feat(ci): inline code review comments + scope docs skill to merged PRs (#361)

* feat(ci): switch PR review to inline comments with code-review plugin

Use the anthropics code-review plugin with inline comment MCP tool
instead of summary-only comments. Retains custom prompt to read
project conventions from CLAUDE.md/agent_docs before reviewing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix(ci): pin GitHub Actions to commit SHAs for supply chain security

Resolves CodeQL alert for unpinned 3rd party actions. Pins
actions/checkout and anthropics/claude-code-action to their
current commit hashes while preserving version comments.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: scope enhance-claude-docs to only merged PRs

Only fetch PRs merged in the date range instead of all updated PRs.
Open/closed-without-merge PRs will be picked up in future runs when they merge,
avoiding duplicate analysis. Also removes redundant State column from PR body template.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: ninja-shreyash

.claude/skills/enhance-claude-docs/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: enhance-claude-docs
-description: Analyze recent PR review comments and update Claude documentation files with new insights. Fetches merged, open, and closed PRs from the last N days, extracts reviewer feedback, and proposes documentation improvements. Triggers on "update claude docs", "enhance docs from PRs", "analyze PR comments".
+description: Analyze recent PR review comments and update Claude documentation files with new insights. Fetches PRs merged in the last N days, extracts reviewer feedback, and proposes documentation improvements. Triggers on "update claude docs", "enhance docs from PRs", "analyze PR comments".
 ---
 
 # Enhance Claude Docs
 
-Analyzes PR review comments from `UiPath/uipath-typescript` and updates Claude documentation files (`CLAUDE.md`, `Agents.md`, `agent_docs/`) with documentation-worthy insights not already captured.
+Analyzes review comments from PRs merged in `UiPath/uipath-typescript` and updates Claude documentation files (`CLAUDE.md`, `Agents.md`, `agent_docs/`) with documentation-worthy insights not already captured.
 
 ---
 
@@ -34,16 +34,16 @@ Store `START_DATE` and `END_DATE` for use in the PR body later.
 
 ---
 
-## Step 2: Fetch PRs
+## Step 2: Fetch Merged PRs
 
-Fetch all PRs updated in the date range:
+Fetch only PRs that were **merged** in the date range. PRs that are still open or were closed without merging are skipped — they'll be picked up in a future run when (and if) they merge.
 
 ```bash
-gh api "repos/UiPath/uipath-typescript/pulls?state=all&sort=updated&direction=desc&per_page=100" \
-  --jq "[.[] | select(.updated_at >= \"${START_DATE}\") | {number, title, state, user: .user.login, updated_at}]"
+gh api "repos/UiPath/uipath-typescript/pulls?state=closed&sort=updated&direction=desc&per_page=100" \
+  --jq "[.[] | select(.merged_at != null and .merged_at >= \"${START_DATE}\") | {number, title, state: \"merged\", user: .user.login, merged_at}]"
 ```
 
-If no PRs found, report "No PRs found in the last N days" and stop.
+If no merged PRs found, report "No merged PRs found in the last N days" and stop.
 
 ---
 
@@ -233,9 +233,9 @@ Analyzed {X} PRs with {Y} comments. Found {Z} actionable insights.
 - {files not modified} -- no relevant insights found
 
 ## PRs Analyzed
-| PR | Title | State | Comments |
-|----|-------|-------|----------|
-| #{N} | {title} | {state} | {count} |
+| PR | Title | Comments |
+|----|-------|----------|
+| #{N} | {title} | {count} |
 EOF
 )"
 ```
@@ -244,8 +244,7 @@ EOF
 - Replace all `{placeholders}` with actual values.
 - The **Changes** section must list every file modified with the specific change, source PR, reviewer, and original comment quote.
 - The **No changes** section must list files that were read but had no relevant insights.
-- The **PRs Analyzed** table must list every PR that was fetched, regardless of whether it yielded insights.
-- State values: `merged`, `open`, `closed`.
+- The **PRs Analyzed** table must list every merged PR that was fetched, regardless of whether it yielded insights.
 
 ---
 

.github/workflows/claude-code-review.yml

@@ -22,26 +22,26 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-      issues: read
+      issues: write
       id-token: write
-      actions: read
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
-          fetch-depth: 0
+          fetch-depth: 1
 
-      - name: Review PR with Claude
+      - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@094bd24d575e7b30ac1576024817bf1a97c81262 # v1
+        uses: anthropics/claude-code-action@26ddc358fe3befff50c5ec2f80304c90c763f6f8 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
-          additional_permissions: |
-            actions: read
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
           prompt: |
-            Review PR #${{ github.event.pull_request.number }}.
             Read CLAUDE.md at the repo root first — it references Agents.md and agent_docs/ which contain all project conventions, architecture, and rules. Follow every convention defined there during your review.
-            Use `gh pr diff ${{ github.event.pull_request.number }}` to get the full diff.
-            Use `gh pr view ${{ github.event.pull_request.number }}` to get the PR description.
+            /code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }} --comment
+          use_sticky_comment: true
+          claude_args: |
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"