release: v3.27.8 - prompt-based GitHub Actions code review workflow
New examples/github-actions/claude-code-review.yml with externalized prompt, anti-hallucination protocol, /claude-review on-demand trigger. Templates 116→161. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Florian BRUNIAUX
parent
373b50cf77
commit
9b75b5125e
9 changed files with 278 additions and 25 deletions
|
|
@ -19,7 +19,44 @@ Ready-to-use GitHub Actions workflows that integrate Claude Code into your CI/CD
|
|||
|
||||
## Available Workflows
|
||||
|
||||
### 1. Auto PR Review (`claude-pr-auto-review.yml`)
|
||||
### 1. Code Review — Prompt-Based (`claude-code-review.yml`) ⭐ Recommended
|
||||
|
||||
**Robust pattern** with externalized prompt, anti-hallucination protocol, and `/claude-review` on-demand trigger.
|
||||
|
||||
The review logic lives in `.github/prompts/code-review.md`, so you can iterate on criteria without touching the workflow YAML. The prompt enforces a verification step before every finding — Claude must confirm an issue with `Read`/`Grep` before reporting it.
|
||||
|
||||
**Features:**
|
||||
- Triggers on PR open/sync/ready **and** `/claude-review` comment
|
||||
- Externalized prompt: edit `code-review.md` to tune criteria for your stack
|
||||
- Anti-hallucination protocol: no invented line numbers or unverified claims
|
||||
- Structured output: `🔴 MUST FIX` / `🟡 SHOULD FIX` / `🟢 CAN SKIP` table + inline comments
|
||||
- Read-only `allowed_tools` (no write access to repo)
|
||||
- OAuth token support (no API key needed if Claude GitHub App is installed)
|
||||
|
||||
**Setup:**
|
||||
```bash
|
||||
# Copy both files into your repo
|
||||
cp examples/github-actions/claude-code-review.yml .github/workflows/
|
||||
mkdir -p .github/prompts
|
||||
cp examples/github-actions/prompts/code-review.md .github/prompts/
|
||||
|
||||
# Add secret: CLAUDE_CODE_OAUTH_TOKEN (or ANTHROPIC_API_KEY)
|
||||
# Install Claude GitHub App: https://github.com/apps/claude
|
||||
```
|
||||
|
||||
**Customization:**
|
||||
Edit `.github/prompts/code-review.md` to add your stack conventions:
