From be4f938091231923aa2149c3b5fa2e5179300aba Mon Sep 17 00:00:00 2001 From: Isaac Suttell Date: Mon, 15 Dec 2025 12:44:09 -0800 Subject: [PATCH 1/3] fix: remove track_progress from issue-triage workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit track_progress is only supported for events: pull_request, issues, issue_comment, pull_request_review_comment, pull_request_review. The issue-triage workflow uses repository_dispatch which doesn't support it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 --- .github/workflows/issue-triage.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml index a8bf281..3d9e54d 100644 --- a/.github/workflows/issue-triage.yml +++ b/.github/workflows/issue-triage.yml @@ -52,7 +52,6 @@ jobs: ${{ secrets.claude_code_oauth_token || secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ secrets.GITHUB_TOKEN }} - track_progress: true settings: | { "mcpServers": { From a3c6e1f895ebba57d3aa8688bd9471472fec6e38 Mon Sep 17 00:00:00 2001 From: Isaac Suttell Date: Fri, 15 May 2026 21:54:03 -0700 Subject: [PATCH 2/3] refactor: focus code-review workflow on diff with inline comments Strip the allowlist to the inline-comment MCP plus gh pr diff/view/comment so the agent can't wander the repo, and replace the 5-category rubric with a lean priority-only prompt that names mcp__github_inline_comment__create_inline_comment explicitly. README defaults updated to match. Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/code-review.yml | 64 ++++++++----------------------- README.md | 25 ++++++------ 2 files changed, 31 insertions(+), 58 deletions(-) diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml index 1460891..c00c57f 100644 --- a/.github/workflows/code-review.yml +++ b/.github/workflows/code-review.yml @@ -15,8 +15,8 @@ on: type: string required: false default: - 'Read,Grep,Glob,LS,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr - view:*),Bash(gh run list:*),Bash(gh run view:*)' + 'mcp__github_inline_comment__create_inline_comment,Bash(gh pr + diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)' prompt: description: 'Custom prompt to override the default review behavior (leave empty @@ -89,55 +89,25 @@ jobs: claude_args: --allowedTools "${{ inputs.allowed_tools }}" allowed_bots: 'blacksmith-sh,useotto[bot]' prompt: | - **Context:** - - Triggered by: ${{ inputs.trigger_type == 'comment' && 'Manual `/review` comment' || 'Automatic (PR opened/ready)' }} - **Task:** - You are Claude, reviewing this PR. Your previous comments may appear as the github-actions[bot] user. + REPO: ${{ github.repository }} + PR NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }} + TRIGGER: ${{ inputs.trigger_type == 'comment' && 'Manual /review' || 'Automatic on PR open/ready' }} - First, check the existing PR details and review comments to understand what has already been discussed. - If there are previous reviews or feedback, continue from where the conversation left off - address any new changes, - follow up on outstanding items, and avoid repeating points already made. + The PR branch is already checked out. Review only the diff — do not explore the rest of the repo. - Use `gh` CLI to get PR details, check CI status, and view workflow results. + Steps: + 1. Run `gh pr view` and `gh pr diff` to see the changes and any prior review history. + 2. If prior Claude reviews exist (as github-actions[bot]), continue from there — don't repeat points already made. + 3. Post inline comments on specific lines using `mcp__github_inline_comment__create_inline_comment` with `confirmed: true`. + 4. Post one top-level summary with `gh pr comment` at the end. - ${{ inputs.prompt || 'Perform a code review based on the following focus areas: + ${{ inputs.prompt || 'Flag only: + - Bugs and logic errors + - Security issues (injection, auth, secrets, unsafe input handling) + - Broken or missing error handling + - Test gaps for the changed code - 1. **Code Quality** - - Clean code principles and best practices - - Proper error handling and edge cases - - Code readability and maintainability - - KISS and DRY principles - - Consistency with project style - - 2. **Security** - - Potential vulnerabilities - - Input sanitization - - Authentication/authorization logic - - No secrets committed - - 3. **Performance** - - Bottlenecks - - Database query efficiency, O(n) vs O(log n) - - Memory leaks or resource issues - - Serverless best practices - - 4. **Testing & Coverage** - - Adequate test coverage - - Test quality and edge cases - - Missing test scenarios - - Check CI results with `gh run list` and `gh run view` - - 5. **Documentation** - - Code documentation - - README updates for new features - - API documentation accuracy - - Provide feedback using inline comments for specific issues and top-level comments for general observations. - - Always include a tldr; summary of the review. Remember developers do not like to read. - Responses should be focused on significant improvements, not nitpicks or congratulations. - - Be witty and engaging.' }} + Skip nitpicks, style preferences, and praise. If the diff is clean, say so in one line and stop.' }} - name: Complete check run if: always() && inputs.trigger_type == 'comment' diff --git a/README.md b/README.md index a95c2ad..b55a0e7 100644 --- a/README.md +++ b/README.md @@ -236,11 +236,11 @@ Code review workflow supporting both manual (`/review` comment) and automatic #### Inputs -| Input | Type | Default | Description | -| --------------- | ------ | ----------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | -| `trigger_type` | string | `comment` | `comment` for /review command, `auto` for PR open/ready | -| `allowed_tools` | string | `Read,Grep,Glob,LS,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh run list:*),Bash(gh run view:*)` | Comma-separated list of allowed tools | -| `prompt` | string | `''` | Custom prompt (overrides default) | +| Input | Type | Default | Description | +| --------------- | ------ | --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | +| `trigger_type` | string | `comment` | `comment` for /review command, `auto` for PR open/ready | +| `allowed_tools` | string | `mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)` | Comma-separated list of allowed tools | +| `prompt` | string | `''` | Custom prompt (overrides default) | #### Secrets @@ -261,13 +261,16 @@ permissions: #### Default Behavior -When no custom `prompt` is provided, the review covers: +When no custom `prompt` is provided, the review is diff-focused and flags only: -1. **Code Quality** - Clean code, error handling, readability, KISS/DRY -2. **Security** - Vulnerabilities, input sanitization, auth logic, secrets -3. **Performance** - Bottlenecks, query efficiency, memory leaks -4. **Testing** - Coverage, test quality, edge cases -5. **Documentation** - Code docs, README updates, API docs +- Bugs and logic errors +- Security issues (injection, auth, secrets, unsafe input handling) +- Broken or missing error handling +- Test gaps for the changed code + +Comments are posted inline on specific lines via +`mcp__github_inline_comment__create_inline_comment`, with a single top-level +summary. Nitpicks, style, and praise are skipped. **When `trigger_type: comment` (default):** From 5eee58c78e701521de9448e161cbd63aa4af3088 Mon Sep 17 00:00:00 2001 From: Isaac Suttell Date: Thu, 9 Jul 2026 14:56:46 -0700 Subject: [PATCH 3/3] chore: align checkout action on v5 across workflows Co-Authored-By: Claude Fable 5 --- .github/workflows/code-review.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/code-review.yml b/.github/workflows/code-review.yml index c00c57f..edd8142 100644 --- a/.github/workflows/code-review.yml +++ b/.github/workflows/code-review.yml @@ -53,7 +53,7 @@ jobs: }); - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v5 with: fetch-depth: 1