actions/.github/workflows/claude-review.yml at 3dc4e4e91cc512eb3159074fff81eea32598a363 · WalletConnect/actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Claude Auto Review

on:
  pull_request:
    types: [opened]
    branches: [master]
  issue_comment:
    types: [created]

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    if: |
      github.event_name == 'pull_request'
      || (
        github.event_name == 'issue_comment'
        && github.event.issue.pull_request
        && contains(github.event.comment.body, '@claude review')
      )
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Claude Review
        uses: WalletConnect/actions/claude/auto-review@master
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          project_context: |
            WalletConnect Actions Repository

            Purpose: Reusable GitHub composite actions and workflows for Terraform infrastructure, AWS ECS deployments, release automation, and AI PR reviews.

            Primary Entry Points
            - actions/deploy-terraform and actions/plan-terraform for infrastructure workflows
            - actions/deploy-ecs for ECS service deployments
            - terraform/ and aws/ directories contain lower-level building blocks
            - claude/auto-review wraps Anthropics claude-code-action for PR reviews

            Key Conventions for Review
            - All actions are composite with bash steps
            - Inputs use kebab-case; outputs are written via the GITHUB_OUTPUT file
            - Consumers should pin actions to a full 40-character commit SHA, not a branch
            - Prefer the working-directory field in steps over changing directories in scripts
            - Terraform usage: select environment via TF_WORKSPACE, run non-interactively, apply with auto-approve, and disable color output in CI
            - AWS usage: configure credentials with aws-actions/configure-aws-credentials v4 and require an explicit region
            - Grafana integration: temporary keys with short TTL and guaranteed cleanup using always

            Security and Compliance Expectations
            - Do not print or commit secrets; mask sensitive values in logs
            - Ensure cleanup of temporary credentials and keys
            - External domains in code or configs should be limited to reown.com, walletconnect.com, walletconnect.org

            Reviewer Focus for This Repository
            - Backward compatibility of action inputs and outputs
            - Safe bash practices including robust quoting and clear error handling
            - Secret handling and masking throughout steps
            - Idempotency and deterministic behavior of composite actions
            - Correct commit SHA pinning for any referenced actions
            - PR titles follow conventional commit format