feat(ci): enable Claude experimental review mode#780
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughWorkflow updates primarily bump pinned action SHAs across multiple GitHub Actions files. The claude-review workflow is refactored: new triggers, job rename, conditional gating, expanded permissions, full-depth checkout, updated Claude action with mode-based inputs and custom instructions. No changes to scripts or core CI logic beyond action version updates. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Events
participant WF as claude-review workflow
participant JR as code-review job
participant CO as actions/checkout (fetch-depth: 0)
participant CC as claude-code-action
GH->>WF: pull_request (opened/synchronize)
GH->>WF: issue_comment (created)
WF->>JR: Evaluate if: PR event OR comment contains "@claude review"
alt condition true
JR->>CO: Checkout repository (full history)
JR->>CC: Run mode=experimental-review with custom_instructions
else condition false
WF-->>GH: No-op
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
There was a problem hiding this comment.
Pull Request Overview
This PR updates GitHub Actions dependencies across all workflow files to their latest secure versions, managed automatically by Ratchet for improved supply chain security.
- Updates
actions/checkoutto latest commit hash across all workflows - Updates CodeQL actions, Homebrew actions, and various third-party actions to latest versions
- Enhances the Claude review workflow with additional trigger conditions and improved configuration
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/workflows/test-action.yml | Updates actions/checkout to latest commit hash |
| .github/workflows/ratchet-verify.yml | Updates actions/checkout to latest commit hash |
| .github/workflows/pack-repository.yml | Updates actions/checkout and repomix action to latest commit hashes |
| .github/workflows/homebrew.yml | Updates all Homebrew actions to latest commit hashes |
| .github/workflows/docker.yml | Updates actions/checkout to latest commit hash |
| .github/workflows/codeql.yml | Updates actions/checkout and CodeQL actions to latest commit hashes |
| .github/workflows/claude.yml | Updates actions/checkout and Claude code action to latest commit hashes |
| .github/workflows/claude-review.yml | Updates actions/checkout and Claude action, plus workflow enhancements |
| .github/workflows/ci.yml | Updates actions/checkout, crate-ci/typos, and git-auto-commit-action to latest commit hashes |
You can also share your feedback on Copilot code review for a chance to win a $100 gift card. Take the survey.
Deploying repomix with
|
| Latest commit: |
33d44a1
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://33c4f8c4.repomix.pages.dev |
| Branch Preview URL: | https://chore-claude-experimental-re.repomix.pages.dev |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v4 | ||
| - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 |
There was a problem hiding this comment.
✅ Security Best Practice: Excellent use of commit hash pinning for actions/checkout. This protects against tag manipulation attacks while the Ratchet comment maintains human readability by showing this maps to @v4.
| - name: Auto review PR | ||
| uses: anthropics/claude-code-action@4f4f43f0444d2d14cf449afc644f13facd71ebc4 # ratchet:anthropics/claude-code-action@main | ||
| - name: Code Review with Claude | ||
| uses: anthropics/claude-code-action@78b07473f50218c6494719ef164ed1ebd31da25c # ratchet:anthropics/claude-code-action@main |
There was a problem hiding this comment.
🔄 Updated Claude Integration: Good update to the latest anthropics/claude-code-action commit. This ensures you're getting the latest features and security improvements for the experimental review mode.
Note: The experimental review mode configuration looks solid with appropriate permissions and custom instructions focused on code quality, security, and best practices.
| # Initializes the CodeQL tools for scanning. | ||
| - name: Initialize CodeQL | ||
| uses: github/codeql-action/init@76621b61decf072c1cee8dd1ce2d2a82d33c17ed # ratchet:github/codeql-action/init@v3 | ||
| uses: github/codeql-action/init@df559355d593797519d70b90fc8edd5db049e7a2 # ratchet:github/codeql-action/init@v3 |
There was a problem hiding this comment.
