Add claude-review-toolkit composite action by kacper-mikolajczak · Pull Request #62 · Expensify/GitHub-Actions

kacper-mikolajczak · 2026-05-12T10:41:24Z

Details

Introduces a shared composite action claude-review-toolkit that consolidates Claude PR review scaffolding currently duplicated across three client repos (Expensify/App, Expensify/Auth, Expensify/Web-Expensify).

Ships:

addPrReaction.sh / removePrReaction.sh - strict-validation reaction helpers (PR_NUMBER must be numeric; REACTION must be one of +1, -1, laugh, confused, heart, hooray, rocket, eyes)
createInlineComment.sh - posts an inline PR comment; when ALLOWED_RULES_FILE is set and non-empty, enforces a per-comment rule-ID gate; otherwise skips validation
extractAllowedRules.sh - walks a rules directory and writes a deduplicated allowlist
schemas/code-review-output.json - canonical violations-only schema for the reviewer agent output

Inputs:

enforce_allowed_rules (default false) - when true, runs the extractor against the caller's .claude/skills/coding-standards/rules/ and exports ALLOWED_RULES_FILE for downstream steps

Outputs:

schema_path, schema_json for direct consumption by anthropics/claude-code-action --json-schema

Side effects: prepends scripts/ to GITHUB_PATH.

This is slice 1 of a three-slice plan. Future slices will share the workflow shape (cross-repo reusable workflow) and base reviewer prompts.

Related Issues

https://github.com/Expensify/Expensify/issues/635397

Manual Tests

Tested by consumer-side draft PRs against this branch's SHA:

[NO QA] Use shared claude-review-toolkit composite action App#90324
Expensify/Auth#21575
Expensify/Web-Expensify#52794

Consumer PRs reference this action by placeholder SHA and will be retargeted to the merged-main SHA before going green.

Linked PRs

Listed under Manual Tests above.

cc @Julesssss

github-actions · 2026-05-12T10:41:37Z

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

kacper-mikolajczak · 2026-05-12T10:56:04Z

I have read the CLA Document and I hereby sign the CLA

kacper-mikolajczak · 2026-05-12T11:03:22Z

CC @Julesssss @rlinoz

Julesssss

Thanks for this refactor!

Julesssss · 2026-05-12T21:21:16Z

+readonly BODY_ARG="${2:-}"
+readonly LINE_ARG="${3:-}"
+
+[[ -z "${PR_NUMBER:-}" ]] && die "Environment variable PR_NUMBER is required"


So we know that PR will always exist and we're only running this action against PRs, but as a small improvement could we make createInlineComment.sh take PR_NUMBER as param $1, to match the other scripts. It might help us flag a problem sooner if for example the PR param in /App gets changed to PR_NUMBER_APP.

We already have to update the 3 repos calling this but we're doing that anyway.

Julesssss

Looking good! I think we can get this open for review. One other thing to improve would be a readme in this action dir or somewhere else explaining what the missingQueryTimings and enforce_allowed_rules options do and why we need them

kacper-mikolajczak · 2026-05-14T00:31:58Z

@codex review

chatgpt-codex-connector · 2026-05-14T00:32:04Z

To use Codex here, create a Codex account and connect to github.

kacper-mikolajczak · 2026-05-14T00:51:42Z

@Julesssss Thanks for the feedback - I addressed that ✅

As a second thought we could drop enforce_allowed_rules option entirely and enforce allowed rules on all the repos by default. It's purpose is to prevent reviewer posting comments that are not referencing any of the rules.

I will add this feature preemptively implement that and based on your decision we can either ship it as-is or simply remove commits. Let me know what you think, thanks!

rlinoz

Love this!

Julesssss · 2026-05-14T22:48:41Z

It's purpose is to prevent reviewer posting comments that are not referencing any of the rules.

I thought that might be on purpose due to App repo being open source. Lets not worry about doing alignment for now.

So I see thew Web-E PR ready but I assume we need to merge this PR first? Can this come out of draft now?

Julesssss · 2026-05-15T16:21:26Z

As a second thought we could drop enforce_allowed_rules option entirely and enforce allowed rules on all the repos by default

Ah I see, that's also fine with me 👍

Julesssss · 2026-05-15T16:36:36Z

Ah I can't merge because one of the initial comms was somehow unverified 😢 could you fix that please Kacper, opening a fresh PR might be the simplest solution.

