diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml new file mode 100644 index 0000000000..05a5cd8bf7 --- /dev/null +++ b/.github/workflows/claude-code-review.yml @@ -0,0 +1,32 @@ +name: Claude code review + +on: + issue_comment: + types: [created] + +permissions: + contents: read + id-token: write + pull-requests: write + +cache-mode: none + +jobs: + review: + # Trigger filter, not a security gate: the reusable workflow keeps all + # four gates and still enforces write access; the author_association + # check here is only a coarse pre-filter. The body match is exact on the + # two commands (plus a trailing-text form) so a near-miss comment like + # /reviews never claims the concurrency group and cancels a running + # review. Trade-off: a /review followed by a newline does not trigger. + if: >- + github.event.issue.pull_request && + (github.event.comment.body == '/review' || + startsWith(github.event.comment.body, '/review ') || + github.event.comment.body == '/review-workflow' || + startsWith(github.event.comment.body, '/review-workflow ')) && + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association) + concurrency: + group: claude-review-${{ github.event.issue.number }} + cancel-in-progress: true + uses: yearn/yearn-gha/.github/workflows/claude-code-review.yml@17446bfb9e9c7911367379222fa5b7e3fff52fa3