Skip to content

ci: refactor Claude review to reusable org-wide workflow #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielewood merged 1 commit into from
Feb 16, 2026
Merged

ci: refactor Claude review to reusable org-wide workflow #43

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 9 additions & 42 deletions .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,50 +4,17 @@ on:
pull_request:
types: [opened, synchronize, ready_for_review, reopened]

permissions:
contents: read
pull-requests: write
issues: read
id-token: write

jobs:
claude-review:
if: |
github.event.pull_request.draft == false &&
github.event.pull_request.head.repo.full_name == github.repository
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
issues: read
id-token: write

steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 1

- name: Minimize previous Claude review comments
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh pr view ${{ github.event.pull_request.number }} \
--json comments \
--jq '.comments[] | select(.author.login == "claude") | .id' \
| while read -r node_id; do
gh api graphql -f query='
mutation {
minimizeComment(input: {subjectId: "'"$node_id"'", classifier: OUTDATED}) {
minimizedComment { isMinimized }
}
}'
done

- name: Run Claude Code Review
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
prompt: |
/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}

IMPORTANT: You MUST always post a PR comment, even if no issues are found.
Do NOT skip the review for any reason — never treat a PR as "trivial" or
"obviously correct." Always run the full review pipeline and post a comment
with the results. If no issues are found, post the "No issues found" summary.
uses: sensiblebit/.github/.github/workflows/claude-code-review.yml@main
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The original workflow defined explicit permissions (contents: read, pull-requests: write, issues: read, id-token: write). When calling a reusable workflow, these permissions need to be explicitly passed using the permissions: key at the job level, or the reusable workflow must define them itself using permissions: at the workflow level.

Without explicit permissions, the reusable workflow will either fail or use default permissions which may be too broad. You should either:

  1. Add a permissions: block to this job that matches the original permissions, OR
  2. Verify that the reusable workflow at sensiblebit/.github has appropriate workflow-level permissions defined

According to GitHub documentation, when calling a reusable workflow, the caller must explicitly grant permissions if the reusable workflow needs them.

Suggested change
uses: sensiblebit/.github/.github/workflows/claude-code-review.yml@main
uses: sensiblebit/.github/.github/workflows/claude-code-review.yml@main
permissions:
contents: read
pull-requests: write
issues: read
id-token: write

Copilot uses AI. Check for mistakes.
secrets:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Comment on lines +18 to +20
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description states "Add an early check that detects when claude-code-review.yml is in the PR diff" and "Skip all review steps gracefully (exit green with a notice)". However, the actual implementation replaces the entire inline workflow with a call to a reusable workflow in a separate repository (sensiblebit/.github).

This is not adding an early check to the current workflow - it's delegating the entire workflow to an external repository. If the skip logic exists, it would be in the reusable workflow at sensiblebit/.github/.github/workflows/claude-code-review.yml, not in this file. The PR description should accurately describe this as "refactor to use shared reusable workflow" rather than implying that skip logic is being added to this file.

Copilot uses AI. Check for mistakes.
Comment on lines +18 to +20
Copy link

Copilot AI Feb 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

According to rule CL-1 in CLAUDE.md, every commit changing behavior must update CHANGELOG.md under the Unreleased section. This PR changes CI behavior by replacing an inline workflow with a reusable workflow call (and according to the description, adds skip logic for self-modifications). However, there's no corresponding entry in CHANGELOG.md.

An entry should be added to the "Changed" section describing this CI workflow modification, something like: "Replace inline Claude Code Review workflow with reusable workflow from sensiblebit/.github"

Copilot generated this review using guidance from repository custom instructions.
Loading