ci: add Claude Code PR review action

Author: ameya-deshmukh

.github/workflows/claude-review.yml

@@ -0,0 +1,79 @@
+# Requires ANTHROPIC_API_KEY secret in repo Settings > Secrets and variables > Actions.
+
+name: Claude Code
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+jobs:
+  claude:
+    if: >
+      github.event_name == 'pull_request' ||
+      contains(github.event.comment.body, '@claude')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          claude_args: |
+            --allowedTools "Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(git:*)"
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            You are a PR reviewer. ONLY review the files changed in this PR.
+            Use gh pr diff to see what changed. Do NOT review unchanged files.
+
+            After your review, post your findings as a single PR comment using:
+            gh pr comment ${{ github.event.pull_request.number }} --body "your review"
+
+            Only post GitHub comments - do not submit review text as messages.
+
+            Format your comment as:
+
+            ## PR Review Summary
+
+            ### Changes
+            Brief description of what this PR changes.
+
+            ### Blocking Issues
+            Numbered list of critical issues that must be fixed before merge.
+            Include file path and line numbers. Explain the issue and provide a fix.
+            If none, write None found.
+
+            ### Suggestions
+            Numbered list of non-blocking improvements.
+            If none, write None.
+
+            ### Positive Notes
+            Brief bullet points of what looks good.
+
+            Review focus areas:
+            - Rust safety (unsafe blocks, memory management, ownership)
+            - Security vulnerabilities (especially cryptographic and smart contract logic)
+            - Confidential txs (type 0x4a): encryption_pubkey/nonce handling, no plaintext leaks in logs/errors/RPC responses
+            - Enclave/TEE: purpose keys (tx_io_pk/tx_io_sk) never logged or serialized, mock server gated to test/dev
+            - EVM execution: SeismicSpecId mapping, confidential state isolation, SeismicReceipt correctness
+            - TxPool: RecentBlockCache block hash validation, RwLock race conditions
+            - RPC: signed_read_to_plaintext_tx coverage, purpose key endpoint safety
+            - Hardforks: Mercury activation correctness, all standard forks at genesis
+            - Codec backward compatibility, no libmdbx modifications
+            - Clippy strictness: no unwrap/expect/indexing/panic/unreachable/todo (Seismic CI enforces as errors)
+            - Performance and error handling
+            - Test coverage gaps