|
||||
```markdown
|
||||
## Stack Context
|
||||
- TypeScript strict mode, no `any`
|
||||
- React Server Components — no `useEffect` for data fetching
|
||||
- All DB writes must go through the repository layer
|
||||
- New API routes require integration tests
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
### 2. Auto PR Review (`claude-pr-auto-review.yml`)
|
||||
|
||||
**Enhanced version** with comprehensive review criteria and smart filtering.
|
||||
|
||||
|
|
@ -210,9 +247,12 @@ These workflows consume Anthropic API credits:
|
|||
```
|
||||
examples/github-actions/
|
||||
├── README.md # This file
|
||||
├── claude-pr-auto-review.yml # Auto PR review workflow
|
||||
├── claude-code-review.yml # Prompt-based review (recommended)
|
||||
├── claude-pr-auto-review.yml # Inline prompt auto-review
|
||||
├── claude-security-review.yml # Security scanning workflow
|
||||
└── claude-issue-triage.yml # Issue triage workflow
|
||||
├── claude-issue-triage.yml # Issue triage workflow
|
||||
└── prompts/
|
||||
└── code-review.md # Externalized review prompt (copy to .github/prompts/)
|
||||
```
|
||||
|
||||
## Resources
|
||||
|
|
|
|||
76
examples/github-actions/claude-code-review.yml
Normal file
76
examples/github-actions/claude-code-review.yml
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
name: Claude Code Review (Prompt-Based)
|
||||
|
||||
# Pattern: externalized prompt + anti-hallucination protocol
|
||||
# Prompt file: .github/prompts/code-review.md
|
||||
# Copy it alongside this workflow: examples/github-actions/prompts/code-review.md
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, ready_for_review]
|
||||
issue_comment:
|
||||
types: [created]
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
issues: write
|
||||
|
||||
jobs:
|
||||
claude-review:
|
||||
# Run on PR events (non-draft) OR on /claude-review comment
|
||||
if: |
|
||||
(github.event_name == 'pull_request' && github.event.pull_request.draft == false) ||
|
||||
(github.event_name == 'issue_comment' &&
|
||||
github.event.issue.pull_request != null &&
|
||||
contains(github.event.comment.body, '/claude-review'))
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 15
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Claude Code Review
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
# OAuth token via Claude GitHub App (no API key needed)
|
||||
# Install: https://github.com/apps/claude
|
||||
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
|
||||
# Or use API key directly:
|
||||
# anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
|
||||
model: claude-sonnet-4-6
|
||||
|
||||
# Load prompt from external file — edit that file to customize review criteria
|
||||
prompt_file: .github/prompts/code-review.md
|
||||
|
||||
# Read-only tools: Claude can inspect the codebase but cannot modify it
|
||||
allowed_tools: >-
|
||||
Read,
|
||||
Glob,
|
||||
Grep,
|
||||
mcp__github__get_pull_request,
|
||||
mcp__github__get_pull_request_diff,
|
||||
mcp__github__create_pending_pull_request_review,
|
||||
mcp__github__add_comment_to_pending_review,
|
||||
mcp__github__submit_pending_pull_request_review,
|
||||
mcp__github__list_pull_request_files,
|
||||
mcp__github__list_commits
|
||||
|
||||
- name: Handle review failure
|
||||
if: failure()
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const prNumber = context.payload.pull_request?.number ?? context.payload.issue?.number;
|
||||
if (prNumber) {
|
||||
github.rest.issues.createComment({
|
||||
issue_number: prNumber,
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
body: '⚠️ **Claude review failed** — Check the Actions log for details. A human reviewer should cover this PR.'
|
||||
});
|
||||
}
|
||||
123
examples/github-actions/prompts/code-review.md
Normal file
123
examples/github-actions/prompts/code-review.md
Normal file
|
|
@ -0,0 +1,123 @@
|
|||
# Code Review Prompt
|
||||
|
||||
<!--
|
||||
Stack note: this example uses generic criteria valid for any project.
|
||||
If you target a specific stack (e.g. Next.js 15 / T3 / Rails / Django),
|
||||
add a "Stack Context" section below with your conventions.
|
||||
-->
|
||||
|
||||
## Anti-Hallucination Protocol
|
||||
|
||||
**MANDATORY — read before every action:**
|
||||
|
||||
1. **Verify before reporting.** Use `Grep` or `Read` to confirm any issue exists in the actual file before mentioning it.
|
||||
2. **Never invent line numbers.** Only reference lines you have read directly from the file.
|
||||
3. **Never assume context.** If a file is not in the diff, do not comment on it.
|
||||
4. **One claim = one verification.** Each finding must be traceable to a tool call result.
|
||||
|
||||
If you cannot verify a finding → do not report it.
|
||||
|
||||
---
|
||||
|
||||
## Your Mission
|
||||
|
||||
You are a senior engineer performing a structured code review on this pull request.
|
||||
|
||||
Your goal: surface real issues, ranked by impact, with actionable fixes. Not a style lecture — a review that unblocks merge decisions.
|
||||
|
||||
---
|
||||
|
||||
## Step 1 — Gather Context
|
||||
|
||||
Before reviewing, run these tool calls in parallel:
|
||||
|
||||
- `mcp__github__get_pull_request` → PR title, description, author
|
||||
- `mcp__github__get_pull_request_diff` → full diff
|
||||
- `mcp__github__list_pull_request_files` → list of changed files
|
||||
|
||||
For any file that looks non-trivial, use `Read` to see the full implementation context around the changed lines.
|
||||
|
||||
---
|
||||
|
||||
## Step 2 — Analyze Changes
|
||||
|
||||
Review each changed file through these lenses:
|
||||
|
||||
### 🔴 MUST FIX — blocks merge
|
||||
|
||||
- **Security**: injection (SQL, command, XSS), unvalidated input at system boundaries, exposed secrets, insecure direct object references, missing auth checks
|
||||
- **Correctness**: logic errors, off-by-one, null/undefined dereferences, incorrect assumptions about data shape
|
||||
- **Data integrity**: missing transactions, partial writes, lost updates under concurrency
|
||||
- **Breaking changes**: API incompatibility, removed fields, changed behavior without migration
|
||||
|
||||
### 🟡 SHOULD FIX — fix before next release
|
||||
|
||||
- **Performance**: N+1 queries, unbounded loops on large datasets, synchronous I/O in hot paths, missing indexes on queried columns
|
||||
- **Error handling**: unhandled promise rejections, swallowed exceptions, missing error boundaries
|
||||
- **Architecture**: business logic leaking into presentation layer, tight coupling between unrelated modules, violation of existing patterns in the codebase
|
||||
|
||||
### 🟢 CAN SKIP — optional improvement
|
||||
|
||||
- Code readability: long functions, unclear naming, missing doc comments on public APIs
|
||||
- Test coverage: missing edge case tests, weak assertions
|
||||
- Minor DRY violations
|
||||
|
||||
---
|
||||
|
||||
## Step 3 — Verify Each Finding
|
||||
|
||||
For every issue you plan to report:
|
||||
|
||||
```
|
||||
1. Use Read or Grep to confirm the problematic code is in the diff
|
||||
2. Note the exact file path and line number
|
||||
3. Only then include it in the review
|
||||
```
|
||||
|
||||
If verification fails → discard the finding.
|
||||
|
||||
---
|
||||
|
||||
## Step 4 — Write the Review
|
||||
|
||||
### Summary Comment (post as PR comment)
|
||||
|
||||
```
|
||||
## Claude Code Review
|
||||
|
||||
**Verdict**: [✅ Approve | 🔄 Request Changes | 💬 Comment]
|
||||
**Risk**: [Low | Medium | High]
|
||||
|
||||
### 🔴 Must Fix ({n})
|
||||
| File | Line | Issue | Fix |
|
||||
|------|------|-------|-----|
|
||||
| `path/to/file.ts` | 42 | SQL query concatenates user input | Use parameterized query |
|
||||
|
||||
### 🟡 Should Fix ({n})
|
||||
| File | Line | Issue | Fix |
|
||||
|------|------|-------|-----|
|
||||
| `path/to/file.ts` | 87 | Missing error handling on async call | Wrap in try/catch |
|
||||
|
||||
### 🟢 Can Skip ({n})
|
||||
- `path/to/file.ts:12` — Consider extracting this into a helper for reuse
|
||||
|
||||
### Strengths
|
||||
- [What was done well — be specific]
|
||||
```
|
||||
|
||||
### Inline Comments (via `add_comment_to_pending_review`)
|
||||
|
||||
For 🔴 and 🟡 findings, add inline comments directly on the relevant lines with:
|
||||
- What is wrong and why it matters
|
||||
- A concrete fix (code snippet when helpful)
|
||||
|
||||
Use `create_pending_pull_request_review` first, then add comments, then `submit_pending_pull_request_review`.
|
||||
|
||||
---
|
||||
|
||||
## Constraints
|
||||
|
||||
- **No nitpicking** — if it does not affect correctness, security, or team velocity, skip it
|
||||
- **No praise theater** — only mention strengths that are genuinely notable
|
||||
- **No invented issues** — verify → report, not report → verify
|
||||
- If the PR is clean: say so clearly and approve
|
||||
Loading…
Add table
Add a link
Reference in a new issue