|
| 1 | +name: Claude Code Review - Secure Analysis |
| 2 | + |
| 3 | +on: |
| 4 | + workflow_run: |
| 5 | + workflows: ["Claude Code Review - Collect PR Data"] |
| 6 | + types: [completed] |
| 7 | + |
| 8 | +jobs: |
| 9 | + secure-review: |
| 10 | + if: ${{ github.event.workflow_run.conclusion == 'success' }} |
| 11 | + runs-on: ubuntu-latest |
| 12 | + permissions: |
| 13 | + contents: read |
| 14 | + pull-requests: write |
| 15 | + issues: read |
| 16 | + actions: read |
| 17 | + |
| 18 | + steps: |
| 19 | + - name: Download and extract PR artifacts |
| 20 | + id: download |
| 21 | + run: | |
| 22 | + # Get artifacts from the workflow run |
| 23 | + ARTIFACTS=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}/artifacts) |
| 24 | + ARTIFACT_ID=$(echo "$ARTIFACTS" | jq -r '.artifacts[0].id') |
| 25 | + ARTIFACT_NAME=$(echo "$ARTIFACTS" | jq -r '.artifacts[0].name') |
| 26 | +
|
| 27 | + echo "Downloading artifact: $ARTIFACT_NAME (ID: $ARTIFACT_ID)" |
| 28 | +
|
| 29 | + # Download the artifact |
| 30 | + gh api repos/${{ github.repository }}/actions/artifacts/$ARTIFACT_ID/zip > artifact.zip |
| 31 | +
|
| 32 | + # Extract it |
| 33 | + unzip -q artifact.zip |
| 34 | +
|
| 35 | + # Read PR info |
| 36 | + if [ -f pr-info.txt ]; then |
| 37 | + echo "=== PR Info ===" |
| 38 | + cat pr-info.txt |
| 39 | + PR_NUM=$(grep "PR Number:" pr-info.txt | cut -d' ' -f3) |
| 40 | + echo "pr_number=$PR_NUM" >> $GITHUB_OUTPUT |
| 41 | + echo "Found PR number: $PR_NUM" |
| 42 | + else |
| 43 | + echo "ERROR: pr-info.txt not found" |
| 44 | + exit 1 |
| 45 | + fi |
| 46 | +
|
| 47 | + # Check diff file |
| 48 | + if [ -f pr.diff ]; then |
| 49 | + echo "Diff file size: $(wc -l < pr.diff) lines" |
| 50 | + else |
| 51 | + echo "ERROR: pr.diff not found" |
| 52 | + exit 1 |
| 53 | + fi |
| 54 | + env: |
| 55 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 56 | + |
| 57 | + - name: Checkout repository |
| 58 | + uses: actions/checkout@v4 |
| 59 | + with: |
| 60 | + fetch-depth: 1 |
| 61 | + |
| 62 | + - name: Run Claude Code Review |
| 63 | + id: claude-review |
| 64 | + uses: anthropics/claude-code-action@v1 |
| 65 | + with: |
| 66 | + github_token: ${{ secrets.GITHUB_TOKEN }} |
| 67 | + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
| 68 | + prompt: | |
| 69 | + REPO: ${{ github.repository }} |
| 70 | + PR NUMBER: ${{ steps.download.outputs.pr_number }} |
| 71 | +
|
| 72 | + A PR diff file has been provided at: pr.diff |
| 73 | +
|
| 74 | + Please review this pull request diff and provide feedback on: |
| 75 | + - Code quality and best practices |
| 76 | + - Potential bugs or issues |
| 77 | + - Performance considerations |
| 78 | + - Security concerns |
| 79 | + - Test coverage |
| 80 | +
|
| 81 | + Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. |
| 82 | +
|
| 83 | + IMPORTANT: Do not execute any code from the PR. Only analyze the diff file. |
| 84 | + Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR. |
| 85 | +
|
| 86 | + # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md |
| 87 | + # or https://docs.claude.com/en/docs/claude-code/cli-reference for available options |
| 88 | + claude_args: '--allowed-tools "Bash(gh pr comment:*),Bash(gh pr view:*),Bash(cat:pr.diff),Bash(cat:pr-info.txt)"' |
| 89 | + |
