Skip to content

Commit 6647661

Browse files
sfreudenthalerclaude
sfreudenthaler
and
claude
committed
feat: add Claude code review workflow with per-repo API key security
- Add reusable claude-code-review.yml workflow with configurable review focus - Require each repository to provide its own ANTHROPIC_API_KEY secret - Implement cost tracking and security isolation through per-repo API keys - Add comprehensive documentation with setup instructions - Include example workflow for consuming repositories - Enhance test validation to check secret requirements in reusable workflows 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 9ea90eb commit 6647661

4 files changed

Lines changed: 297 additions & 0 deletions

File tree

‎.github/workflows/claude-code-review.yml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
name: Claude Code Review
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
files_to_review:
7+
description: 'Comma-separated list of files to review (optional - defaults to all changed files)'
8+
required: false
9+
type: string
10+
default: ''
11+
review_focus:
12+
description: 'Specific focus for the review (e.g., security, performance, best-practices)'
13+
required: false
14+
type: string
15+
default: 'general'
16+
max_files:
17+
description: 'Maximum number of files to review in a single run'
18+
required: false
19+
type: number
20+
default: 10
21+
secrets:
22+
ANTHROPIC_API_KEY:
23+
description: 'Anthropic API key for Claude access'
24+
required: true
25+
26+
jobs:
27+
claude-review:
28+
name: Claude Code Review
29+
runs-on: ubuntu-latest
30+
31+
steps:
32+
- name: Checkout code
33+
uses: actions/checkout@v4
34+
with:
35+
fetch-depth: 0
36+
37+
- name: Get changed files
38+
id: changed-files
39+
run: |
40+
if [ -n "${{ inputs.files_to_review }}" ]; then
41+
echo "files=${{ inputs.files_to_review }}" >> $GITHUB_OUTPUT
42+
else
43+
# Get changed files from PR or push
44+
if [ "${{ github.event_name }}" = "pull_request" ]; then
45+
files=$(git diff --name-only ${{ github.event.pull_request.base.sha }} ${{ github.sha }} | head -${{ inputs.max_files }} | tr '\n' ',' | sed 's/,$//')
46+
else
47+
files=$(git diff --name-only HEAD~1 HEAD | head -${{ inputs.max_files }} | tr '\n' ',' | sed 's/,$//')
48+
fi
49+
echo "files=$files" >> $GITHUB_OUTPUT
50+
fi
51+
52+
- name: Setup Node.js
53+
uses: actions/setup-node@v4
54+
with:
55+
node-version: '20'
56+
57+
- name: Install Claude CLI
58+
run: |
59+
npm install -g @anthropic-ai/claude-cli
60+
61+
- name: Configure Claude CLI
62+
run: |
63+
echo "${{ secrets.ANTHROPIC_API_KEY }}" | claude auth login --api-key-stdin
64+
env:
65+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
66+
67+
- name: Run Claude Code Review
68+
id: review
69+
run: |
70+
files="${{ steps.changed-files.outputs.files }}"
71+
focus="${{ inputs.review_focus }}"
72+
73+
if [ -z "$files" ]; then
74+
echo "No files to review"
75+
exit 0
76+
fi
77+
78+
# Create review prompt based on focus
79+
case "$focus" in
80+
"security")
81+
prompt="Please review these files for security vulnerabilities, potential exploits, and security best practices. Focus on: authentication, authorization, input validation, data sanitization, and secrets handling."
82+
;;
83+
"performance")
84+
prompt="Please review these files for performance issues, inefficient algorithms, memory leaks, and optimization opportunities."
85+
;;
86+
"best-practices")
87+
prompt="Please review these files for code quality, maintainability, and adherence to best practices for the respective languages and frameworks."
88+
;;
89+
*)
90+
prompt="Please review these files for code quality, potential bugs, security issues, and suggest improvements."
91+
;;
92+
esac
93+
94+
# Run Claude review
95+
echo "Reviewing files: $files"
96+
echo "Review focus: $focus"
97+
98+
# Split files and review each one
99+
IFS=',' read -ra FILE_ARRAY <<< "$files"
100+
review_output=""
101+
102+
for file in "${FILE_ARRAY[@]}"; do
103+
if [ -f "$file" ]; then
104+
echo "Reviewing: $file"
105+
file_review=$(claude "$prompt" --file "$file" 2>&1 || echo "Error reviewing $file")
106+
review_output="$review_output\n\n## Review of $file\n$file_review"
107+
fi
108+
done
109+
110+
# Save review to file
111+
echo -e "$review_output" > claude_review.md
112+
113+
# Set output for comment
114+
echo "review_completed=true" >> $GITHUB_OUTPUT
115+
116+
- name: Comment on PR
117+
if: github.event_name == 'pull_request' && steps.review.outputs.review_completed == 'true'
118+
uses: actions/github-script@v7
119+
with:
120+
script: |
121+
const fs = require('fs');
122+
const path = 'claude_review.md';
123+
124+
if (fs.existsSync(path)) {
125+
const review = fs.readFileSync(path, 'utf8');
126+
const comment = `## 🤖 Claude Code Review
127+
128+
**Review Focus:** ${{ inputs.review_focus }}
129+
**Files Reviewed:** ${{ steps.changed-files.outputs.files }}
130+
131+
${review}
132+
133+
---
134+
*This review was generated by Claude AI. Please use it as a guide and apply your own judgment.*`;
135+
136+
github.rest.issues.createComment({
137+
issue_number: context.issue.number,
138+
owner: context.repo.owner,
139+
repo: context.repo.repo,
140+
body: comment
141+
});
142+
}
143+
144+
- name: Upload review artifact
145+
if: steps.review.outputs.review_completed == 'true'
146+
uses: actions/upload-artifact@v4
147+
with:
148+
name: claude-review-${{ github.run_id }}
149+
path: claude_review.md
150+
retention-days: 30

