claude-code-review.yml

---
name: Claude Code Review

'on':
  pull_request:
    types: [opened, synchronize]

# Prevent multiple review runs on rapid PR updates
concurrency:
  group: claude-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  claude-review:
    # Auto-review ALL pull requests with Claude
    # BYPASS: Add [EMERGENCY], [SKIP REVIEW], or [HOTFIX] to PR title
    # BYPASS: Or add 'emergency' or 'skip-review' label to PR
    # SKIP: Release PRs (dev → main) - already reviewed in dev
    if: github.event.pull_request.base.ref != 'main'
    runs-on: ubuntu-latest
    timeout-minutes: 10  # Prevent hung runs (Claude API timeout)
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write  # Required by Claude Code action for OIDC authentication

    steps:
      - name: Check Workflow Kill Switch
        run: |
          if [ -f ".github/WORKFLOW_KILLSWITCH" ]; then
            STATUS=$(grep "STATUS:" .github/WORKFLOW_KILLSWITCH | awk '{print $2}')
            if [ "$STATUS" = "DISABLED" ]; then
              echo "🛑 Workflows disabled by kill switch"
              exit 0
            fi
          fi

      - name: Check for Review Bypass
        id: bypass
        run: |
          PR_TITLE="${{ github.event.pull_request.title }}"
          PR_LABELS="${{ toJSON(github.event.pull_request.labels.*.name) }}"

          # Check for bypass markers in PR title
          if echo "$PR_TITLE" | grep -qE '\[EMERGENCY\]|\[SKIP REVIEW\]|\[HOTFIX\]'; then
            echo "bypass=true" >> $GITHUB_OUTPUT
            echo "reason=PR title contains bypass marker" >> $GITHUB_OUTPUT
            echo "⏭️ BYPASS: PR title contains bypass marker"
            exit 0
          fi

          # Check for bypass labels
          if echo "$PR_LABELS" | grep -qE 'emergency|skip-review|hotfix'; then
            echo "bypass=true" >> $GITHUB_OUTPUT
            echo "reason=PR has bypass label" >> $GITHUB_OUTPUT
            echo "⏭️ BYPASS: PR has bypass label"
            exit 0
          fi

          echo "bypass=false" >> $GITHUB_OUTPUT
          echo "✅ No bypass detected - review will proceed"

      - name: Post Bypass Notice
        if: steps.bypass.outputs.bypass == 'true'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## ⏭️ Code Review Bypassed

              **Reason**: ${{ steps.bypass.outputs.reason }}

              ⚠️ **Manual review recommended** - This PR was merged without automated code review.

              ---
              *Bypass triggered by emergency procedures*`
            })

      - name: Checkout repository
        if: steps.bypass.outputs.bypass != 'true'
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Claude Code Review
        if: steps.bypass.outputs.bypass != 'true'
        id: claude-review
        uses: anthropics/claude-code-action@v1
        continue-on-error: true
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            Please review this pull request for Claude Code Tresor - a professional development utilities toolkit.

            Focus on:
            - Code quality and best practices
            - Skill/Agent/Command YAML frontmatter validity
            - Documentation completeness
            - Security concerns (especially in hooks and commands)
            - Breaking changes to v2.0.0 compatibility
            - Integration patterns (Skills → Agents → Commands)

            Use the repository's CLAUDE.md for guidance on project structure and conventions.

            Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.

          # Allowed tools for Claude Code review
          claude_args: >-
            --allowed-tools "Bash(gh issue view:*),Bash(gh search:*),
            Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),
            Bash(gh pr view:*),Bash(gh pr list:*)"

      - name: Post fallback review note (quota/timeout)
        if: steps.claude-review.outcome != 'success'
        uses: actions/github-script@v7
        with:
          script: |
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: `## ⚠️ Automated Review Skipped

              The automated Claude review could not complete (likely quota or a transient error).

              - You can retry this workflow from the Actions tab
              - Proceed with manual review to unblock
              `
            })