
2519 uses : actions/checkout@v4
2620 with :
21+ ref : ${{ github.event.pull_request.head.sha }}
2722 fetch-depth : 1
2823
2924 - name : Run Claude Code Review
25+ id : claude-review
3026 uses : anthropics/claude-code-action@v1
3127 with :
3228 claude_code_oauth_token : ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
3329 github_token : ${{ github.token }}
3430
35- plugin_marketplaces : " https://github.com/anthropics/claude-code.git"
36- plugins : " code-review@claude-code-plugins"
31+ plugin_marketplaces : ' https://github.com/anthropics/claude-code.git'
32+ plugins : ' code-review@claude-code-plugins'
3733
38- # NOTE: do NOT use --dangerouslyDisableSandbox (it can crash the CLI).
39- # This flag is for non-interactive CI runs (bypasses approval prompts).
4034 claude_args : >
41- --dangerously-skip-permissions
42- --max-turns 90
35+ --dangerouslyDisableSandbox
36+ --max-turns 10
4337 --allowedTools
44- "Bash"
38+ "Bash(gh pr view:*)"
39+ "Bash(gh pr diff:*)"
40+ "Bash(gh pr comment:*)"
41+ "Bash(gh api repos/*/pulls/*:*)"
42+ "Bash(gh api repos/*/issues/*/comments:*)"
43+ "Bash(cat:*)"
44+ "Bash(ls:*)"
45+ "Bash(grep:*)"
46+ "Bash(find:*)"
4547
4648 prompt : |
47- You are running in pull_request_target.
48- DO NOT read or inspect any checked-out PR/fork code. Review ONLY using GitHub API/gh commands.
49+ /code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}
4950
50- You may read local guidance ONLY from:
51- - ./CLAUDE.md (root) if present
52- - ./.claude/rules/*.md if present (max 10 files)
51+ Always use the numeric PR form with --repo, e.g.:
52+ - gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} ...
53+ - gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }} ...
54+ - gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} ...
5355
54- Keep tool calls minimal and in this order:
55- 1) ls -1 .claude/rules 2>/dev/null || true
56- 2) cat CLAUDE.md 2>/dev/null || true
57- 3) find .claude/rules -maxdepth 1 -name "*.md" -print | head -n 10 | xargs -I{} cat "{}" 2>/dev/null || true
58- 4) gh pr view ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --json title,body,files,changedFiles,additions,deletions,headRefOid
59- 5) gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }}
60- 6) Post ONE top-level PR comment titled "Claude Code Review", then STOP.
56+ Output requirements (even if no issues):
57+ - Start with: files changed count + list up to 15 changed file paths
58+ - Then: a short summary of what the PR changes (3–6 bullets)
59+ - Then: findings:
60+ - If issues: list them with file path + line numbers when possible
61+ - If no issues: list at least 3 concrete "improvement opportunities" with file paths
6162
62- Output format:
63- - Head SHA
64- - Files changed count + list up to 10 file paths
65- - Summary (3–6 bullets, minimal)
66- - Findings with file + line numbers when possible
67- - If no issues: 0–3 improvement opportunities (only if confident)
63+ Post the results as ONE top-level PR comment titled "Claude Code Review".
64+ If you cannot access the diff/files, say exactly what is blocked.
65+ If posting a PR comment is blocked, write the full review to the GitHub Actions job summary instead.
6866
69- If posting is blocked, write the full review to the GitHub Actions job summary instead, then STOP.
67+ IMPORTANT:
68+ - Do NOT stop just because a previous "Claude Code Review" comment exists.
69+ - If a prior Claude review exists, post a NEW comment titled "Claude Code Review (updated)" that includes:
70+ - current head SHA: ${{ github.event.pull_request.head.sha }}
71+ - files changed count + up to 15 file paths
72+ - 3–6 bullet summary of changes
73+ - findings or at least 3 improvement opportunities with file paths
74+ Post as ONE top-level PR comment.
7075
7176 additional_permissions : |
7277 actions: read
0 commit comments