diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml deleted file mode 100644 index 807866e..0000000 --- a/.github/workflows/claude.yml +++ /dev/null @@ -1,140 +0,0 @@ -# Claude Code GitHub Actions workflow -# -# Two trigger modes: -# 1. AUTO — fires on every PR open/update → Claude auto-reviews the diff -# 2. MANUAL — mention @claude anywhere in an issue/PR/review to invoke the agent -# -# Auth: CLAUDE_CODE_OAUTH_TOKEN (repository secret) — uses Claude Pro/Max subscription. -# Generate: `claude setup-token`, then `gh secret set CLAUDE_CODE_OAUTH_TOKEN` -# Setup: https://github.com/anthropics/claude-code-action/blob/main/docs/setup.md -# Security: https://github.com/anthropics/claude-code-action/blob/main/docs/security.md - -name: Claude Code - -on: - # AUTO: review every PR diff as soon as it's opened or updated - pull_request: - types: [opened, synchronize, reopened, ready_for_review] - - # MANUAL: @claude mention in issues, PRs, review threads - issue_comment: - types: [created] - pull_request_review_comment: - types: [created] - issues: - types: [opened, assigned] - pull_request_review: - types: [submitted] - -jobs: - # ─── AUTO review on every PR ─────────────────────────────────────────────── - claude-pr-review: - name: Auto PR Review - if: github.event_name == 'pull_request' && github.event.pull_request.draft == false && github.actor != 'dependabot[bot]' - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: write - issues: write - actions: read - id-token: write - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 1 - - - name: Validate & normalize Claude token - env: - RAW_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - run: | - # A wrapped copy/paste embeds a newline in the secret → the action sends - # an invalid auth header ("Header has invalid value: '***\n ***'"). Strip - # all whitespace to heal it, then sanity-check the shape and fail loudly - # if the secret is missing or clearly wrong. - TOKEN="$(printf '%s' "$RAW_TOKEN" | tr -d '[:space:]')" - if [ -z "$TOKEN" ]; then - echo "::error::CLAUDE_CODE_OAUTH_TOKEN secret is not set. Run 'claude setup-token' then 'gh secret set CLAUDE_CODE_OAUTH_TOKEN'." - exit 1 - fi - case "$TOKEN" in - sk-ant-oat*) : ;; - *) echo "::error::CLAUDE_CODE_OAUTH_TOKEN is malformed (expected to start with sk-ant-oat). Re-copy from 'claude setup-token' output."; exit 1 ;; - esac - echo "::add-mask::$TOKEN" - printf 'CLAUDE_OAUTH=%s\n' "$TOKEN" >> "$GITHUB_ENV" - echo "Claude token shape OK (length ${#TOKEN})." - - - name: Claude auto-review - uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1 - with: - claude_code_oauth_token: ${{ env.CLAUDE_OAUTH }} - # Prompt sent automatically on every PR — no @claude mention needed - prompt: | - Review this pull request. Check for: - - Bugs, logic errors, or broken functionality - - Security issues (secrets, injections, unsafe inputs) - - Style/convention inconsistencies vs CLAUDE.md - - Broken or invalid URLs in README changes - Post inline comments on specific lines where issues exist. - If the PR looks clean, leave a short approving summary comment. - claude_args: | - --max-turns 30 - plugin_marketplaces: | - https://github.com/anthropics/claude-plugins-official.git - plugins: | - code-review@claude-plugins-official - - # ─── MANUAL: respond to @claude mentions ─────────────────────────────────── - claude-interactive: - name: Interactive (@claude) - if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)) - runs-on: ubuntu-latest - permissions: - contents: write - pull-requests: write - issues: write - actions: read - id-token: write - steps: - - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 1 - - - name: Validate & normalize Claude token - env: - RAW_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - run: | - # A wrapped copy/paste embeds a newline in the secret → the action sends - # an invalid auth header ("Header has invalid value: '***\n ***'"). Strip - # all whitespace to heal it, then sanity-check the shape and fail loudly - # if the secret is missing or clearly wrong. - TOKEN="$(printf '%s' "$RAW_TOKEN" | tr -d '[:space:]')" - if [ -z "$TOKEN" ]; then - echo "::error::CLAUDE_CODE_OAUTH_TOKEN secret is not set. Run 'claude setup-token' then 'gh secret set CLAUDE_CODE_OAUTH_TOKEN'." - exit 1 - fi - case "$TOKEN" in - sk-ant-oat*) : ;; - *) echo "::error::CLAUDE_CODE_OAUTH_TOKEN is malformed (expected to start with sk-ant-oat). Re-copy from 'claude setup-token' output."; exit 1 ;; - esac - echo "::add-mask::$TOKEN" - printf 'CLAUDE_OAUTH=%s\n' "$TOKEN" >> "$GITHUB_ENV" - echo "Claude token shape OK (length ${#TOKEN})." - - - name: Run Claude Code - id: claude - uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1 - with: - claude_code_oauth_token: ${{ env.CLAUDE_OAUTH }} - claude_args: | - --max-turns 15 - plugin_marketplaces: | - https://github.com/anthropics/claude-plugins-official.git - plugins: | - code-review@claude-plugins-official