claude-review.yml

name: PR Reviews with Claude Code

permissions:
  contents: read
  pull-requests: write

on:
  pull_request_target:
    types: [opened, ready_for_review]
  pull_request_review:
    types: [submitted]

concurrency:
  group: claude-review-${{ github.event.pull_request.html_url }}
  cancel-in-progress: true

jobs:
  validate:
    if: github.event_name == 'pull_request_target'
    uses: ./.github/workflows/contributorValidationGate.yml
    with:
      PR_NUMBER: ${{ github.event.pull_request.number }}
      PR_AUTHOR: ${{ github.event.pull_request.user.login }}
      AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}

  checkCPlusApproval:
    if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
    runs-on: blacksmith-2vcpu-ubuntu-2404
    outputs:
      IS_CPLUS: ${{ steps.check.outputs.IS_CPLUS }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Check Contributor+ membership
        id: check
        uses: ./.github/actions/composite/isContributorPlus
        with:
          USERNAME: ${{ github.event.review.user.login }}
          OS_BOTIFY_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}

  review:
    needs: [validate, checkCPlusApproval]
    if: |
      !cancelled()
      && github.event.pull_request.draft != true
      && !contains(github.event.pull_request.title, 'Revert')
      && (
        (github.event_name == 'pull_request_target' && needs.validate.outputs.IS_AUTHORIZED == 'true')
        || (github.event_name == 'pull_request_review' && needs.checkCPlusApproval.outputs.IS_CPLUS == 'true')
      )
    runs-on: blacksmith-2vcpu-ubuntu-2404
    env:
      PR_NUMBER: ${{ github.event.pull_request.number }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          fetch-depth: 1

      - name: Setup Node
        uses: ./.github/actions/composite/setupNode

      - name: Filter paths
        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
        id: filter
        with:
          filters: |
            code:
              - 'src/**'
            docs:
              - 'docs/**/*.md'
              - 'docs/**/*.csv'

      - name: Add claude utility scripts to PATH
        run: |
          echo "$GITHUB_WORKSPACE/.claude/scripts" >> "$GITHUB_PATH"

      - name: Extract allowed rules from coding standards
        run: |
          "$GITHUB_WORKSPACE/.github/scripts/extractAllowedRules.sh" \
            "$GITHUB_WORKSPACE/.claude/skills/coding-standards/rules" \
            "$RUNNER_TEMP/allowed-rules.txt"

      - name: Load code review JSON schema
        id: schema
        run: echo "json=$(jq -c . "$GITHUB_WORKSPACE/.claude/schemas/code-review-output.json")" >> "$GITHUB_OUTPUT"

      - name: Run Claude Code (code)
        id: code-review
        if: steps.filter.outputs.code == 'true'
        uses: anthropics/claude-code-action@ba026a3e56b9f646ae3b1be02dd9c0812aa2f8ae # v1.0.86
        with:
          display_report: "true"
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          allowed_non_write_users: "*"
          prompt: "/review-code-pr REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}"
          claude_args: |
            --model claude-opus-4-6
            --allowedTools "Task,Glob,Grep,Read,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(check-compiler.sh:*)" --json-schema '${{ steps.schema.outputs.json }}'

      - name: Post code review results
        if: steps.code-review.outcome == 'success' && steps.filter.outputs.code == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          STRUCTURED_OUTPUT: ${{ steps.code-review.outputs.structured_output }}
          ALLOWED_RULES_FILE: ${{ runner.temp }}/allowed-rules.txt
        run: |
          if [ -z "$STRUCTURED_OUTPUT" ]; then
            echo "::error::Claude Code Action returned empty structured output"
            exit 1
          fi
          COUNT=$(echo "$STRUCTURED_OUTPUT" | jq '.violations | length')
          if [ "$COUNT" -eq 0 ]; then
            addPrReaction.sh "$PR_NUMBER"
          else
            echo "$STRUCTURED_OUTPUT" | jq -c '.violations[]' | while IFS= read -r v; do
              PATH_ARG=$(echo "$v" | jq -r '.path')
              BODY_ARG=$(echo "$v" | jq -r '.body')
              LINE_ARG=$(echo "$v" | jq -r '.line')
              createInlineComment.sh "$PATH_ARG" "$BODY_ARG" "$LINE_ARG" || true
            done
          fi

      - name: Run Claude Code (docs)
        if: steps.filter.outputs.docs == 'true'
        uses: anthropics/claude-code-action@ba026a3e56b9f646ae3b1be02dd9c0812aa2f8ae # v1.0.86
        with:
          display_report: "true"
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ secrets.GITHUB_TOKEN }}
          allowed_non_write_users: "*"
          prompt: "/review-helpdot-pr REPO: ${{ github.repository }} PR_NUMBER: ${{ github.event.pull_request.number }}"
          claude_args: |
            --model claude-opus-4-6
            --allowedTools "Task,Glob,Grep,Read,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),mcp__github_inline_comment__create_inline_comment"