| 90 | + - name: Check for benchmark results |
| 91 | + id: benchmark |
| 92 | + continue-on-error: true |
| 93 | + run: | |
| 94 | + PR_NUM="${{ steps.download.outputs.pr_number }}" |
| 95 | +
|
| 96 | + # Look for benchmark artifacts from the CI workflow |
| 97 | + echo "Looking for benchmark artifacts for PR #$PR_NUM..." |
| 98 | +
|
| 99 | + # Get all workflow runs for this PR |
| 100 | + RUNS=$(gh api "repos/${{ github.repository }}/actions/runs?event=pull_request&status=completed" \ |
| 101 | + --jq ".workflow_runs[] | select(.head_sha == \"${{ github.event.workflow_run.head_sha }}\") | .id") |
| 102 | +
|
| 103 | + BENCHMARK_FOUND=false |
| 104 | + for RUN_ID in $RUNS; do |
| 105 | + echo "Checking run $RUN_ID for benchmark artifacts..." |
| 106 | +
|
| 107 | + # Check if this run has benchmark artifacts |
| 108 | + ARTIFACTS=$(gh api "repos/${{ github.repository }}/actions/runs/$RUN_ID/artifacts" \ |
| 109 | + --jq ".artifacts[] | select(.name | startswith(\"benchmark-results-pr-\"))") |
| 110 | +
|
| 111 | + if [ -n "$ARTIFACTS" ]; then |
| 112 | + echo "Found benchmark artifacts in run $RUN_ID" |
| 113 | + ARTIFACT_ID=$(echo "$ARTIFACTS" | jq -r '.id' | head -1) |
| 114 | +
|
| 115 | + # Download benchmark artifact |
| 116 | + gh api "repos/${{ github.repository }}/actions/artifacts/$ARTIFACT_ID/zip" > benchmark.zip |
| 117 | + unzip -q benchmark.zip -d benchmark-results |
| 118 | +
|
| 119 | + BENCHMARK_FOUND=true |
| 120 | + break |
| 121 | + fi |
| 122 | + done |
| 123 | +
|
| 124 | + if [ "$BENCHMARK_FOUND" = true ]; then |
| 125 | + echo "has_benchmark=true" >> $GITHUB_OUTPUT |
| 126 | + echo "✅ Benchmark results found and downloaded" |
| 127 | + else |
| 128 | + echo "has_benchmark=false" >> $GITHUB_OUTPUT |
| 129 | + echo "ℹ️ No benchmark results found for this PR" |
| 130 | + fi |
| 131 | + env: |
| 132 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 133 | + |
| 134 | + - name: Post benchmark results to PR |
| 135 | + if: steps.benchmark.outputs.has_benchmark == 'true' |
| 136 | + run: | |
| 137 | + PR_NUM="${{ steps.download.outputs.pr_number }}" |
| 138 | +
|
| 139 | + # Find the benchmark markdown file |
| 140 | + BENCHMARK_FILE=$(find benchmark-results -name "*-report-github.md" -type f | head -1) |
| 141 | +
|
| 142 | + if [ -n "$BENCHMARK_FILE" ] && [ -f "$BENCHMARK_FILE" ]; then |
| 143 | + echo "Found benchmark report: $BENCHMARK_FILE" |
| 144 | +
|
| 145 | + # Create formatted comment |
| 146 | + { |
| 147 | + echo "## 📊 Benchmark Results" |
| 148 | + echo "" |
| 149 | + echo "<details>" |
| 150 | + echo "<summary>Click to expand benchmark results</summary>" |
| 151 | + echo "" |
| 152 | + cat "$BENCHMARK_FILE" |
| 153 | + echo "" |
| 154 | + echo "</details>" |
| 155 | + echo "" |
| 156 | + echo "---" |
| 157 | + echo "*Benchmark generated automatically on $(date -u '+%Y-%m-%d %H:%M:%S UTC')*" |
| 158 | + } > benchmark_comment.md |
| 159 | +
|
| 160 | + # Post to PR |
| 161 | + gh pr comment "$PR_NUM" --body-file benchmark_comment.md |
| 162 | + echo "✅ Benchmark results posted to PR #$PR_NUM" |
| 163 | + else |
| 164 | + echo "⚠️ Benchmark markdown file not found in downloaded artifacts" |
| 165 | + fi |
| 166 | + env: |
| 167 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
0 commit comments