|
| 1 | +name: Claude Code Improvements |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + types: [opened, synchronize, ready_for_review, reopened] |
| 6 | + |
| 7 | +# Shared with claude-watcher: both mutate the PR branch (commit + push), so they |
| 8 | +# must not run simultaneously. Keying on head branch serializes reviewer and |
| 9 | +# watcher runs targeting the same PR into a single queue. |
| 10 | +concurrency: |
| 11 | + group: claude-pr-${{ github.event.pull_request.head.ref }} |
| 12 | + cancel-in-progress: false |
| 13 | + |
| 14 | +jobs: |
| 15 | + claude-review: |
| 16 | + runs-on: self-hosted |
| 17 | + if: github.event.pull_request.head.repo.full_name == github.repository |
| 18 | + permissions: |
| 19 | + contents: write |
| 20 | + pull-requests: write |
| 21 | + issues: read |
| 22 | + id-token: write |
| 23 | + |
| 24 | + steps: |
| 25 | + - name: Checkout PR branch |
| 26 | + uses: actions/checkout@v6 |
| 27 | + with: |
| 28 | + ref: ${{ github.event.pull_request.head.ref }} |
| 29 | + fetch-depth: 0 |
| 30 | + |
| 31 | + - name: Compute PR diff stats |
| 32 | + id: diff |
| 33 | + env: |
| 34 | + BASE_REF: ${{ github.event.pull_request.base.ref }} |
| 35 | + HEAD_SHA: ${{ github.event.pull_request.head.sha }} |
| 36 | + run: | |
| 37 | + git fetch --no-tags origin "+refs/heads/$BASE_REF:refs/remotes/origin/$BASE_REF" |
| 38 | + merge_base=$(git merge-base "origin/$BASE_REF" "$HEAD_SHA") |
| 39 | + changed_files=$(git diff --name-only "$merge_base..$HEAD_SHA" | wc -l | tr -d ' ') |
| 40 | + changed_lines=$(git diff --shortstat "$merge_base..$HEAD_SHA" | awk '{ ins=0; del=0; for (i=1;i<=NF;i++) { if ($i ~ /insertion/) ins=$(i-1); if ($i ~ /deletion/) del=$(i-1) } print ins + del }') |
| 41 | + changed_lines=${changed_lines:-0} |
| 42 | +
|
| 43 | + { |
| 44 | + echo "files=$changed_files" |
| 45 | + echo "lines=$changed_lines" |
| 46 | + echo 'file_list<<__EOF__' |
| 47 | + git diff --name-only "$merge_base..$HEAD_SHA" | head -50 |
| 48 | + echo '__EOF__' |
| 49 | + } >> "$GITHUB_OUTPUT" |
| 50 | +
|
| 51 | + - name: Classify PR complexity with Haiku |
| 52 | + id: classify |
| 53 | + uses: ./.github/actions/classify-complexity |
| 54 | + with: |
| 55 | + oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
| 56 | + prompt: | |
| 57 | + Classify this pull request's review complexity. Reply with EXACTLY one lowercase word and nothing else: 'simple' or 'complex'. |
| 58 | +
|
| 59 | + simple = typo fix, docs tweak, one-file obvious bug, rename, trivial refactor within a single function, small test-only change |
| 60 | + complex = multi-file change, new feature, architecture or API change, deep debugging, performance work, security-sensitive code, anything with unclear scope or touching more than ~3 files |
| 61 | +
|
| 62 | + TITLE: ${{ github.event.pull_request.title }} |
| 63 | +
|
| 64 | + STATS: ${{ steps.diff.outputs.files }} files, ${{ steps.diff.outputs.lines }} lines changed |
| 65 | +
|
| 66 | + FILES: |
| 67 | + ${{ steps.diff.outputs.file_list }} |
| 68 | +
|
| 69 | + DESCRIPTION: |
| 70 | + ${{ github.event.pull_request.body }} |
| 71 | +
|
| 72 | + - name: Run Claude Code Review |
| 73 | + id: claude-review |
| 74 | + uses: anthropics/claude-code-action@v1 |
| 75 | + env: |
| 76 | + PR_NUMBER: ${{ github.event.pull_request.number }} |
| 77 | + REPO: ${{ github.repository }} |
| 78 | + HEAD_BRANCH: ${{ github.event.pull_request.head.ref }} |
| 79 | + with: |
| 80 | + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
| 81 | + plugin_marketplaces: | |
| 82 | + https://github.com/anthropics/claude-code.git |
| 83 | + https://github.com/abnegate/claudes.git |
| 84 | + plugins: | |
| 85 | + code-review@claude-code-plugins |
| 86 | + skills@claudes |
| 87 | + use_sticky_comment: 'false' |
| 88 | + use_commit_signing: 'true' |
| 89 | + show_full_output: 'true' |
| 90 | + claude_args: | |
| 91 | + --model ${{ steps.classify.outputs.model }} |
| 92 | + --fallback-model ${{ steps.classify.outputs.fallback }} |
| 93 | + --dangerously-skip-permissions |
| 94 | + prompt: | |
| 95 | + You are reviewing and fixing PR #$PR_NUMBER in $REPO. |
| 96 | +
|
| 97 | + ## Coordination with the CI watcher |
| 98 | + The `claude-watcher` workflow also pushes to this PR branch when CI fails. |
