claude-code.yml

name: Claude Code

# AI-assisted PR reviews and interactive @claude mentions.
# Authentication to the Databricks Model Serving endpoint (which hosts
# the Claude model) is handled via GitHub OIDC federation so this
# workflow does not need any secrets.

on:
  pull_request:
    types: [opened, synchronize, reopened]

  issue_comment:
    types: [created]

  pull_request_review_comment:
    types: [created]

jobs:
  # Automatic PR review when a PR is opened or updated.
  review:
    if: github.event_name == 'pull_request'
    runs-on:
      group: databricks-deco-testing-runner-group
      labels: ubuntu-latest-deco
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Get GitHub OIDC token
        id: github-oidc
        uses: actions/github-script@v7
        with:
          script: |
            const token = await core.getIDToken('968367da-7edd-44f7-9dea-3e0b20b0ec97');
            core.setSecret(token);
            core.setOutput('token', token);

      - name: Get Databricks OAuth token
        id: oauth
        run: |
          TOKEN_RESPONSE=$(curl -sfS -X POST \
            "https://accounts.cloud.databricks.com/oidc/accounts/968367da-7edd-44f7-9dea-3e0b20b0ec97/v1/token" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
            -d "subject_token=${SUBJECT_TOKEN}" \
            -d "subject_token_type=urn:ietf:params:oauth:token-type:jwt" \
            -d "client_id=b76b6808-9e10-43b3-be20-6b6d19ed1af0" \
            -d "scope=all-apis")
          ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r .access_token)
          echo "::add-mask::${ACCESS_TOKEN}"
          echo "token=${ACCESS_TOKEN}" >> "$GITHUB_OUTPUT"
        env:
          SUBJECT_TOKEN: ${{ steps.github-oidc.outputs.token }}

      - name: Build settings
        id: config
        run: |
          TOOLS_JSON=$(cat << 'TOOLS'
          ["mcp__github_inline_comment__create_inline_comment", "Bash(pr-diff)", "Bash(pr-diff *)", "Bash(pr-view)", "Bash(pr-view *)", "Bash(pr-comment *)", "Bash(git log)", "Bash(git log *)", "Bash(git diff)", "Bash(git diff *)", "Bash(git show *)", "Bash(grep *)", "Read", "Write", "Glob", "Grep"]
          TOOLS
          )
          SETTINGS=$(jq -n \
            --argjson tools "$TOOLS_JSON" \
            --arg auth_token "$OAUTH_TOKEN" \
            '{
              env: {
                ANTHROPIC_BASE_URL: "https://dbc-1232e87d-9384.cloud.databricks.com/serving-endpoints/anthropic",
                ANTHROPIC_AUTH_TOKEN: $auth_token,
                ANTHROPIC_MODEL: "databricks-claude-opus-4-6",
                DISABLE_PROMPT_CACHING: "1",
                CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
              },
              permissions: {
                allow: $tools
              }
            }')
          echo "settings<<EOF" >> "$GITHUB_OUTPUT"
          echo "$SETTINGS" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
        env:
          OAUTH_TOKEN: ${{ steps.oauth.outputs.token }}

      - name: Create PR-scoped helper scripts
        run: |
          NUMBER="$PR_NUMBER"
          printf '#!/bin/bash\nexec gh pr comment %s "$@"\n' "$NUMBER" > /usr/local/bin/pr-comment
          printf '#!/bin/bash\nexec gh pr diff %s "$@"\n' "$NUMBER" > /usr/local/bin/pr-diff
          printf '#!/bin/bash\nexec gh pr view %s "$@"\n' "$NUMBER" > /usr/local/bin/pr-view
          chmod +x /usr/local/bin/pr-comment /usr/local/bin/pr-diff /usr/local/bin/pr-view
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          GH_TOKEN: ${{ github.token }}

      - name: Run Claude Code
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ steps.oauth.outputs.token }}
          github_token: ${{ github.token }}
          prompt: |
            Review this PR. Focus on correctness, error handling, and adherence to the project's Go conventions documented in CLAUDE.md.

            You MUST post all code-specific feedback as inline comments using the mcp__github_inline_comment__create_inline_comment tool. For each issue you find, call this tool with the file path, line number, and your comment. Always set confirmed: true. Do NOT put code-level feedback in a summary comment.

