1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
name: Claude Code Review
on:
# pull_request:
# types: [opened, synchronize, ready_for_review, reopened]
workflow_dispatch:
jobs:
claude-review:
# NOTE: there is deliberately no `if: false` here.
#
# Until v0.6.22 this job carried one, on top of the commented-out `pull_request` trigger
# above. The trigger alone already stops automatic review on every PR -- which was the
# whole point -- so the guard added nothing there, and its only remaining effect was to
# neuter the manual path: `gh workflow run claude-code-review.yml` started a run, skipped
# this job, and reported SUCCESS having reviewed nothing.
#
# A green run that did nothing is the exact failure this repo's tooling exists to refuse,
# and it is the one the sibling repo recorded twice about this very action (a review job
# going green without reviewing). "Dispatch is available but silently inert" is worse than
# either honest alternative -- working, or absent.
#
# To review a PR on demand:
# gh workflow run claude-code-review.yml --ref <branch>
# Optional: Filter by PR author
# if: |
# github.event.pull_request.user.login == 'external-contributor' ||
# github.event.pull_request.user.login == 'new-developer' ||
# github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read
issues: read
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@v7.0.1
with:
fetch-depth: 1
- name: Run Claude Code Review
id: claude-review
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
# Dependabot PRs are opened by a bot actor; the action refuses to run for
# non-human actors unless explicitly allowed. Scoped to dependabot[bot] only.
allowed_bots: 'dependabot[bot]'
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options