Repository navigation
ci: add Claude code review for pull requests [skip release] - #121
Merged
Merged
Conversation
Runs Anthropic's code-review plugin through claude-code-action once per pull request and posts inline findings. Skips drafts and fork PRs, which don't receive repository secrets.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 1 file
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
One Sonnet call per PR instead of the multi-agent code-review plugin, to keep costs down. Uses the workflow's GITHUB_TOKEN to post comments, skips Markdown-only and bot PRs, and does nothing when no API key is set.
Prefers CLAUDE_CODE_OAUTH_TOKEN so reviews use the subscription's included usage, falling back to ANTHROPIC_API_KEY only when no token is set. Drops the temporary full output.
There was a problem hiding this comment.
All reported issues were addressed across 1 file (changes from recent commits).
Reply with feedback, questions, or to request a fix.
View guided diff | Re-trigger cubic
|
No blocking problems found in the workflow. Permissions are minimal, the action is pinned to a commit, fork and bot PRs are skipped, and the tool allowlist is tight. One thing to note: the full review hasn't completed yet, so it still needs a run once the token secret is added. |
Also runs on pushes, but skips once the marked summary comment exists, so each PR still gets one review. Queued runs wait instead of cancelling a review part way through.
|
No problems found. The workflow's guards, token permissions and pinned action look sound. |
5 of 7 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem and reproduction
I want Claude reviewing my own PRs alongside cubic without it eating into paid API credits.
Implementation and impact
.github/workflows/claude-code-review.yml. Each PR gets one review from a single Claude Sonnet pass (claude-sonnet-5-5) throughanthropics/claude-code-action. It posts inline comments on real problems and one short summary comment, and readsAGENTS.mdandCONTRIBUTING.mdfor the project rules.code-reviewplugin, but it runs several agents, including two on Opus, on every PR. At around 100 PRs a month that would cost far more than it's worth, so this uses one Sonnet pass instead.<!-- claude-review -->) exists, so each PR gets one review, including PRs that start Markdown-only and gain code later. Skips drafts, bot PRs, fork PRs (GitHub withholds secrets from them) and Markdown-only changes. Cubic still covers fork PRs.CLAUDE_CODE_OAUTH_TOKENsecret so reviews run on my Claude subscription's included usage, falling back toANTHROPIC_API_KEYonly when no token is set. With neither, the job just skips.GITHUB_TOKEN(read-only code access, write access to PR comments only), so it doesn't depend on the Claude GitHub App. Capped at a 15-minute timeout and 25 turns, and the action is pinned to the v1.0.248 commit.Validation
actionlintpasses.Performance
Not applicable.
Testing status
Design impact and approval
Documentation impact
No documentation changes. No existing docs mention review bots.
AI disclosure
I implemented these changes and used Claude Opus as a tool.