            After posting all inline comments, write a brief summary to a temporary file and post it with: pr-comment --body-file <path>. The summary should only list the number of inline comments posted and a one-line overview. If you have no issues to raise, just post a short comment saying the PR looks good.
          claude_args: '--max-turns 100 --allowedTools "mcp__github_inline_comment__create_inline_comment"'
          trigger_phrase: "@claude"
          settings: ${{ steps.config.outputs.settings }}
          show_full_output: true

  # Interactive @claude mentions — Claude can make changes and push commits.
  assist:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude'))
    runs-on:
      group: databricks-deco-testing-runner-group
      labels: ubuntu-latest-deco
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Get GitHub OIDC token
        id: github-oidc
        uses: actions/github-script@v7
        with:
          script: |
            const token = await core.getIDToken('968367da-7edd-44f7-9dea-3e0b20b0ec97');
            core.setSecret(token);
            core.setOutput('token', token);

      - name: Get Databricks OAuth token
        id: oauth
        run: |
          TOKEN_RESPONSE=$(curl -sfS -X POST \
            "https://accounts.cloud.databricks.com/oidc/accounts/968367da-7edd-44f7-9dea-3e0b20b0ec97/v1/token" \
            -H "Content-Type: application/x-www-form-urlencoded" \
            -d "grant_type=urn:ietf:params:oauth:grant-type:token-exchange" \
            -d "subject_token=${SUBJECT_TOKEN}" \
            -d "subject_token_type=urn:ietf:params:oauth:token-type:jwt" \
            -d "client_id=b76b6808-9e10-43b3-be20-6b6d19ed1af0" \
            -d "scope=all-apis")
          ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r .access_token)
          echo "::add-mask::${ACCESS_TOKEN}"
          echo "token=${ACCESS_TOKEN}" >> "$GITHUB_OUTPUT"
        env:
          SUBJECT_TOKEN: ${{ steps.github-oidc.outputs.token }}

      - name: Build settings
        id: config
        run: |
          TOOLS_JSON=$(cat << 'TOOLS'
          ["mcp__github_ci__get_ci_status", "mcp__github_ci__get_workflow_run_details", "mcp__github_ci__download_job_log", "Bash(make lint)", "Bash(make test)", "Bash(make fmt)", "Bash(make schema)", "Bash(go build *)", "Bash(go test *)", "Bash(go vet)", "Bash(go vet *)", "Bash(git add *)", "Bash(git commit *)", "Bash(git diff)", "Bash(git diff *)", "Bash(git log)", "Bash(git log *)", "Bash(git status)", "Bash(git show *)", "Bash(pr-comment *)", "Bash(pr-push)", "Bash(pr-push *)", "Bash(pr-view)", "Bash(pr-view *)", "Bash(grep *)", "Read", "Edit", "Write", "Glob", "Grep"]
          TOOLS
          )
          SETTINGS=$(jq -n \
            --argjson tools "$TOOLS_JSON" \
            --arg auth_token "$OAUTH_TOKEN" \
            '{
              env: {
                ANTHROPIC_BASE_URL: "https://dbc-1232e87d-9384.cloud.databricks.com/serving-endpoints/anthropic",
                ANTHROPIC_AUTH_TOKEN: $auth_token,
                ANTHROPIC_MODEL: "databricks-claude-opus-4-6",
                DISABLE_PROMPT_CACHING: "1",
                CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS: "1"
              },
              permissions: {
                allow: $tools
              }
            }')
          echo "settings<<EOF" >> "$GITHUB_OUTPUT"
          echo "$SETTINGS" >> "$GITHUB_OUTPUT"
          echo "EOF" >> "$GITHUB_OUTPUT"
        env:
          OAUTH_TOKEN: ${{ steps.oauth.outputs.token }}

      - name: Create PR-scoped helper scripts
        run: |
          NUMBER="$ISSUE_NUMBER"
          BRANCH=$(gh pr view "$NUMBER" --json headRefName -q .headRefName)
          printf '#!/bin/bash\nexec gh pr comment %s "$@"\n' "$NUMBER" > /usr/local/bin/pr-comment
          printf '#!/bin/bash\nexec git push origin "HEAD:refs/heads/%s" "$@"\n' "$BRANCH" > /usr/local/bin/pr-push
          printf '#!/bin/bash\nexec gh pr view %s "$@"\n' "$NUMBER" > /usr/local/bin/pr-view
          chmod +x /usr/local/bin/pr-comment /usr/local/bin/pr-push /usr/local/bin/pr-view
        env:
          ISSUE_NUMBER: ${{ github.event.issue.number }}
          GH_TOKEN: ${{ github.token }}

      - name: Run Claude Code
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ steps.oauth.outputs.token }}
          github_token: ${{ github.token }}
          claude_args: "--max-turns 100"
          trigger_phrase: "@claude"
          settings: ${{ steps.config.outputs.settings }}
          show_full_output: true