🛡️ Security Scanning Updates: CodeQL actions properly updated to latest commit hashes, ensuring you're using the most current security scanning capabilities with enhanced rule sets and language detection.
| uses: Homebrew/actions/setup-homebrew@87d3af7a72e5ede081b6dafce1798551a74fb366 # ratchet:Homebrew/actions/setup-homebrew@master | ||
| with: | ||
| test-bot: false | ||
|
|
||
| - name: Configure Git user | ||
| uses: Homebrew/actions/git-user-config@b3fb6f7cb1475434d4285b90020c2aa51f1e0b12 # ratchet:Homebrew/actions/git-user-config@master | ||
| uses: Homebrew/actions/git-user-config@87d3af7a72e5ede081b6dafce1798551a74fb366 # ratchet:Homebrew/actions/git-user-config@master | ||
|
|
||
| - name: Bump packages | ||
| uses: Homebrew/actions/bump-packages@b3fb6f7cb1475434d4285b90020c2aa51f1e0b12 # ratchet:Homebrew/actions/bump-packages@master | ||
| uses: Homebrew/actions/bump-packages@87d3af7a72e5ede081b6dafce1798551a74fb366 # ratchet:Homebrew/actions/bump-packages@master |
There was a problem hiding this comment.
📦 Homebrew Actions Synchronized: All three Homebrew actions updated to the same commit hash 87d3af7a... ensuring consistency across:
- setup-homebrew
- git-user-config
- bump-packages
This synchronization is excellent for maintaining compatibility and avoiding version mismatches in the Homebrew release pipeline.
yamadashy
changed the title
| steps: | ||
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v4 | ||
| - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 | ||
| - uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # ratchet:actions/setup-go@v5 |
There was a problem hiding this comment.
🔧 Self-Verifying Security: Great to see the Ratchet verification workflow itself getting updated! This creates a self-reinforcing security loop where:
- Ratchet updates dependencies
- This workflow verifies all pinned SHAs are legitimate
- The workflow itself uses pinned, verified actions
This is a perfect example of "eating your own dog food" for security practices.
- Enable experimental review mode in claude-review.yml - Add trigger for @claude review comments on PRs - Add synchronize event trigger for updated PRs - Enhance permissions for pull request and issue comments - Improve review focus on code quality, security, and best practices - Use GitHub suggestion format for proposed code changes
Update pinned action versions across workflow files: - actions/checkout to 08eba0b27e820071cde6df949e0beb9ba4906955 - github/codeql-action to df559355d593797519d70b90fc8edd5db049e7a2 - anthropics/claude-code-action to 78b07473f50218c6494719ef164ed1ebd31da25c - stefanzweifel/git-auto-commit-action to 3ea6ae190baf489ba007f7c92608f33ce20ef04a - crate-ci/typos to a67079b4ae32e18c3f53d75368c52ce53b5fb56b - Various Homebrew and other actions to latest commits These updates improve security with latest verified action versions.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/claude-review.yml (2)
20-21: Permissions expanded appropriately; consider least-privilege tighteningpull-requests: write and issues: write are justified here. If OIDC isn’t used in this job, you can drop id-token: write to reduce scope.
permissions: contents: read - pull-requests: write - issues: write - id-token: write + pull-requests: write + issues: write
12-16: Optional hardening: restrict who can trigger via commentsTo avoid abuse from drive-by commenters on public repos, you can additionally require the commenter to be a member/collaborator/owner when using issue_comment.
