Merge pull request Expensify#88584 from Expensify/mountiny-claude-review-cplus-approval

Run Claude PR reviewer when a Contributor+ approves a PR

Author: AndrewGable

.github/actions/composite/isContributorPlus/action.yml

@@ -0,0 +1,33 @@
+name: Is Contributor+
+description: Check whether a GitHub user is a member of the Expensify/contributor-plus team. Sets IS_CPLUS=true when the user is a member, IS_CPLUS=false otherwise.
+
+inputs:
+  USERNAME:
+    description: The GitHub login of the user to check.
+    required: true
+  OS_BOTIFY_TOKEN:
+    description: OSBotify token. Needed to read team memberships (the default GITHUB_TOKEN lacks the read:org scope).
+    required: true
+
+outputs:
+  IS_CPLUS:
+    description: "'true' if the user is a member of Expensify/contributor-plus, 'false' otherwise."
+    value: ${{ steps.check.outputs.IS_CPLUS }}
+
+runs:
+  using: composite
+  steps:
+    - name: Check Contributor+ membership
+      id: check
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.OS_BOTIFY_TOKEN }}
+        USERNAME: ${{ inputs.USERNAME }}
+      run: |
+        if gh api "/orgs/Expensify/teams/contributor-plus/memberships/$USERNAME" --silent; then
+          echo "::notice::✅ $USERNAME is a Contributor+ member"
+          echo "IS_CPLUS=true" >> "$GITHUB_OUTPUT"
+        else
+          echo "::notice::$USERNAME is not a Contributor+ member"
+          echo "IS_CPLUS=false" >> "$GITHUB_OUTPUT"
+        fi

.github/workflows/claude-review.yml

@@ -7,25 +7,50 @@ permissions:
 on:
   pull_request_target:
     types: [opened, ready_for_review]
+  pull_request_review:
+    types: [submitted]
 
 concurrency:
   group: claude-review-${{ github.event.pull_request.html_url }}
   cancel-in-progress: true
 
 jobs:
   validate:
+    if: github.event_name == 'pull_request_target'
     uses: ./.github/workflows/contributorValidationGate.yml
     with:
       PR_NUMBER: ${{ github.event.pull_request.number }}
       PR_AUTHOR: ${{ github.event.pull_request.user.login }}
       AUTHOR_ASSOCIATION: ${{ github.event.pull_request.author_association }}
 
+  checkCPlusApproval:
+    if: github.event_name == 'pull_request_review' && github.event.review.state == 'approved'
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    outputs:
+      IS_CPLUS: ${{ steps.check.outputs.IS_CPLUS }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 1
+
+      - name: Check Contributor+ membership
+        id: check
+        uses: ./.github/actions/composite/isContributorPlus
+        with:
+          USERNAME: ${{ github.event.review.user.login }}
+          OS_BOTIFY_TOKEN: ${{ secrets.OS_BOTIFY_TOKEN }}
+
   review:
-    needs: [validate]
+    needs: [validate, checkCPlusApproval]
     if: |
-      needs.validate.outputs.IS_AUTHORIZED == 'true'
+      !cancelled()
       && github.event.pull_request.draft != true
       && !contains(github.event.pull_request.title, 'Revert')
+      && (
+        (github.event_name == 'pull_request_target' && needs.validate.outputs.IS_AUTHORIZED == 'true')
+        || (github.event_name == 'pull_request_review' && needs.checkCPlusApproval.outputs.IS_CPLUS == 'true')
+      )
     runs-on: blacksmith-2vcpu-ubuntu-2404
     env:
       PR_NUMBER: ${{ github.event.pull_request.number }}