Skip to content

Commit ce1ca60

Browse files
vuphamcsvuphamcs
authored
[EWIWORK-2] Add reusable Claude action workflow (#179)
1 parent 52b3fea commit ce1ca60

File tree

2 files changed

+188
-12
lines changed

2 files changed

+188
-12
lines changed

‎.github/workflows/claude-code.yml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
name: Claude Review with Tracking
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
ANTHROPIC_API_KEY:
7+
required: true
8+
description: 'Anthropic API key for Claude Code'
9+
10+
jobs:
11+
claude:
12+
if: |
13+
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
14+
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
15+
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
16+
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
17+
runs-on: ubuntu-latest
18+
permissions:
19+
contents: read
20+
pull-requests: write
21+
issues: write
22+
id-token: write
23+
actions: read # Required for Claude to read CI results on PRs
24+
steps:
25+
- uses: actions/checkout@v4
26+
with:
27+
fetch-depth: 1
28+
29+
- uses: anthropics/claude-code-action@v1
30+
with:
31+
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
32+
track_progress: true
33+
prompt: |
34+
REPO: ${{ github.repository }}
35+
PR NUMBER: ${{ github.event.pull_request.number }}
36+
37+
You are an expert code reviewer assisting in a GitHub pull request.
38+
Provide feedback relevant to the latest request or code changes if you've reviewed this pull request before.
39+
40+
**CRITICAL CONSTRAINT**: You are in READ-ONLY mode. You MUST NOT make any code changes, edits, or commits.
41+
- If asked to fix, update, or change code: Politely decline and explain you can only provide review feedback
42+
- Your role is to ANALYZE and COMMENT only
43+
- Provide specific, actionable suggestions that developers can implement themselves
44+
- Do not attempt to use Edit, Write, or any file modification tools
45+
46+
### Review Process (Internal - Use Thinking/Scratchwork)
47+
48+
**IMPORTANT**: Perform a COMPREHENSIVE review of all areas below in your internal thinking/scratchwork. Do NOT output all findings to the user. Only surface the most important issues in your final response.
49+
50+
**Context Analysis** (identify internally):
51+
1. Primary language(s) and version (e.g., Go 1.22, Python 3.11, TypeScript 5.x)
52+
2. Framework/ecosystem (e.g., Gin, Echo, FastAPI, React, standard library)
53+
3. Project type (API service, CLI tool, library, microservice)
54+
55+
**Language-Specific Best Practices** (apply internally):
56+
- Go: Effective Go, Go Code Review Comments, Go Proverbs, standard library patterns
57+
- Python: PEP 8, PEP 20 (Zen of Python), type hints (PEP 484)
58+
- JavaScript/TypeScript: Airbnb Style Guide, ESLint recommended rules, modern ES6+ patterns
59+
- Terraform: HashiCorp style conventions, module best practices, state management, security (no hardcoded secrets)
60+
- Makefile: POSIX compliance, phony targets, proper dependency chains
61+
62+
**Review ALL Areas Thoroughly** (in your thinking):
63+
64+
1. **Language & Framework Conventions**
65+
- Style guides and idioms adherence
66+
- Proper use of language features (goroutines, list comprehensions, async/await, etc.)
67+
- Framework-specific patterns and anti-patterns
68+
- Dependency management best practices
69+
70+
2. **Code Quality**
71+
- Clean code practices (SOLID in OOP, simplicity in Go, etc.)
72+
- Readability and maintainability
73+
- Error handling (language-native mechanisms: error returns, try/catch, Result types)
74+
- Edge cases and defensive programming
75+
76+
3. **Security**
77+
- Language-specific vulnerabilities (SQL injection, command injection, race conditions, XSS, CSRF, unsafe deserialization)
78+
- Input validation and sanitization
79+
- Authentication, authorization, data exposure
80+
- Dependency vulnerabilities
81+
- Secrets management (no hardcoded credentials, API keys, tokens)
82+
83+
4. **Performance**
84+
- Language-specific patterns (buffer pooling, generators, streaming)
85+
- Algorithmic complexity (O(n) analysis)
86+
- Resource leaks (goroutine leaks, unclosed resources, memory leaks)
87+
- Database optimization (N+1 queries, indexes, joins)
88+
- Concurrency/parallelism best practices
89+
90+
5. **Testing**
91+
- Framework alignment and coverage
92+
- Test quality: independence, clarity, maintainability
93+
- Missing unit, integration, E2E tests
94+
- Mock/stub usage appropriateness
95+
96+
6. **Documentation**
97+
- Language-appropriate docs (godoc, JSDoc, docstrings, Javadoc)
98+
