ci: add Claude PR review workflow - #12
Merged
Merged
Conversation
Two workflows, both authenticated with the Claude Max subscription via CLAUDE_CODE_OAUTH_TOKEN (generated locally with `claude setup-token`) — no ANTHROPIC_API_KEY, no API billing, no per-call cost: - claude-pr-review.yml — automatic reviewer-POV review when a PR to main is opened/reopened, specialized to RiskKernel's invariants. - claude.yml — on-demand "@claude" trigger on PR/review comments, locked to the maintainer (github.event.sender.login == 'prashar32'), so only the owner can invoke Claude on this repo. Setup: add the CLAUDE_CODE_OAUTH_TOKEN repo secret and install the Claude GitHub App. Permissions scoped to contents:read + pull-requests:write (+issues:write for the @claude flow).
prashar32
force-pushed
the
ci/claude-pr-review
branch
from
May 30, 2026 19:34
97049d9 to
5424f7e
Compare
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Claude-powered PR review using the Claude Max subscription (no
ANTHROPIC_API_KEY, no API billing, no per-call cost). Two workflows:claude-pr-review.yml— automatic reviewer-POV review when a PR tomainis opened/reopened, with a prompt specialized to RiskKernel's invariants (deterministic-only-in-Go enforcement, no-telemetry egress,api/v1/config/forward-only-migration compatibility, safety-critical tests, tainted-input/overflow risks). Addsynchronizeto also review every push.claude.yml— on-demand@claudeon PR/review comments, locked to the maintainer: the job runs only whengithub.event.sender.login == 'prashar32', so nobody else can invoke Claude on this repo.Setup required before it works
claude setup-token— uses the Claude Max plan, prints a long-lived token once.CLAUDE_CODE_OAUTH_TOKEN(Settings → Secrets and variables → Actions).Auth is
claude_code_oauth_token(notanthropic_api_key). Permissions are scoped tocontents: read+pull-requests: write(+issues: writefor the@claudeflow). Neither workflow is a required status check, so they don't block merges.