mirror of
https://github.com/outbackdingo/optimclaw.git
synced 2026-08-25 14:53:34 +00:00
f4b7309523
Cherry-pick of #794: remove continue-on-error hack, skip redundant checks on staging PRs, allow ironclaw-ci[bot] in Claude Code review. Co-authored-by: Claude Opus 4.6 <[email protected]>
101 lines
4.7 KiB
YAML
101 lines
4.7 KiB
YAML
name: Claude Code Review
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, labeled]
|
|
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
id-token: write
|
|
|
|
concurrency:
|
|
group: claude-review-${{ github.event.pull_request.number || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
review:
|
|
name: Claude Code Review
|
|
if: contains(github.event.pull_request.labels.*.name, 'staging-promotion')
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Run Claude Code review
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
allowed_bots: "ironclaw-ci[bot]"
|
|
claude_args: "--max-turns 50 --model claude-haiku-4-5-20251001 --allowedTools 'Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search:*),Bash(git blame:*),Bash(git log:*),Bash(git diff:*)'"
|
|
prompt: |
|
|
Code review this pull request. Follow these steps precisely:
|
|
|
|
1. Use a Haiku agent to find relevant CLAUDE.md files: the root CLAUDE.md
|
|
and any CLAUDE.md files in directories whose files this PR modifies.
|
|
|
|
2. Use a Haiku agent to summarize the PR change (use `gh pr diff`).
|
|
|
|
3. Launch 4 parallel agents to review the change independently. Each agent should
|
|
read the PR diff with `gh pr diff` and the full source files for changed
|
|
code, then return a list of issues found:
|
|
|
|
Agent 1 — Security & Safety
|
|
Check for: command injection, path traversal, SSRF, XSS, auth bypass,
|
|
secrets in logs, .unwrap()/.expect() in production code (not tests),
|
|
race conditions, TOCTOU, unsafe blocks, panics in async, unbounded allocations.
|
|
|
|
Agent 2 — Architecture & Patterns
|
|
Check for: extensible design (traits/enums over nested conditionals),
|
|
clean abstractions, proper error types (thiserror), CLAUDE.md compliance,
|
|
type-driven design over stringly-typed code, DRY violations.
|
|
|
|
Agent 3 — Bug Scan
|
|
Shallow diff-only scan for obvious bugs: logic errors, off-by-one,
|
|
missing error handling, division by zero, incorrect return values.
|
|
Ignore nitpicks and likely false positives. Do NOT read extra context
|
|
beyond the diff — focus only on the changes.
|
|
|
|
Agent 4 — Performance & Production
|
|
Check for: blocking in async, N+1 queries, unbounded loops, missing
|
|
timeouts, resource leaks (file handles, connections), large allocations
|
|
in hot paths.
|
|
|
|
4. For each issue found, launch a parallel Haiku agent to:
|
|
a. Assign a severity:
|
|
- CRITICAL: security vulns, panics in prod (.unwrap/.expect), data exfiltration, race conditions
|
|
- HIGH: logic bugs, missing error handling, breaking API/schema changes
|
|
- MEDIUM: missing tests, unnecessary complexity, performance issues
|
|
- LOW: documentation gaps, naming suggestions
|
|
b. Score confidence 0-100 (give this rubric verbatim):
|
|
0: False positive, doesn't stand up to scrutiny, or pre-existing issue.
|
|
25: Might be real, but may be false positive. Stylistic issues not in CLAUDE.md.
|
|
50: Real issue but nitpick or rare in practice. Not very important.
|
|
75: Verified real issue, will be hit in practice. Directly impacts functionality
|
|
or explicitly mentioned in CLAUDE.md.
|
|
100: Certain, confirmed, will happen frequently. Evidence directly confirms.
|
|
|
|
5. Post a single comment on the PR using `gh pr comment` with this format.
|
|
If no issues were found, post "No issues found." instead:
|
|
|
|
### Code review
|
|
|
|
Found N issues:
|
|
|
|
1. [SEVERITY:CONFIDENCE] <brief description>
|
|
|
|
<permalink to file:line using full SHA, eg https://github.com/owner/repo/blob/abc123def/src/file.rs#L10-L15>
|
|
|
|
Example: [CRITICAL:92] `.unwrap()` can panic in production when config is missing
|
|
|
|
You MUST use the full git SHA in links (not HEAD or branch name).
|
|
Provide 1 line of context before and after each linked range.
|
|
|
|
Notes:
|
|
- Use `gh` for all GitHub interactions, not web fetch
|
|
- Do NOT check build signal or attempt to build/test the code
|
|
- Ignore pre-existing issues not introduced by this PR
|
|
- Ignore issues a linter/compiler would catch (formatting, imports, types)
|