From 9d4303f4e080a174267cc2240401ab99de6d0ad2 Mon Sep 17 00:00:00 2001 From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com> Date: Sat, 27 Jun 2026 20:55:19 -0400 Subject: [PATCH] ci: add claude-review caller workflow Wire this repo into the ci-workflows claude-review reusable workflow, consistent with the org-wide rollout. pull_request-triggered; passes CLAUDE_CODE_OAUTH_TOKEN explicitly (least privilege). Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01W4D4GgeYg7k6yU1DSzweij --- .github/workflows/claude-review.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/workflows/claude-review.yml diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml new file mode 100644 index 000000000..8a62c48ef --- /dev/null +++ b/.github/workflows/claude-review.yml @@ -0,0 +1,28 @@ +name: claude-review + +# Automated PR code review via the ci-workflows reusable workflow. The caller +# owns the triggers + GITHUB_TOKEN permission grant (a called workflow can only +# downgrade them, never elevate); the reusable workflow owns the action pin and +# the secret-handling safety model. +# +# Fork PRs receive no secrets and a read-only token, so they are simply not +# reviewed by design (no token-exfiltration surface). Requires `claude-code-plugins` to be +# in the CLAUDE_CODE_OAUTH_TOKEN org secret's selected-repositories scope. +on: + pull_request: + types: [opened, synchronize, ready_for_review, reopened] + +permissions: + contents: read + +jobs: + review: + permissions: + contents: read # checkout + read the diff + pull-requests: write # post review + track_progress tracking comment + id-token: write # OIDC — mints the Claude GitHub App token + uses: melodic-software/ci-workflows/.github/workflows/claude-review.yml@025be4512ede5f24ec159d52608613c167a49881 # 025be45 2026-06-27 + # Pass only the one named secret (least privilege) rather than `secrets: + # inherit`, which would forward every parent secret to the called workflow. + secrets: + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}