mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
Henry ParkandGitHub
c541220ea4
* feat(ci): chained promotion PRs with multi-agent Claude review [skip-regression-check] Staging CI workflow with batched promotion PRs: - Creates staging-promote/<sha> branches per batch - Chains PRs onto previous promotion branch (incremental diffs) - Claude Code reviews only the incremental changes per batch - Blocked PRs stay open as records of findings - staging-tested tag advances regardless of gate outcome - Runs every 60 min on cron + manual dispatch Multi-agent Claude review (Sonnet orchestrator + Haiku agents): - 4 parallel Sonnet review agents (security, architecture, bugs, performance) - Haiku agents for severity/confidence scoring - [SEVERITY:CONFIDENCE] output format - Severity/confidence matrix for issue creation and gate blocking: CRITICAL: always create issue, block if confidence >=80 HIGH: create issue if confidence >=50 MEDIUM/LOW: create issue if confidence >=80
100 lines
4.7 KiB
YAML
100 lines
4.7 KiB
YAML
name: Claude Code Review
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, labeled]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
id-token: write
|
|
|
|
concurrency:
|
|
group: claude-review-${{ github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
review:
|
|
name: Claude Code Review
|
|
if: contains(github.event.pull_request.labels.*.name, 'staging-promotion')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Run Claude Code review
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
claude_args: "--max-turns 50 --model claude-haiku-4-5-20251001 --allowedTools 'Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search:*),Bash(git blame:*),Bash(git log:*),Bash(git diff:*)'"
|
|
prompt: |
|
|
Code review this pull request. Follow these steps precisely:
|
|
|
|
1. Use a Haiku agent to find relevant CLAUDE.md files: the root CLAUDE.md
|
|
and any CLAUDE.md files in directories whose files this PR modifies.
|
|
|
|
2. Use a Haiku agent to summarize the PR change (use `gh pr diff`).
|
|
|
|
3. Launch 4 parallel agents to review the change independently. Each agent should
|
|
read the PR diff with `gh pr diff` and the full source files for changed
|
|
code, then return a list of issues found:
|
|
|
|
Agent 1 — Security & Safety
|
|
Check for: command injection, path traversal, SSRF, XSS, auth bypass,
|
|
secrets in logs, .unwrap()/.expect() in production code (not tests),
|
|
race conditions, TOCTOU, unsafe blocks, panics in async, unbounded allocations.
|
|
|
|
Agent 2 — Architecture & Patterns
|
|
Check for: extensible design (traits/enums over nested conditionals),
|
|
clean abstractions, proper error types (thiserror), CLAUDE.md compliance,
|
|
type-driven design over stringly-typed code, DRY violations.
|
|
|
|
Agent 3 — Bug Scan
|
|
Shallow diff-only scan for obvious bugs: logic errors, off-by-one,
|
|
missing error handling, division by zero, incorrect return values.
|
|
Ignore nitpicks and likely false positives. Do NOT read extra context
|
|
beyond the diff — focus only on the changes.
|
|
|
|
Agent 4 — Performance & Production
|
|
Check for: blocking in async, N+1 queries, unbounded loops, missing
|
|
timeouts, resource leaks (file handles, connections), large allocations
|
|
in hot paths.
|
|
|
|
4. For each issue found, launch a parallel Haiku agent to:
|
|
a. Assign a severity:
|
|
- CRITICAL: security vulns, panics in prod (.unwrap/.expect), data exfiltration, race conditions
|
|
- HIGH: logic bugs, missing error handling, breaking API/schema changes
|
|
- MEDIUM: missing tests, unnecessary complexity, performance issues
|
|
- LOW: documentation gaps, naming suggestions
|
|
b. Score confidence 0-100 (give this rubric verbatim):
|
|
0: False positive, doesn't stand up to scrutiny, or pre-existing issue.
|
|
25: Might be real, but may be false positive. Stylistic issues not in CLAUDE.md.
|
|
50: Real issue but nitpick or rare in practice. Not very important.
|
|
75: Verified real issue, will be hit in practice. Directly impacts functionality
|
|
or explicitly mentioned in CLAUDE.md.
|
|
100: Certain, confirmed, will happen frequently. Evidence directly confirms.
|
|
|
|
5. Post a single comment on the PR using `gh pr comment` with this format.
|
|
If no issues were found, post "No issues found." instead:
|
|
|
|
### Code review
|
|
|
|
Found N issues:
|
|
|
|
1. [SEVERITY:CONFIDENCE] <brief description>
|
|
|
|
<permalink to file:line using full SHA, eg https://github.com/owner/repo/blob/abc123def/src/file.rs#L10-L15>
|
|
|
|
Example: [CRITICAL:92] `.unwrap()` can panic in production when config is missing
|
|
|
|
You MUST use the full git SHA in links (not HEAD or branch name).
|
|
Provide 1 line of context before and after each linked range.
|
|
|
|
Notes:
|
|
- Use `gh` for all GitHub interactions, not web fetch
|
|
- Do NOT check build signal or attempt to build/test the code
|
|
- Ignore pre-existing issues not introduced by this PR
|
|
- Ignore issues a linter/compiler would catch (formatting, imports, types)
|