diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml index 1460891..c00c57f 100644 --- a/.github/workflows/code-review.yml +++ b/.github/workflows/code-review.yml @@ -15,8 +15,8 @@ on: type: string required: false default: - 'Read,Grep,Glob,LS,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr - view:*),Bash(gh run list:*),Bash(gh run view:*)' + 'mcp__github_inline_comment__create_inline_comment,Bash(gh pr + diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)' prompt: description: 'Custom prompt to override the default review behavior (leave empty @@ -89,55 +89,25 @@ jobs: claude_args: --allowedTools "${{ inputs.allowed_tools }}" allowed_bots: 'blacksmith-sh,useotto[bot]' prompt: | - **Context:** - - Triggered by: ${{ inputs.trigger_type == 'comment' && 'Manual `/review` comment' || 'Automatic (PR opened/ready)' }} - **Task:** - You are Claude, reviewing this PR. Your previous comments may appear as the github-actions[bot] user. + REPO: ${{ github.repository }} + PR NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }} + TRIGGER: ${{ inputs.trigger_type == 'comment' && 'Manual /review' || 'Automatic on PR open/ready' }} - First, check the existing PR details and review comments to understand what has already been discussed. - If there are previous reviews or feedback, continue from where the conversation left off - address any new changes, - follow up on outstanding items, and avoid repeating points already made. + The PR branch is already checked out. Review only the diff — do not explore the rest of the repo. - Use `gh` CLI to get PR details, check CI status, and view workflow results. + Steps: + 1. Run `gh pr view` and `gh pr diff` to see the changes and any prior review history. + 2. If prior Claude reviews exist (as github-actions[bot]), continue from there — don't repeat points already made. + 3. Post inline comments on specific lines using `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`. + 4. Post one top-level summary with `gh pr comment` at the end. - ${{ inputs.prompt || 'Perform a code review based on the following focus areas: + ${{ inputs.prompt || 'Flag only: + - Bugs and logic errors + - Security issues (injection, auth, secrets, unsafe input handling) + - Broken or missing error handling + - Test gaps for the changed code - 1. **Code Quality** - - Clean code principles and best practices - - Proper error handling and edge cases - - Code readability and maintainability - - KISS and DRY principles - - Consistency with project style - - 2. **Security** - - Potential vulnerabilities - - Input sanitization - - Authentication/authorization logic - - No secrets committed - - 3. **Performance** - - Bottlenecks - - Database query efficiency, O(n) vs O(log n) - - Memory leaks or resource issues - - Serverless best practices - - 4. **Testing & Coverage** - - Adequate test coverage - - Test quality and edge cases - - Missing test scenarios - - Check CI results with `gh run list` and `gh run view` - - 5. **Documentation** - - Code documentation - - README updates for new features - - API documentation accuracy - - Provide feedback using inline comments for specific issues and top-level comments for general observations. - - Always include a tldr; summary of the review. Remember developers do not like to read. - Responses should be focused on significant improvements, not nitpicks or congratulations. - - Be witty and engaging.' }} + Skip nitpicks, style preferences, and praise. If the diff is clean, say so in one line and stop.' }} - name: Complete check run if: always() && inputs.trigger_type == 'comment' diff --git a/README.md b/README.md index a95c2ad..b55a0e7 100644 --- a/README.md +++ b/README.md @@ -236,11 +236,11 @@ Code review workflow supporting both manual (`/review` comment) and automatic #### Inputs -| Input | Type | Default | Description | -| --------------- | ------ | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `trigger_type` | string | `comment` | `comment` for /review command, `auto` for PR open/ready | -| `allowed_tools` | string | `Read,Grep,Glob,LS,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh run list:*),Bash(gh run view:*)` | Comma-separated list of allowed tools | -| `prompt` | string | `''` | Custom prompt (overrides default) | +| Input | Type | Default | Description | +| --------------- | ------ | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `trigger_type` | string | `comment` | `comment` for /review command, `auto` for PR open/ready | +| `allowed_tools` | string | `mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)` | Comma-separated list of allowed tools | +| `prompt` | string | `''` | Custom prompt (overrides default) | #### Secrets @@ -261,13 +261,16 @@ permissions: #### Default Behavior -When no custom `prompt` is provided, the review covers: +When no custom `prompt` is provided, the review is diff-focused and flags only: -1. **Code Quality** - Clean code, error handling, readability, KISS/DRY -2. **Security** - Vulnerabilities, input sanitization, auth logic, secrets -3. **Performance** - Bottlenecks, query efficiency, memory leaks -4. **Testing** - Coverage, test quality, edge cases -5. **Documentation** - Code docs, README updates, API docs +- Bugs and logic errors +- Security issues (injection, auth, secrets, unsafe input handling) +- Broken or missing error handling +- Test gaps for the changed code + +Comments are posted inline on specific lines via +`mcp__github_inline_comment__create_inline_comment`, with a single top-level +summary. Nitpicks, style, and praise are skipped. **When `trigger_type: comment` (default):**