code_review.yml

# Claude Code Review Workflow
#
# Triggered by adding the "claude-review" label to a PR.
# Uses stored OAuth credentials on self-hosted runner (no ANTHROPIC_API_KEY needed).
#
# Usage:
#   1. Contributor opens PR
#   2. Collaborator adds "claude-review" label when ready for review
#   3. Workflow triggers, removes the label, runs Claude review
#   4. Want to re-review after changes? Add the label again
#
# ---- Runner One-Time Setup ----
# SSH into tzrec-codereview-runner as the runner user and run:
#
#   # Install bun
#   curl -fsSL https://bun.sh/install | bash
#
#   # Install Claude Code
#   curl -fsSL https://claude.ai/install.sh | sh
#
#   # Clone claude-code-action at pinned version and install deps (for MCP inline comment server)
#   git clone --branch v1 https://github.com/anthropics/claude-code-action.git /opt/claude-code-action
#   cd /opt/claude-code-action && bun install
#
#   # Configure MCP server for inline PR comments (~/.claude/mcp.json)
#   mkdir -p ~/.claude && cat > ~/.claude/mcp.json << 'EOF'
#   {
#     "mcpServers": {
#       "github_inline_comment": {
#         "command": "bun",
#         "args": ["run", "/opt/claude-code-action/src/mcp/github-inline-comment-server.ts"]
#       }
#     }
#   }
#   EOF
#
#   # Login (stores OAuth credentials for headless use)
#   claude /login
#
#   # Verify headless mode works without API key
#   unset ANTHROPIC_API_KEY && unset ANTHROPIC_BASE_URL
#   claude -p "Say hello"
#
# If auth fails after a long period, re-run `claude /login` on the runner.
# Do NOT use --bare flag — it disables OAuth/keychain reads.
# ---- End Setup ----

name: Code Review

on:
  pull_request_target:
    types: [labeled]

concurrency:
  group: codereview-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  review:
    if: github.event.label.name == 'claude-review'
    runs-on: tzrec-codereview-runner
    timeout-minutes: 30
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Remove label to allow re-triggering later
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          gh pr edit ${{ github.event.pull_request.number }} \
            --repo ${{ github.repository }} \
            --remove-label claude-review

      # Checkout trusted .claude/ files from base branch (not the PR author's code)
      - name: Checkout trusted agent files
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          sparse-checkout: .claude
          path: trusted-claude

      # Checkout PR code for review
      - name: Checkout PR code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 1
          path: pr-code

      # rm first: cp -r into an existing dir nests instead of replacing (GHSA-f9x3-9rgg-92p7).
      - name: Use trusted agent files
        run: |
          rm -rf pr-code/.claude
          cp -r trusted-claude/.claude pr-code/.claude

      - name: RunCodeReview
        working-directory: pr-code
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
          # No ANTHROPIC_API_KEY — uses stored OAuth from `claude /login` on the runner
          # MCP server inherits env vars (GITHUB_TOKEN, REPO_OWNER, REPO_NAME, PR_NUMBER)
        run: |
          set -euo pipefail

          # Resolve full bun path (bun installed to ~/.bun/bin/ — not in Claude's subprocess PATH)
          BUN_PATH="$(which bun 2>/dev/null || echo "$HOME/.bun/bin/bun")"
          echo "bun path: $BUN_PATH ($("$BUN_PATH" --version))"

          MCP_CONFIG="{\"mcpServers\":{\"github_inline_comment\":{\"command\":\"${BUN_PATH}\",\"args\":[\"run\",\"/opt/claude-code-action/src/mcp/github-inline-comment-server.ts\"]}}}"

          claude -p \
            --output-format stream-json \
            --verbose \
            --mcp-config "$MCP_CONFIG" \
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*),Read,Grep,Glob,Agent" \
            -- "/review-pr REPO: ${{ github.repository }} PR_NUMBER: ${PR_NUMBER}"