| 99 | + We share a concurrency group (branch-keyed), so only one of us runs at a time — |
| 100 | + but the OTHER may have pushed between the last event and this job starting. |
| 101 | + Before committing in STEP 5, `git fetch origin` and `git pull --rebase origin <branch>`. |
| 102 | + If rebase conflicts, resolve them (prefer the other side's changes unless they |
| 103 | + contradict a finding you're fixing), then continue. |
| 104 | +
|
| 105 | + ## STEP 1 — Analyze |
| 106 | + Run `/code-review:code-review` for all CRITICAL/HIGH/MEDIUM findings. Skip low/nits. |
| 107 | +
|
| 108 | + ## STEP 2 — Post inline review |
| 109 | + Build /tmp/review.json with this structure and post it: |
| 110 | + ```json |
| 111 | + { |
| 112 | + "event": "COMMENT", |
| 113 | + "body": "## Code Review\n\n**N finding(s)**\n\nSee inline comments. Fixes incoming.", |
| 114 | + "comments": [ |
| 115 | + {"path": "file.php", "line": 42, "body": "**[SEVERITY]** ...\n\nExplanation + fix."} |
| 116 | + ] |
| 117 | + } |
| 118 | + ``` |
| 119 | + Post: `gh api repos/$REPO/pulls/$PR_NUMBER/reviews --input /tmp/review.json` |
| 120 | +
|
| 121 | + If zero findings: post "No critical/high/medium findings." and STOP. |
| 122 | +
|
| 123 | + ## STEP 3 — Fix in parallel via isolated worktree subagents |
| 124 | + For MAXIMUM speed, launch one Agent per finding using worktree isolation. |
| 125 | + Findings in different files run in TRUE parallel — launch them ALL in one message. |
| 126 | + Findings in the SAME file go to the SAME agent to avoid conflicts. |
| 127 | +
|
| 128 | + Each agent prompt must be self-contained: |
| 129 | + - Include the finding: severity, file path, line numbers, what's wrong, how to fix |
| 130 | + - Tell it to verify the fix compiles (read CLAUDE.md for the build command) |
| 131 | + - Tell it NOT to touch other files or make unrelated changes |
| 132 | +
|
| 133 | + Example — 3 findings in 3 files, all launched at once: |
| 134 | + Agent({description: "Fix 1", isolation: "worktree", prompt: "Fix [HIGH] ... in file.php line 42 ..."}) |
| 135 | + Agent({description: "Fix 2", isolation: "worktree", prompt: "Fix [MEDIUM] ... in other.php line 99 ..."}) |
| 136 | + Agent({description: "Fix 3", isolation: "worktree", prompt: "Fix [MEDIUM] ... in third.php line 7 ..."}) |
| 137 | +
|
| 138 | + ## STEP 4 — Consolidate |
| 139 | + After all agents finish, apply their changes to the main checkout: |
| 140 | + - Each worktree agent returns the files it changed |
| 141 | + - Cherry-pick or manually apply each agent's diff to the working tree |
| 142 | + - If two agents touched the same file, merge carefully |
| 143 | + - Verify final result compiles |
| 144 | +
|
| 145 | + ## STEP 5 — Commit and push |
| 146 | + - `git fetch origin && git pull --rebase origin $HEAD_BRANCH` to absorb any |
| 147 | + commits the watcher (or the PR author) pushed while this job was queued |
| 148 | + - Capture the pre-commit tip: `BEFORE_SHA=$(git rev-parse HEAD)` |
| 149 | + - Stage only fix files |
| 150 | + - Commit: `(fix): address review findings — X HIGH, Y MEDIUM` |
| 151 | + - Body: one bullet per finding |
| 152 | + - Push to PR branch |
| 153 | + - Capture the post-push tip: `AFTER_SHA=$(git rev-parse HEAD)` |
| 154 | +
|
| 155 | + ## STEP 6 — Post summary comment with compare link |
| 156 | + After a successful push, add a follow-up comment linking to a compare view |
| 157 | + of everything this run added, so reviewers can see exactly what changed: |
| 158 | +
|
| 159 | + COMPARE_URL="https://github.com/$REPO/compare/$BEFORE_SHA...$AFTER_SHA" |
| 160 | + gh pr comment $PR_NUMBER --repo $REPO --body "Fixes pushed: $COMPARE_URL |
| 161 | +
|
| 162 | + <bulleted list of commits: \`sha\` — subject>" |
| 163 | +
|
| 164 | + If BEFORE_SHA equals AFTER_SHA (nothing was actually pushed — e.g. all |
| 165 | + fixes were no-ops after rebase), skip this step. |
| 166 | +
|
| 167 | + Rules: |
| 168 | + - Do NOT skip findings. |
| 169 | + - Maximize parallelism — launch as many worktree agents as there are independent file groups. |
| 170 | + - Each agent prompt must be fully self-contained (it has no context from this conversation). |
| 171 | + - Never push to main. |
0 commit comments