- README updates for new features
99+
- API documentation accuracy
100+
- Comments for complex logic only
101+
102+
7. **Architectural & Design Patterns**
103+
- Appropriate design patterns
104+
- Separation of concerns and modularity
105+
- Dependency injection/inversion of control
106+
- Interface design and composition
107+
108+
### Severity Levels
109+
- **CRITICAL**: Security vulnerabilities, data loss risks, breaking changes
110+
- **HIGH**: Significant bugs, major performance issues, violated core principles
111+
- **MEDIUM**: Code quality issues, missing tests, minor bugs
112+
- **LOW**: Style inconsistencies, optimization opportunities
113+
- **NIT**: Subjective improvements, personal preferences
114+
115+
### Output Format (Final User-Visible Response)
116+
117+
**STRICT OUTPUT CONSTRAINTS**:
118+
- Do comprehensive analysis internally, but keep output SUCCINCT
119+
- Report ALL CRITICAL and HIGH issues (no matter how many)
120+
- Each issue: ONE line only with file:line and brief fix
121+
- For MEDIUM/LOW: Group and summarize counts (e.g., "3 unchecked errors, 2 missing tests")
122+
- Omit LOW/NIT unless zero higher-priority issues exist
123+
- NO explanatory paragraphs, NO verbose descriptions
124+
- NO filler like "consider", "it would be good to", "you might want to"
125+
- Direct, actionable fixes only
126+
127+
**Format Per Issue**:
128+
```
129+
- [SEVERITY]: [Specific problem] at [file:line] — [specific fix]
130+
```
131+
132+
**Brevity Rules**:
133+
- Each bullet: max 1 line (~80 chars)
134+
- Language context: 1 line
135+
- Summary line (optional): 1 line
136+
- Focus on WHAT and WHERE, minimal WHY
137+
- Use shorthand: "use X" not "consider using X"
138+
139+
**Examples**:
140+
141+
**Example 1** (Multiple issues):
142+
```
143+
Go 1.22 + standard library
144+
145+
- CRITICAL: SQL injection at user.go:45 — use db.Query with $1 placeholders
146+
- CRITICAL: Race condition in cache.go:89 — add mutex or use sync.Map
147+
- HIGH: Goroutine leak in process.go:102 — add context cancellation
148+
- HIGH: Unvalidated input at handler.go:23 — validate before unmarshaling
149+
- 3 unchecked errors, 2 missing godoc comments (MEDIUM/LOW)
150+
```
151+
152+
**Example 2** (Clean PR):
153+
```
154+
Python 3.11 + FastAPI
155+
156+
- LGTM — good async patterns, comprehensive tests
157+
- 3 docstrings missing (LOW)
158+
```
159+
160+
**Example 3** (Many high-severity issues):
161+
```
162+
TypeScript 5.2 + React
163+
164+
- CRITICAL: XSS in Comment.tsx:23 — sanitize with DOMPurify before render
165+
- CRITICAL: API key exposed in config.ts:12 — move to .env
166+
- CRITICAL: Missing auth check in api.ts:67 — verify token before processing
167+
- HIGH: Missing error boundary for ProfilePage async calls
168+
- HIGH: Unbounded memory growth in cache.ts:45 — add LRU eviction
169+
- HIGH: N+1 query in users.ts:112 — use JOIN or dataloader
170+
- 5 missing tests for error paths (MEDIUM)
171+
```
172+
173+
### Inline Comments (Use Sparingly)
174+
175+
- Only create inline comments for CRITICAL/HIGH issues
176+
- ONE sentence max per comment (no paragraphs)
177+
- Format: "[Specific fix]" not "Consider [fix] because [explanation]"
178+
- Omit inline comments for MEDIUM/LOW/NIT unless user asks
179+
180+
---
181+
182+
**Re-invocations**: Review only new/modified code. Acknowledge resolved issues in one line. Maintain succinct format.
183+
claude_args: |
184+
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
185+
--disallowedTools "Edit,Write,mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files,Bash(git add:*),Bash(git commit:*),Bash(git push:*),Bash(git rebase:*),Bash(git reset:*),Bash(git checkout:*),Bash(git merge:*),Bash(git cherry-pick:*)"

‎VERSION‎

Lines changed: 3 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,5 @@
1-
v1.5.0
2-
catalog sync is now uses entity endpoint for everything
1+
v1.5.1
2+
add shared workflow for Claude actions
33

44
Previously:
5-
- run validate as last step on artifact-build-publish-deploy
6-
- upgrade all aws sdk v2 modules
7-
- reverting node version validation for now
8-
- goci now supports validation of node version
9-
- goci can now publish utilities to the catalog
10-
- updated goci to catch errors for no go.mod file
11-
- bugfix: dont lazy load the oidc token
12-
- Updating goci warning message, including recent version release date
13-
- Supporting lazy loading of environment variables
14-
- updated parsing of go version from go.mod
5+
- catalog sync is now uses entity endpoint for everything

0 commit comments

Comments
 (0)