Use shared claude-review reusable workflow - #120
Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the repository’s Claude PR review GitHub Action from an inlined workflow implementation to the shared reusable workflow in stellar/actions, and adjusts the pull_request trigger types to reduce when the workflow runs.
Changes:
- Replace inlined
claude-code-actionjob steps with a reusable workflow call tostellar/actions/.github/workflows/claude-review.yml@main. - Narrow
pull_requesttrigger types to onlyready_for_reviewandsynchronize. - Keep existing concurrency grouping for per-PR cancellation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] | ||
| types: [ready_for_review, synchronize] |
| cancel-in-progress: true | ||
|
|
||
| permissions: {} | ||
|
|
||
| jobs: | ||
| review: | ||
| if: github.event.pull_request.draft == false && github.event.pull_request.head.repo.fork == false | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| id-token: write | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| track_progress: true | ||
| prompt: | | ||
| REPO: ${{ github.repository }} | ||
| PR NUMBER: ${{ github.event.pull_request.number }} | ||
|
|
||
| Please review this pull request with a focus on: | ||
| - Code quality and best practices | ||
| - Potential bugs or issues | ||
| - Security implications | ||
| - Performance considerations | ||
|
|
||
| Provide detailed feedback using inline comments for specific issues. | ||
|
|
||
| When using GitHub CLI commands always include the PR number explicitly, | ||
| e.g. `gh pr diff ${{ github.event.pull_request.number }}`, | ||
| `gh pr view ${{ github.event.pull_request.number }}`, | ||
| `gh pr comment ${{ github.event.pull_request.number }} --body "..."`. | ||
| Do not rely on the current directory context to infer the PR number. | ||
|
|
||
| # --max-turns caps how many tool-use cycles Claude can run, which | ||
| # bounds token spend per invocation. The allowed `gh pr` commands are | ||
| # scoped to this PR's number so a misfire can't reach into another PR. | ||
| claude_args: | | ||
| --max-turns 30 | ||
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment ${{ github.event.pull_request.number }}:*),Bash(gh pr diff ${{ github.event.pull_request.number }}:*),Bash(gh pr view ${{ github.event.pull_request.number }}:*)" | ||
| uses: stellar/actions/.github/workflows/claude-review.yml@main | ||
| secrets: | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Grant token permissions to the called workflow
Keeping permissions: {} at workflow scope while omitting jobs.review.permissions passes an unprivileged GITHUB_TOKEN into the reusable workflow call. Reusable workflows cannot elevate token scopes beyond what the caller grants, so the shared Claude review job cannot reliably read PR contents or write review comments, causing the automation to fail or produce no review output on every run.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] | ||
| types: [ready_for_review, synchronize] |
There was a problem hiding this comment.
Restricting pull_request triggers to ready_for_review and synchronize removes coverage for PRs opened already out of draft and for reopened PRs. Those cases do not get an initial review unless another commit is pushed, which regresses expected automatic review behavior for many normal PR workflows.
Useful? React with 👍 / 👎.
|
Superseded by: |
What
Replace the inlined
claude-review.ymlworkflow with a call to the shared reusable workflow atstellar/actions/.github/workflows/claude-review.yml@main. Keep the existingpull_requesttrigger (the safer default; fork PRs can't access secrets on this event so they cannot be reviewed) and narrow the trigger types to[ready_for_review, synchronize]so Claude only reviews PRs that are marked ready and re-reviews on new commits.Why
The same claude-review workflow is maintained across four stellar repos. Moving to
stellar/actionslets all repos share one implementation, so the security model and prompt updates live in one place. The reusable workflow also adopts the harderpull_request_targetflow with an author-association gate, enabling reviews of fork PRs from org members while still keeping secrets out of attacker-controlled code paths.Example
Before — fully inlined workflow with
pull_requesttrigger and bespoke prompt.After:
The default prompt in the reusable workflow matches the one used here previously, with an added note that the PR head is checked out into
pr-head/.Note
Requires the corresponding PR in
stellar/actionsto be merged first so thatstellar/actions/.github/workflows/claude-review.yml@mainresolves: