examples: add claude-code-sandbox and qclaw-sandbox templates #2287
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Auto Review | |
| on: | |
| # IMPORTANT: pull_request_target makes secrets available to fork PRs. | |
| # SECURITY RULE: never add steps that EXECUTE code from the PR | |
| # (no npm install / make / cargo build / pre-commit / etc.). | |
| # Checkout only the base branch (trusted root). Claude reads PR changes via | |
| # gh pr diff/view and posts review output through constrained tools below. | |
| # See: https://github.com/anthropics/claude-code-action/blob/main/docs/security.md | |
| pull_request_target: | |
| types: [opened, synchronize, reopened] | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| jobs: | |
| review: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout PR head for review context | |
| uses: actions/checkout@v6 | |
| with: | |
| persist-credentials: false | |
| submodules: false | |
| lfs: false | |
| - name: Generate GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ secrets.CLAUDE_APP_ID }} | |
| private-key: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }} | |
| permission-contents: read | |
| permission-pull-requests: write | |
| - uses: anthropics/claude-code-action@v1 | |
| env: | |
| ANTHROPIC_BASE_URL: https://tokenhub.tencentmaas.com | |
| ANTHROPIC_MODEL: deepseek-v4-flash-202605 | |
| ANTHROPIC_SMALL_FAST_MODEL: deepseek-v4-flash-202605 | |
| CLAUDE_CODE_SCRIPT_CAPS: '{"gh.sh":3}' | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| github_token: ${{ steps.app-token.outputs.token }} | |
| allowed_non_write_users: "*" | |
| show_full_output: true | |
| classify_inline_comments: true | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| Review this pull request. Use `gh pr diff` / `gh pr view` for changes. | |
| The workspace is the base branch; do not assume PR files are checked out. | |
| Comment management requirements: | |
| - Use a single top-level sticky PR comment for this workflow. | |
| - Inline issues: use mcp__github_inline_comment__create_inline_comment | |
| (set confirmed: true for final review comments). | |
| - To publish the sticky top-level review, pass the full body through stdin: | |
| ./scripts/gh.sh pr review-comment ${{ github.event.pull_request.number }} --body-file - <<'EOF' | |
| <!-- cubesandbox-auto-review:start --> | |
| ...review body... | |
| <!-- cubesandbox-auto-review:end --> | |
| EOF | |
| - Wrap the review body with these exact hidden markers: | |
| <!-- cubesandbox-auto-review:start --> | |
| <!-- cubesandbox-auto-review:end --> | |
| - Do not call `gh pr comment` or `gh api` directly for top-level comments. | |
| - Mark the review as AI-generated; do not claim human approval. | |
| - Only post GitHub comments — don't submit review text as messages only. | |
| claude_args: | | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(./scripts/gh.sh pr review-comment:*)" | |
| --disallowedTools "Write,Edit,NotebookEdit,Agent,WebFetch,WebSearch" |