From 33b71992e49c3f632adb1aad1eb2383ac44ea1b4 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 6 Jan 2026 15:36:17 -0500 Subject: [PATCH 1/4] Allow Claude to safely do code review automatically and from forks. Doesn't change the existing Claude workflow. * Added claude_pr_review.yml --- .github/workflows/claude_pr_review.yml | 46 ++++++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 .github/workflows/claude_pr_review.yml diff --git a/.github/workflows/claude_pr_review.yml b/.github/workflows/claude_pr_review.yml new file mode 100644 index 00000000..a64276b8 --- /dev/null +++ b/.github/workflows/claude_pr_review.yml @@ -0,0 +1,46 @@ +name: Claude Code Review + +on: + pull_request: + types: [opened, synchronize, reopened] + +permissions: + contents: read + pull-requests: write + +jobs: + claude-review: + runs-on: ubuntu-latest + + steps: + - name: Checkout PR branch from fork + uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.head.ref }} + repository: ${{ github.event.pull_request.head.repo.full_name }} + fetch-depth: 0 + + - name: Run Claude Code Review + id: claude-review + uses: anthropics/claude-code-action@v1 + with: + anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} + github_token: ${{ secrets.GITHUB_TOKEN }} + instructions: | + Please review this PR focusing on: + - TypeScript type safety + - MCP protocol compliance + - Security vulnerabilities + - Performance implications + + - name: Comment on failure + if: failure() + uses: actions/github-script@v7 + with: + script: | + github.rest.issues.createComment({ + issue_number: context.issue.number, + owner: context.repo.owner, + repo: context.repo.repo, + body: '❌ Claude Code review failed. Please check the [action logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.' + }) From 7e6cc16fbac791eda0bba119d364bdce24e15a88 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 6 Jan 2026 15:50:15 -0500 Subject: [PATCH 2/4] Change instructions to prompt in claude_pr_review.yml --- .github/workflows/claude_pr_review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude_pr_review.yml b/.github/workflows/claude_pr_review.yml index a64276b8..f24e2653 100644 --- a/.github/workflows/claude_pr_review.yml +++ b/.github/workflows/claude_pr_review.yml @@ -26,7 +26,7 @@ jobs: with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ secrets.GITHUB_TOKEN }} - instructions: | + prompt: | Please review this PR focusing on: - TypeScript type safety - MCP protocol compliance From 1c265b926025655ec574bce667ac53d6ae90a602 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 6 Jan 2026 16:25:57 -0500 Subject: [PATCH 3/4] Remove claude_pr_review.yml as it turns out there is a GitHub restriction that keeps secrets from being accessed on PRs from forks. We will have to request reviews manually. * Modify claude.yml 1. Added "Get PR details" step (NEW - lines 28-51) This new step runs ONLY when the trigger is a PR-related comment. It: - Detects if it's a PR comment vs regular issue - Fetches the PR information using GitHub API - Extracts the fork's repository name and commit SHA - Sets them as outputs (steps.pr.outputs.sha and steps.pr.outputs.repo) Why? The original workflow couldn't see fork PR code because it only checked out the main repo. 2. Split checkout into TWO conditional steps (CHANGED - lines 53-62) Before: One checkout step that always checked out main repo with fetch-depth: 1 After: Two checkout steps: - "Checkout PR branch" - Runs if PR details were fetched successfully, checks out the fork's PR branch - "Checkout repository" - Runs otherwise (for regular issues), checks out main repo Why? Need different checkout behavior for PRs (checkout fork) vs issues (checkout main). 3. Changed fetch-depth from 1 to 0 (CHANGED) Before: fetch-depth: 1 (only latest commit) After: fetch-depth: 0 (full git history) Why? Claude Code needs more context to understand the codebase and provide better reviews. Summary The original workflow could only see the main repo's code. When you commented @claude on a fork PR, it would review the wrong code! These changes make it check out the actual PR branch from the fork when reviewing PRs, while keeping the original behavior for regular issues. --- .github/workflows/claude.yml | 38 +++++++++++++++++++-- .github/workflows/claude_pr_review.yml | 46 -------------------------- 2 files changed, 36 insertions(+), 48 deletions(-) delete mode 100644 .github/workflows/claude_pr_review.yml diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 2910e4f3..8b33001e 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -27,10 +27,44 @@ jobs: id-token: write actions: read steps: - - name: Checkout repository + - name: Get PR details + if: | + (github.event_name == 'issue_comment' && github.event.issue.pull_request) || + github.event_name == 'pull_request_review_comment' || + github.event_name == 'pull_request_review' + id: pr + uses: actions/github-script@v7 + with: + script: | + let prNumber; + if (context.eventName === 'issue_comment') { + prNumber = context.issue.number; + } else { + prNumber = context.payload.pull_request.number; + } + + const pr = await github.rest.pulls.get({ + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: prNumber + }); + + core.setOutput('sha', pr.data.head.sha); + core.setOutput('repo', pr.data.head.repo.full_name); + + - name: Checkout PR branch + if: steps.pr.outcome == 'success' uses: actions/checkout@v4 with: - fetch-depth: 1 + ref: ${{ steps.pr.outputs.sha }} + repository: ${{ steps.pr.outputs.repo }} + fetch-depth: 0 + + - name: Checkout repository + if: steps.pr.outcome != 'success' + uses: actions/checkout@v4 + with: + fetch-depth: 0 - name: Run Claude Code id: claude diff --git a/.github/workflows/claude_pr_review.yml b/.github/workflows/claude_pr_review.yml deleted file mode 100644 index f24e2653..00000000 --- a/.github/workflows/claude_pr_review.yml +++ /dev/null @@ -1,46 +0,0 @@ -name: Claude Code Review - -on: - pull_request: - types: [opened, synchronize, reopened] - -permissions: - contents: read - pull-requests: write - -jobs: - claude-review: - runs-on: ubuntu-latest - - steps: - - name: Checkout PR branch from fork - uses: actions/checkout@v4 - with: - ref: ${{ github.event.pull_request.head.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - fetch-depth: 0 - - - name: Run Claude Code Review - id: claude-review - uses: anthropics/claude-code-action@v1 - with: - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} - github_token: ${{ secrets.GITHUB_TOKEN }} - prompt: | - Please review this PR focusing on: - - TypeScript type safety - - MCP protocol compliance - - Security vulnerabilities - - Performance implications - - - name: Comment on failure - if: failure() - uses: actions/github-script@v7 - with: - script: | - github.rest.issues.createComment({ - issue_number: context.issue.number, - owner: context.repo.owner, - repo: context.repo.repo, - body: '❌ Claude Code review failed. Please check the [action logs](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for details.' - }) From 775726b95874eff79a7767e2265d700c15f42cc0 Mon Sep 17 00:00:00 2001 From: cliffhall Date: Tue, 6 Jan 2026 16:31:38 -0500 Subject: [PATCH 4/4] prettier --- .github/workflows/claude.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 8b33001e..61298864 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -42,13 +42,13 @@ jobs: } else { prNumber = context.payload.pull_request.number; } - + const pr = await github.rest.pulls.get({ owner: context.repo.owner, repo: context.repo.repo, pull_number: prNumber }); - + core.setOutput('sha', pr.data.head.sha); core.setOutput('repo', pr.data.head.repo.full_name);