Harden Claude review workflow (#114)

Author: leighmcculloch

.github/workflows/claude-review.yml

@@ -38,5 +38,15 @@ jobs:
 
             Provide detailed feedback using inline comments for specific issues.
 
+            When using GitHub CLI commands always include the PR number explicitly,
+            e.g. `gh pr diff ${{ github.event.pull_request.number }}`,
+            `gh pr view ${{ github.event.pull_request.number }}`,
+            `gh pr comment ${{ github.event.pull_request.number }} --body "..."`.
+            Do not rely on the current directory context to infer the PR number.
+
+          # --max-turns caps how many tool-use cycles Claude can run, which
+          # bounds token spend per invocation. The allowed `gh pr` commands are
+          # scoped to this PR's number so a misfire can't reach into another PR.
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
+            --max-turns 30
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment ${{ github.event.pull_request.number }}:*),Bash(gh pr diff ${{ github.event.pull_request.number }}:*),Bash(gh pr view ${{ github.event.pull_request.number }}:*)"