Apply this diff to the job condition:
if: | github.event_name == 'pull_request' || (github.event_name == 'issue_comment' && github.event.issue.pull_request && - contains(github.event.comment.body, '@claude review')) + contains(github.event.comment.body, '@claude review') && + ( + github.event.comment.author_association == 'MEMBER' || + github.event.comment.author_association == 'OWNER' || + github.event.comment.author_association == 'COLLABORATOR' + ))
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (9)
.github/workflows/ci.yml(15 hunks).github/workflows/claude-review.yml(1 hunks).github/workflows/claude.yml(1 hunks).github/workflows/codeql.yml(2 hunks).github/workflows/docker.yml(1 hunks).github/workflows/homebrew.yml(1 hunks).github/workflows/pack-repository.yml(1 hunks).github/workflows/ratchet-verify.yml(1 hunks).github/workflows/test-action.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (11)
- GitHub Check: Test (windows-latest, 20.x)
- GitHub Check: Test (macos-latest, 21.x)
- GitHub Check: Test (windows-latest, 23.x)
- GitHub Check: Test (macos-latest, 20.x)
- GitHub Check: Test (windows-latest, 24.x)
- GitHub Check: Test (ubuntu-latest, 21.x)
- GitHub Check: Test (windows-latest, 22.x)
- GitHub Check: Test (windows-latest, 21.x)
- GitHub Check: build-and-publish-image
- GitHub Check: code-review
- GitHub Check: Cloudflare Pages
🔇 Additional comments (15)
.github/workflows/pack-repository.yml (1)
15-15: Good pinning of external actions to immutable SHAs.actions/checkout and the Repomix composite action are both pinned to specific commits with ratchet annotations. This is aligned with supply-chain best practices.
Also applies to: 18-18
.github/workflows/docker.yml (1)
30-30: Checkout action updated and pinned — looks good.Pinned to a newer SHA with ratchet annotation; no behavior change expected in this step.
.github/workflows/ratchet-verify.yml (1)
9-9: Checkout SHA bump aligns with Ratchet’s expectations.Pinned update with ratchet comment; the subsequent lint step should validate all workflow pins as intended.
.github/workflows/claude.yml (2)
28-28: Action SHAs updated and pinned — minimal risk.Both actions are pinned to specific commits with ratchet annotations. No other logic changes in the job.
Also applies to: 34-34
34-37: No action required: input compatibility confirmedI’ve checked the pinned action.yml at 78b0747… and the only required input remains
anthropic_api_key(all others have defaults, including the newmode: tag). Passing just your existing key will work exactly as before—no updates needed..github/workflows/homebrew.yml (1)
13-13: Homebrew actions updated and pinned — looks solid.All three Homebrew steps now reference the same newer commit with ratchet annotations. No config changes needed.
Also applies to: 18-18, 21-21
.github/workflows/test-action.yml (1)
24-24: Checkout pin bump looks goodPinned to the latest v4 SHA via Ratchet. No other logic changes introduced.
.github/workflows/codeql.yml (2)
29-29: Checkout action pin updated correctlyUpdated to the latest v4 commit and still ratcheted. No issues.
33-33: CodeQL actions updated to a consistent, newer SHABoth init and analyze now point to the same newer commit (v3). This consistency is good practice. If you rely on query packs or custom config, consider a quick smoke run to ensure there are no breaking rule changes.
Also applies to: 49-49
.github/workflows/ci.yml (3)
16-16: All checkout pins refreshed consistentlyEvery job now uses the latest pinned v4 SHA. Consistent and supply-chain safe.
Also applies to: 29-29, 42-42, 55-55, 72-72, 89-89, 105-105, 114-114, 125-125, 144-144, 158-158, 183-183, 203-203, 230-230, 253-253
115-115: Typos action updated to a newer commitLooks good. If you’ve customized typos config, keep an eye on any new default dictionary changes in the new commit.
260-260: git-auto-commit-action pin updatedUpdate is straightforward. Optional: skim the action’s changelog to confirm no behavior changes around authoring/committing flags that matter to this job.
.github/workflows/claude-review.yml (3)
5-7: Ensure correct PR ref when triggered via issue_commentNice gating so it only runs on PR events or when someone comments “@claude review”. When triggered by issue_comment, checkout will default to the repository’s default branch ref. If the action depends on the checked-out code (rather than only GitHub API diffs), it may analyze the wrong ref for comment-triggered runs. Verify the anthropics action behavior on issue_comment; if needed, adjust checkout to the PR’s head/merge ref for that path.
