From 954a3ea27520760d84f4fc1ccd6a5eb4cd6c3b13 Mon Sep 17 00:00:00 2001
From: jtdub <amascuba@gmail.com>
Date: Sun, 23 Aug 2026 09:18:08 -0500
Subject: [PATCH 1/2] add claude review agent

---
 .github/workflows/claude-review.yml | 74 +++++++++++++++++++++++++++++
 CHANGELOG.md                        |  6 +++
 2 files changed, 80 insertions(+)
 create mode 100644 .github/workflows/claude-review.yml

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
new file mode 100644
index 0000000..a3d2e0c
--- /dev/null
+++ b/.github/workflows/claude-review.yml
@@ -0,0 +1,74 @@
+name: Claude PR review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+# Cancel a superseded review when the branch is pushed again.
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    # Secrets, including CLAUDE_CODE_OAUTH_TOKEN, are unavailable to fork
+    # pull requests.
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository
+    permissions:
+      contents: read
+      pull-requests: write
+      issues: write
+      actions: read
+    steps:
+    - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
+
+    - name: Fetch the base branch
+      run: |
+        git fetch --no-tags origin \
+          +refs/heads/${{ github.event.pull_request.base.ref }}:refs/heads/${{ github.event.pull_request.base.ref }} || true
+
+    - name: Set up Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.12"
+
+    - name: Install poetry
+      uses: snok/install-poetry@v1
+      with:
+        version: 1.5.1
+
+    - name: Install the project dependencies
+      run: poetry install --no-interaction --no-root
+
+    - name: Install the docs dependencies
+      run: pip install -r docs/requirements.txt
+
+    - name: Run the hier-config-review skill
+      uses: anthropics/claude-code-action@v1
+      with:
+        claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+        track_progress: true
+        prompt: |
+          /hier-config-review
+
+          Review this pull request. The base branch is
+          `${{ github.event.pull_request.base.ref }}`, so use
+          `git diff ${{ github.event.pull_request.base.ref }}...HEAD` for the diff.
+
+          The Python environment is ready. Do not run `poetry install`.
+
+          Report only. Do not change, stage, or commit any file.
+
+          Post the full report as your pull request comment. Group the findings
+          by severity (Blockers, Should fix, Nits). Give each finding a
+          `file:line` reference and name the standard it violates. End with the
+          pass/fail verdict against the "Before Opening a PR" checklist in
+          AGENTS.md.
+        claude_args: |
+          --max-turns 60
+          --allowedTools Read,Grep,Glob,Bash,mcp__github_comment__update_claude_comment
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3974c52..efc9f55 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,6 +23,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- `.github/workflows/claude-review.yml`: a GitHub Actions workflow that runs
+  the in-repo `hier-config-review` skill against every pull request through
+  `anthropics/claude-code-action` and posts the findings as a PR comment. The
+  job installs the poetry and docs environments first, so the skill's lint,
+  test, and `mkdocs build --strict` gates run for real. It is skipped for draft
+  and fork pull requests, where `CLAUDE_CODE_OAUTH_TOKEN` is unavailable.
 - Aruba AOS-CX platform support (`Platform.ARUBA_AOSCX`): a new driver and
   config view covering AOS-CX's Cisco/EOS-like hierarchical CLI. Because
   `vlan trunk allowed` is additive on AOS-CX rather than declarative, collapsed

From 1713ea2490a37d09492429c611343577522e26be Mon Sep 17 00:00:00 2001
From: jtdub <amascuba@gmail.com>
Date: Sun, 23 Aug 2026 09:24:10 -0500
Subject: [PATCH 2/2] Grant id-token write to the Claude review workflow

claude-code-action exchanges a GitHub OIDC token for its App token. The
job did not request id-token: write, so the runner supplied no OIDC
endpoint and the action failed with "Unable to get
ACTIONS_ID_TOKEN_REQUEST_URL env variable" after three attempts.

Claude-Session: https://claude.ai/code/session_01HbMucj2WqnL685BRUcFhZT
---
 .github/workflows/claude-review.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index a3d2e0c..c004c02 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -22,6 +22,8 @@ jobs:
       pull-requests: write
       issues: write
       actions: read
+      # claude-code-action exchanges an OIDC token for its GitHub App token.
+      id-token: write
     steps:
     - uses: actions/checkout@v6
       with: