chore: improve PR follwo-up reviews #1216
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Automated PR review using Claude (anthropics/claude-code-action). | |
| # Requires repository secret: ANTHROPIC_API_KEY | |
| # | |
| # - PRs from branches containing dependabot/: | |
| # Reviews dependency changelogs and usage in code for breaking changes and upgrade risks. | |
| # - All other PRs: | |
| # General code review (quality, edge cases, bugs, readability, maintainability, tests). | |
| name: Claude PR Review | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| concurrency: | |
| group: claude-pr-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| review-dependency-updates: | |
| if: contains(fromJSON('["dependabot[bot]", "ci-signed-commit-bot[bot]"]'), github.actor) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| id-token: write | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Claude review (dependency updates) | |
| uses: anthropics/claude-code-action@v1.0.222 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| track_progress: true | |
| use_sticky_comment: true | |
| allowed_bots: 'ci-signed-commit-bot[bot], dependabot[bot]' | |
| claude_args: >- | |
| --max-turns 40 | |
| --max-budget-usd 5 | |
| --model claude-opus-5 | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)" | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| This PR updates dependencies. Please: | |
| 1. Identify which dependencies changed. | |
| 2. For each changed dependency, consider changelogs, release notes, and semver: look for breaking changes, deprecations, and behavior changes that could affect this codebase. | |
| 3. Search the repo for how each upgraded dependency is used (imports, config, APIs). Flag any usage that might break or behave differently after the upgrade. | |
| 4. Call out specific risks (e.g. API changes, removed features, new defaults) and suggest follow-up checks or tests if needed. | |
| 5. If the scope is large, prioritize the most widely used or critical dependencies. | |
| Note: The PR branch is already checked out in the current working directory. | |
| Focus on upgrade safety and actionable concerns; keep the review concise and scoped to this PR. | |
| Use `gh pr comment --edit-last --create-if-none` for top-level feedback, | |
| so the summary replaces the previous run's summary instead of stacking. | |
| Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues. | |
| Only post GitHub comments - don't submit review text as messages. | |
| review-general: | |
| # Skip for Dependabot|CI bot PRs | |
| if: ${{ !contains(fromJSON('["dependabot[bot]", "ci-signed-commit-bot[bot]"]'), github.actor) }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| permissions: | |
| id-token: write | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: ".go-version" | |
| check-latest: true | |
| - name: Claude review (general) | |
| uses: anthropics/claude-code-action@v1.0.222 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| track_progress: true | |
| use_sticky_comment: true | |
| allowed_bots: 'kosli-ai-agent' | |
| claude_args: >- | |
| --max-turns 40 | |
| --max-budget-usd 5 | |
| --model claude-opus-5 | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(go build:*),Bash(go vet:*),Bash(go mod tidy:*),Bash(git diff:*),Bash(golangci-lint:*)" | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| Read CLAUDE.md in the repo root for build commands, architecture details, and testing patterns. | |
| Use this context to assess whether the PR follows established conventions. | |
| ## Phase 1: Static Analysis (run these BEFORE reading code) | |
| Run the following checks and note any failures: | |
| 1. `go build ./...` — verify the code compiles | |
| 2. `go vet ./...` — catch common Go mistakes | |
| 3. `go mod tidy` — then run `git diff --exit-code go.mod go.sum` to check for missing or unused dependencies | |
| Include any failures from these checks in your review as high-priority issues. | |
| ## Phase 2: Code Review | |
| Review this PR for: | |
| 1. **Code quality** – clarity, consistency with the rest of the codebase, and adherence to existing patterns. | |
| 2. **Edge and corner cases** – missing null/empty checks, boundary conditions, error paths, and invalid inputs. | |
| 3. **Possible bugs** – logic errors, race conditions, misuse of APIs, and incorrect assumptions. | |
| 4. **Readability and maintainability** – naming, structure, comments where needed, and ease of future changes. | |
| 5. **Testability and testing** – whether new/changed behavior is testable and whether tests are present and sufficient; suggest extra tests or coverage gaps where relevant. | |
| 6. **Security implications** – potential security vulnerabilities, data exposure, and other security risks. | |
| 7. **Performance considerations** – potential performance bottlenecks, scalability issues, and other performance risks. | |
| ## Phase 3: Acknowledge Good Work | |
| Briefly note any well-designed patterns, good testing practices, or thoughtful improvements in the PR. | |
| A good review balances constructive criticism with recognition of quality work. | |
| Note: The PR branch is already checked out in the current working directory. | |
| Be concise and actionable. Prefer inline suggestions where possible; add a short summary at the end. | |
| Use `gh pr comment --edit-last --create-if-none` for top-level feedback, | |
| so the summary replaces the previous run's summary instead of stacking. | |
| Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues. | |
| Only post GitHub comments - don't submit review text as messages. | |
| # ── Follow-up on pushes: only the delta and existing findings ──────────── | |
| - name: Follow-up Claude review (new commits only) | |
| if: github.event.action == 'synchronize' | |
| uses: anthropics/claude-code-action@v1.0.222 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| track_progress: true | |
| use_sticky_comment: true | |
| allowed_bots: 'kosli-ai-agent' | |
| claude_args: >- | |
| --max-turns 20 | |
| --max-budget-usd 5 | |
| --model claude-sonnet-5 | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr comment:*),Bash(gh api:*),Bash(git diff:*),Bash(git log:*),Bash(git show:*),Read,Grep,Glob" | |
| prompt: | | |
| You are following up on an existing review of PR #${{ github.event.pull_request.number }} | |
| in ${{ github.repository }}. New commits were pushed: | |
| BEFORE=${{ github.event.before }} AFTER=${{ github.event.after }} | |
| Scope rules — follow these strictly: | |
| - Review ONLY the lines changed in `git diff BEFORE..AFTER`. If BEFORE is not | |
| reachable (force-push), fall back to `gh pr diff` but still only examine hunks | |
| touched by the newest commits (`git log --oneline -n 20`). | |
| - Do NOT re-review unchanged code and do NOT look for new issues in files or | |
| regions these commits did not touch. | |
| Steps: | |
| 1. Fetch the existing review comments on this PR (gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/comments | |
| and gh pr view --comments). Collect every finding previously raised by Claude. | |
| 2. For each previous finding whose location is touched by the new commits, decide: | |
| resolved / partially addressed / not addressed. Do not repeat the original finding | |
| text — just state the status and, if still open, one sentence on what's missing. Close resolved opened in-line comments! | |
| 3. Within the changed lines only, flag anything that would be a bug, security issue, | |
| or a regression introduced by the fix itself. Post these as inline comments. | |
| Skip style nits and anything that is a matter of preference. | |
| 4. Post ONE summary comment via `gh pr comment` listing the status of each previous | |
| finding you evaluated and the count of any new inline comments. If every touched | |
| finding is resolved and nothing new was found, say so in a single line. |