Also applies to: 12-17
25-28: Full history checkout is appropriate for review contextfetch-depth: 0 is useful for better diff analysis. Approved.
30-36: Claude action integration updated; validate new inputs on this SHAMigration to mode: experimental-review with timeout and custom_instructions looks correct for the pinned commit. Please verify this SHA documents these inputs to avoid runtime failures. If the action posts comments, confirm it won’t re-trigger itself (you already gate on the “@claude review” phrase, which should mitigate).
yamadashy
force-pushed
the
chore/claude-experimental-review
branch
from
f318670 to
33d44a1
Compare
| mode: experimental-review | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| allowed_tools: "mcp__github__create_pending_pull_request_review,mcp__github__add_pull_request_review_comment_to_pending_review,mcp__github__submit_pending_pull_request_review,mcp__github__get_pull_request_diff" | ||
| # github_token not needed - uses default GITHUB_TOKEN for GitHub operations |
There was a problem hiding this comment.
The comment on line 34 states "github_token not needed" but this may not be accurate for the experimental-review mode. The anthropics/claude-code-action action typically requires explicit GitHub token configuration to perform operations like creating review comments and suggestions on PRs.
Consider explicitly providing the token for clarity and to ensure proper functionality:
| # github_token not needed - uses default GITHUB_TOKEN for GitHub operations | |
| github_token: ${{ secrets.GITHUB_TOKEN }} |
| if: | | ||
| github.event_name == 'pull_request' || | ||
| (github.event_name == 'issue_comment' && | ||
| github.event.issue.pull_request && | ||
| contains(github.event.comment.body, '@claude review')) |
There was a problem hiding this comment.
Security Consideration: The current condition allows any user to trigger the Claude review by commenting "@claude review". For public repositories, consider restricting this to repository collaborators to prevent potential abuse or spam:
| if: | | |
| github.event_name == 'pull_request' || | |
| (github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| contains(github.event.comment.body, '@claude review')) | |
| if: | | |
| github.event_name == 'pull_request' || | |
| (github.event_name == 'issue_comment' && | |
| github.event.issue.pull_request && | |
| contains(github.event.comment.body, '@claude review') && | |
| (github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'COLLABORATOR')) |
This ensures only trusted users can trigger manual reviews.
| - name: Checkout repository | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v4 | ||
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
| fetch-depth: 0 # Full history for better diff analysis |
There was a problem hiding this comment.
Potential Issue with issue_comment Trigger: When triggered by issue_comment, the checkout action defaults to the repository's default branch, not the PR branch. This means Claude might analyze the wrong code version when manually triggered via comments.
Consider checking out the PR's head ref for comment triggers:
| - name: Checkout repository | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v4 | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| fetch-depth: 0 # Full history for better diff analysis | |
| - name: Checkout repository | |
| uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # Full history for better diff analysis | |
| ref: ${{ github.event_name == 'issue_comment' && github.event.pull_request.head.sha || github.sha }} |
This ensures the correct code is analyzed regardless of trigger method.
| timeout-minutes: 10 | ||
| steps: | ||
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # ratchet:actions/checkout@v4 | ||
| - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # ratchet:actions/checkout@v4 |
There was a problem hiding this comment.
✅ Excellent Security Practice: Great use of commit hash pinning for actions/checkout. This protects against tag manipulation attacks while the Ratchet comment maintains human readability by showing this maps to @v4.
The consistent application of this pattern across all workflow files demonstrates strong supply chain security practices.
This PR enables Claude's experimental review mode in the GitHub Actions workflow to provide automated code reviews on pull requests.
Changes
.github/workflows/claude-review.ymlto use experimental review mode@claude reviewcomments on PRsFeatures
@claude reviewcommentsChecklist
npm run testnpm run lint