Automated AI code review workflow (#393)

Implement a workflow triggering automated AI code reviews for incoming
BPF patches.

The code reviews are executed with Claude Code [1] with elaborate
prompts that instruct LLM to search for particular regressions [2].

In case any regressions are found, LLM is instructed to generate a
conventional inline review, suitable for Linux Kernel mailing list.

[1] https://github.com/anthropics/claude-code-action
[2] https://github.com/masoncl/review-prompts

Author: theihor

.github/workflows/ai-code-review.yml

@@ -0,0 +1,113 @@
+name: AI Code Review
+
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+  id-token: write
+
+on:
+  pull_request:
+    types: [opened, review_requested]
+
+jobs:
+  get-commits:
+    if: ${{ secrets.KP_REVIEW_BOT_APP_ID != '' }}
+    runs-on: 'ubuntu-latest'
+    continue-on-error: true
+    outputs:
+      commits: ${{ steps.get-commits.outputs.commits }}
+    steps:
+      - name: Checkout Linux source tree
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 32
+
+      # Get the list of commits and trigger a review job for each separate commit
+      # As a safeguard, check no more than the first 50 commits
+      - name: Get PR commits
+        id: get-commits
+        run: |
+          tmp=$(mktemp)
+          git rev-list ${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }} | head -n 50 > pr_commits.txt
+          cat pr_commits.txt | tail -n +2 | jq -R -s -c 'split("\n")[:-1]' > $tmp
+          echo "commits=$(cat $tmp)" >> $GITHUB_OUTPUT
+
+
+  ai-review:
+    needs: get-commits
+    runs-on: 'ubuntu-latest'
+    continue-on-error: true
+    strategy:
+      matrix:
+        commit: ${{ fromJson(needs.get-commits.outputs.commits) }}
+      fail-fast: false
+    env:
+      AWS_REGION: us-west-2
+    steps:
+      - name: Checkout CI code
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: |
+            .github
+            ci
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.KP_REVIEW_BOT_APP_ID }}
+          private-key: ${{ secrets.KP_REVIEW_BOT_APP_PRIVATE_KEY }}
+
+      - name: Configure AWS Credentials (OIDC)
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_BEDROCK_ROLE }}
+          aws-region: us-west-2
+
+      - name: Set up .claude/settings.json
+        shell: bash
+        run: |
+          mkdir -p ~/.claude
+          cp ci/claude/settings.json ~/.claude/settings.json
+
+      - name: Checkout Linux source tree
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 32
+          ref: ${{ matrix.commit }}
+
+      - name: Checkout prompts repo
+        uses: actions/checkout@v5
+        with:
+          repository: 'kernel-patches/review-prompts'
+          path: 'review'
+
+      - uses: anthropics/claude-code-action@v1
+        with:
+          github_token: ${{ steps.app-token.outputs.token }}
+          use_bedrock: "true"
+          claude_args: '--max-turns 100'
+          prompt: |
+            Current directory is the root of a Linux Kernel git repository.
+            Using the prompt `review/review-core.md` and the prompt directory `review`
+            do a code review of the top commit in the Linux repository.
+
+      - name: Dump review-inline.txt if exists
+        shell: bash
+        run: |
+          review_file=$(find ${{ github.workspace }} -name review-inline.txt)
+          cat $review_file
+          if [ -s "$review_file" ]; then
+            cp -f $review_file ${{ github.workspace }}/review-inline.txt || true
+            echo "### Inline review" >> $GITHUB_STEP_SUMMARY
+            echo "```" >> $GITHUB_STEP_SUMMARY
+            cat $review_file >> $GITHUB_STEP_SUMMARY
+            echo "```" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ai-review-output
+          if-no-files-found: ignore
+          path: ${{ github.workspace }}/review-inline.txt

ci/claude/settings.json

@@ -0,0 +1,7 @@
+{
+  "model": "us.anthropic.claude-opus-4-1-20250805-v1:0",
+  "permissions": {
+    "allow": ["Bash", "Edit", "MultiEdit", "Write"],
+    "defaultMode": "acceptEdits"
+  }
+}