|
1 | 1 | name: Claude Automated PR Review |
2 | 2 |
|
3 | 3 | on: |
4 | | - # Reusable workflow - called by pr-checks.yml orchestrator |
5 | | - workflow_call: |
| 4 | + # Using pull_request (not pull_request_target) for security: |
| 5 | + # - pull_request_target exposes secrets to fork PRs, creating exfiltration risk |
| 6 | + # - For fork PRs needing review, maintainers can manually @claude via claude.yml |
| 7 | + pull_request: |
| 8 | + types: [opened, synchronize, ready_for_review] |
6 | 9 |
|
7 | 10 | # Cancel any in-progress review for the same PR when new commits are pushed |
8 | 11 | concurrency: |
9 | | - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} |
| 12 | + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} |
10 | 13 | cancel-in-progress: true |
11 | 14 |
|
12 | 15 | jobs: |
|
17 | 20 | github.actor != 'claude[bot]' && |
18 | 21 | github.event.pull_request.draft == false |
19 | 22 | runs-on: ubuntu-latest |
20 | | - timeout-minutes: 15 |
21 | 23 | permissions: |
22 | 24 | contents: read |
23 | 25 | pull-requests: write |
|
35 | 37 | with: |
36 | 38 | node-version: "20" |
37 | 39 |
|
38 | | - - name: Cache npm packages |
39 | | - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 |
40 | | - with: |
41 | | - path: ~/.npm |
42 | | - key: npm-markdownlint-${{ runner.os }} |
43 | | - restore-keys: npm-markdownlint- |
| 40 | + - name: Install markdownlint-cli |
| 41 | + run: npm install -g markdownlint-cli |
44 | 42 |
|
45 | 43 | - name: Review PR with Claude |
46 | 44 | uses: anthropics/claude-code-action@6337623ebba10cf8c8214b507993f8062fd4ccfb # v1.0.22 |
|
58 | 56 |
|
59 | 57 | ## Instructions |
60 | 58 | 1. Get the PR diff to understand what changed |
61 | | - 2. If any `.md` files were changed, run `npx markdownlint-cli --config .markdownlint.json <files>` to check for style issues |
| 59 | + 2. If any `.md` files were changed, run `markdownlint --config .markdownlint.json <files>` to check for style issues |
62 | 60 | 3. Review the changes against the criteria below |
63 | 61 | 4. Post a summary comment with your findings |
64 | 62 |
|
|
70 | 68 | - **Agents** (`agents/*.md`): Verify <example> blocks for triggering, appropriate tool restrictions. |
71 | 69 | - **Hooks** (`hooks/hooks.json`): Validate event types and matcher patterns. |
72 | 70 |
|
73 | | - ### Markdown Quality |
74 | | - Run `npx markdownlint-cli --config .markdownlint.json` on changed `.md` files. Key rules enforced: |
| 71 | + ### Markdown Quality (run markdownlint) |
| 72 | + Run `markdownlint --config .markdownlint.json` on changed `.md` files. Key rules enforced: |
75 | 73 | - ATX-style headers (`#` not underlines) |
76 | 74 | - Dash-style lists (`-` not `*` or `+`) |
77 | 75 | - 2-space indentation for nested lists |
|
92 | 90 | Be constructive and helpful. Focus on significant issues, not nitpicks. |
93 | 91 | If the PR looks good, say so briefly - don't invent problems. |
94 | 92 | claude_args: | |
95 | | - --allowedTools "Bash(gh pr:*),Bash(npx markdownlint-cli:*),Read,Glob,Grep,mcp__github_inline_comment__create_inline_comment" |
| 93 | + --allowedTools "Bash(gh pr:*),Bash(markdownlint:*),Read,Glob,Grep,mcp__github_inline_comment__create_inline_comment" |
0 commit comments