From 5424f7ea7e5a83bbd1ac442292a0f808ec048485 Mon Sep 17 00:00:00 2001
From: Adarsh Prashar <adarsh.prashar32@gmail.com>
Date: Sun, 31 May 2026 00:48:34 +0530
Subject: [PATCH] ci: add Claude PR review (Max subscription auth)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two workflows, both authenticated with the Claude Max subscription via
CLAUDE_CODE_OAUTH_TOKEN (generated locally with `claude setup-token`) — no
ANTHROPIC_API_KEY, no API billing, no per-call cost:

- claude-pr-review.yml — automatic reviewer-POV review when a PR to main is
  opened/reopened, specialized to RiskKernel's invariants.
- claude.yml — on-demand "@claude" trigger on PR/review comments, locked to the
  maintainer (github.event.sender.login == 'prashar32'), so only the owner can
  invoke Claude on this repo.

Setup: add the CLAUDE_CODE_OAUTH_TOKEN repo secret and install the Claude GitHub
App. Permissions scoped to contents:read + pull-requests:write (+issues:write
for the @claude flow).
---
 .github/workflows/claude-pr-review.yml | 47 ++++++++++++++++++++++++++
 .github/workflows/claude.yml           | 32 ++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 .github/workflows/claude-pr-review.yml
 create mode 100644 .github/workflows/claude.yml

diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
new file mode 100644
index 0000000..5f7e19c
--- /dev/null
+++ b/.github/workflows/claude-pr-review.yml
@@ -0,0 +1,47 @@
+name: Claude PR Review
+
+# Automatic reviewer-POV review when a PR to main is opened. Auth is the Claude
+# Max subscription via CLAUDE_CODE_OAUTH_TOKEN (no API billing, no per-call cost) —
+# generate it locally once with `claude setup-token` and add it as a repo secret.
+# Re-review on demand by commenting "@claude" (see claude.yml). Add `synchronize`
+# below if you also want a fresh review on every push.
+on:
+  pull_request:
+    types: [opened, reopened]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          prompt: |
+            Review this pull request as a senior reviewer for RiskKernel — a
+            deterministic, self-hosted reliability runtime for AI agents. Post
+            concise, actionable inline comments on the specific lines; if the PR
+            is clean, say so briefly. Prioritise:
+
+            1. Correctness & bugs — concurrency, error handling, edge cases.
+            2. Security — path/SSRF/injection, integer overflow, unsafe file or
+               exec handling, and secret handling. No data may leave the host
+               except calls to the user-configured provider, OTLP, and approval
+               webhook endpoints (see SECURITY.md).
+            3. The core invariant — ALL enforcement (token/dollar/loop/time
+               budgets, kill switch, approval gating, routing, retries,
+               checkpoint/resume) stays deterministic Go and is NEVER delegated to
+               an LLM.
+            4. Backwards compatibility — api/v1 request/response shapes, the config
+               schema, and SQLite migrations (forward-only; never edit a shipped
+               migration).
+            5. Tests — safety-critical paths (governor, approval gate, checkpoint
+               manager) need exhaustive coverage.
+            6. Surface any new CodeQL-style risks (e.g. tainted input reaching a
+               file path or a command) before they land.
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
new file mode 100644
index 0000000..d123a0e
--- /dev/null
+++ b/.github/workflows/claude.yml
@@ -0,0 +1,32 @@
+name: Claude (@claude)
+
+# On-demand Claude — comment "@claude ..." on a PR (or an inline review comment)
+# to ask for a re-review or a change. Locked to the maintainer: the job only runs
+# when the commenter is prashar32, so nobody else can invoke Claude on this repo.
+# Auth is the Claude Max subscription (CLAUDE_CODE_OAUTH_TOKEN); no API billing.
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: write
+
+jobs:
+  claude:
+    # Only the maintainer can trigger Claude, and only via the @claude phrase.
+    if: >
+      github.event.sender.login == 'prashar32' &&
+      contains(github.event.comment.body, '@claude')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          trigger_phrase: "@claude"