Introduces a shared composite action that consolidates the duplicated Claude PR review scaffolding currently maintained in three client repos (Expensify/App, Expensify/Auth, Expensify/Web-Expensify). The action ships: - addPrReaction.sh / removePrReaction.sh - strict-validation reaction helpers (PR_NUMBER must be numeric, REACTION must be one of the eight GitHub-supported values). - createInlineComment.sh - posts an inline PR comment; when ALLOWED_RULES_FILE is set and non-empty, enforces a per-comment rule-ID gate against the allowlist; otherwise skips validation. - extractAllowedRules.sh - walks a rules directory and writes a sorted, deduplicated allowlist of rule IDs. - schemas/code-review-output.json - canonical violations-only schema for the code-inline-reviewer agent output. The action prepends scripts/ to GITHUB_PATH, exposes schema_path and a compacted schema_json output for direct consumption by anthropics/claude-code-action, and (when enforce_allowed_rules=true) extracts the caller's rule allowlist and exports ALLOWED_RULES_FILE for downstream steps.

createInlineComment.sh now matches addPrReaction.sh/removePrReaction.sh by accepting PR_NUMBER as $1 instead of reading it from env. Surfaces mismatches at the caller (e.g. a renamed PR_NUMBER_APP env var) instead of silently failing later. Adds README.md documenting the action's inputs, outputs, and the four scripts on PATH. Clarifies that schema extensions (Auth's missingQueryTimings) live in the caller's workflow, not in the toolkit.

The opt-in toggle was leftover from migration. All three consumer repos (App, Auth, Web-Expensify) already ship a .claude/skills/coding-standards/rules/ directory with valid ruleId frontmatter, and their reviewer agents already mandate one Rule ID per inline comment. Making the gate universal removes configuration drift and matches the toolkit's stated purpose of shipping the strictest version of each script. - action.yml: drop inputs.enforce_allowed_rules; always run the extract step - createInlineComment.sh: require ALLOWED_RULES_FILE; remove the skip branch - README: align with the new always-on behavior Caller workflows that previously passed enforce_allowed_rules: 'true' can drop that with: block; callers that did not opt in inherit the gate.

kacper-mikolajczak · 2026-05-18T07:47:09Z

@Julesssss Re-signed the commits to fix the unverified-commit blocker - PR should be mergeable now. Kept the enforce_allowed_rules drop in, so the gate is universal.

Ready to merge whenever you are - this should unblock PRs on Web-E, App and Auth waiting on the SHA stamp.

kacper-mikolajczak · 2026-05-18T11:34:14Z

CC @rlinoz too, so might push it forward before Jules' timezone hits working hours ❤️

rlinoz · 2026-05-18T13:12:11Z

ah nice, thank you!

melvin-bot Bot assigned kacper-mikolajczak May 12, 2026

exfy-clabot Bot added a commit to Expensify/CLA that referenced this pull request May 12, 2026

@kacper-mikolajczak has signed the CLA in Expensify/GitHub-Actions#62

3301050

Julesssss approved these changes May 12, 2026

View reviewed changes

Julesssss reviewed May 12, 2026

View reviewed changes

Julesssss previously approved these changes May 12, 2026

View reviewed changes

kacper-mikolajczak dismissed Julesssss’s stale review via 6a4fb70 May 14, 2026 00:42

rlinoz approved these changes May 14, 2026

View reviewed changes

Julesssss approved these changes May 14, 2026

View reviewed changes

Julesssss marked this pull request as ready for review May 15, 2026 16:34

kacper-mikolajczak added 3 commits May 18, 2026 09:44

kacper-mikolajczak force-pushed the add-claude-review-toolkit-action branch from 6ad2355 to 1f41026 Compare May 18, 2026 07:46

rlinoz merged commit 43c1b43 into Expensify:main May 18, 2026
5 checks passed

Conversation

kacper-mikolajczak commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Details

Related Issues

Manual Tests

Linked PRs

Uh oh!

github-actions Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kacper-mikolajczak commented May 12, 2026

Uh oh!

kacper-mikolajczak commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Julesssss left a comment

Choose a reason for hiding this comment

Uh oh!

Julesssss May 12, 2026

Choose a reason for hiding this comment

Uh oh!

Julesssss left a comment

Choose a reason for hiding this comment

Uh oh!

kacper-mikolajczak commented May 14, 2026

Uh oh!

chatgpt-codex-connector Bot commented May 14, 2026

Uh oh!

kacper-mikolajczak commented May 14, 2026

Uh oh!

rlinoz left a comment

Choose a reason for hiding this comment

Uh oh!

Julesssss commented May 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Julesssss commented May 15, 2026

Uh oh!

Julesssss commented May 15, 2026

Uh oh!

kacper-mikolajczak commented May 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kacper-mikolajczak commented May 18, 2026

Uh oh!

rlinoz commented May 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kacper-mikolajczak commented May 12, 2026 •

edited

Loading

github-actions Bot commented May 12, 2026 •

edited

Loading

kacper-mikolajczak commented May 12, 2026 •

edited

Loading

Julesssss commented May 14, 2026 •

edited

Loading

kacper-mikolajczak commented May 18, 2026 •

edited

Loading