‎.github/workflows/test.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,4 +64,24 @@ jobs:
6464
exit 1
6565
fi
6666
fi
67+
done
68+
69+
- name: Validate secret requirements in reusable workflows
70+
run: |
71+
# Check that reusable workflows properly define required secrets
72+
for file in .github/workflows/*.yml .github/workflows/*.yaml; do
73+
if [ -f "$file" ] && grep -q "workflow_call:" "$file"; then
74+
echo "Validating reusable workflow secrets in $file"
75+
76+
# Check if workflow uses secrets but doesn't declare them
77+
if grep -q "secrets\." "$file" && ! grep -q "secrets:" "$file"; then
78+
echo "ERROR: $file uses secrets but doesn't declare them in workflow_call"
79+
exit 1
80+
fi
81+
82+
# Check for required ANTHROPIC_API_KEY if Claude CLI is used
83+
if grep -q "claude\|anthropic" "$file" && ! grep -q "ANTHROPIC_API_KEY" "$file"; then
84+
echo "WARNING: $file appears to use Claude but doesn't require ANTHROPIC_API_KEY secret"
85+
fi
86+
fi
6787
done

‎README.md‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,103 @@
11
# claude-workflows
22
Reusable Claude AI GitHub Actions workflows and config for dotCMS and related projects
3+
4+
## Important: Security and Cost Management
5+
6+
**⚠️ API Key Requirement**: All workflows in this repository require each consuming repository to provide its own Anthropic API key. This is a mandatory security and cost management requirement.
7+
8+
**Why we require per-repository API keys:**
9+
10+
1. **Cost Tracking & Accountability**: Each repository's Claude AI usage is tracked separately in the Anthropic console, allowing for detailed cost attribution and budget management per project.
11+
12+
2. **Security Isolation**: If a repository experiences unauthorized or excessive usage, it only affects that repository's API key and budget, not a shared organizational key.
13+
14+
3. **Usage Control**: Individual repositories can set their own API limits and monitoring, preventing runaway costs from affecting other projects.
15+
16+
4. **Compliance**: Many organizations require API key isolation for audit trails and security compliance.
17+
18+
**What this means for you:**
19+
- You **must** configure an `ANTHROPIC_API_KEY` secret in your repository
20+
- You **must** pass this secret to the reusable workflow in the `secrets:` section
21+
- The workflow will **fail** if the API key is not provided
22+
- Each repository is responsible for its own API costs and usage
23+
24+
## Available Workflows
25+
26+
### Claude Code Review (`claude-code-review.yml`)
27+
Provides AI-powered code review using Claude AI for pull requests and commits.
28+
29+
**Features:**
30+
- Reviews changed files in PRs automatically
31+
- Configurable review focus (general, security, performance, best-practices)
32+
- Posts review comments directly on PRs
33+
- Supports custom file selection
34+
- Uploads review artifacts
35+
36+
## Setup Instructions
37+
38+
### 1. Repository Secret Configuration
39+
Each consuming repository must configure its own Anthropic API key:
40+
41+
1. Go to your repository's Settings → Secrets and variables → Actions
42+
2. Create a new repository secret named `ANTHROPIC_API_KEY`
43+
3. Set the value to your Anthropic API key
44+
45+
**Benefits of per-repository API keys:**
46+
- **Cost Tracking**: Each repository's usage is tracked separately in the Anthropic console
47+
- **Security Isolation**: Unauthorized usage in one repo won't affect others
48+
- **Usage Control**: Individual repos can manage their own API limits
49+
50+
### 2. Using the Claude Code Review Workflow
51+
52+
Create a workflow file in your repository at `.github/workflows/claude-review.yml`:
53+
54+
```yaml
55+
name: PR Code Review with Claude
56+
57+
on:
58+
pull_request:
59+
types: [opened, synchronize, reopened]
60+
branches: [ main, develop ]
61+
62+
jobs:
63+
claude-review:
64+
name: Claude AI Code Review
65+
uses: dotCMS/claude-workflows/.github/workflows/claude-code-review.yml@main
66+
with:
67+
# Optional: Set review focus
68+
review_focus: 'security' # Options: general, security, performance, best-practices
69+
70+
# Optional: Maximum number of files to review
71+
max_files: 15
72+
73+
# Optional: Specify specific files (defaults to all changed files)
74+
# files_to_review: 'src/main.js,src/utils.js'
75+
secrets:
76+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
77+
```
78+
79+
### 3. Workflow Inputs
80+
81+
| Input | Description | Required | Default |
82+
|-------|-------------|----------|---------|
83+
| `files_to_review` | Comma-separated list of specific files to review | No | All changed files |
84+
| `review_focus` | Review focus area | No | `general` |
85+
| `max_files` | Maximum number of files to review | No | `10` |
86+
87+
**Review Focus Options:**
88+
- `general`: Overall code quality, bugs, and improvements
89+
- `security`: Security vulnerabilities and best practices
90+
- `performance`: Performance issues and optimizations
91+
- `best-practices`: Code quality and maintainability
92+
93+
### 4. Required Secrets
94+
95+
| Secret | Description | Required | Notes |
96+
|--------|-------------|----------|-------|
97+
| `ANTHROPIC_API_KEY` | Your repository's Anthropic API key | **Yes** | Must be configured in each consuming repository. The workflow will fail without this secret. |
98+
99+
**⚠️ Critical**: The `ANTHROPIC_API_KEY` secret is mandatory and must be passed to the reusable workflow. This is not optional - it's a security and cost management requirement. See the "Security and Cost Management" section above for details.
100+
101+
## Examples
102+
103+
See the `examples/` directory for complete workflow examples.

‎examples/consumer-repo-workflow.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Example workflow for a consumer repository
2+
# This file should be placed in .github/workflows/ in the consuming repository
3+
4+
name: PR Code Review with Claude
5+
6+
on:
7+
pull_request:
8+
types: [opened, synchronize, reopened]
9+
branches: [ main, develop ]
10+
11+
jobs:
12+
claude-review:
13+
name: Claude AI Code Review
14+
uses: dotCMS/claude-workflows/.github/workflows/claude-code-review.yml@main
15+
with:
16+
# Optional: Specify files to review (defaults to all changed files)
17+
# files_to_review: 'src/main.js,src/utils.js'
18+
19+
# Optional: Set review focus (general, security, performance, best-practices)
20+
review_focus: 'security'
21+
22+
# Optional: Maximum number of files to review
23+
max_files: 15
24+
secrets:
25+
# Pass the repository's own Anthropic API key
26+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

0 commit comments

Comments
 (0)