feat: admit one envelope dissemination per signer and sign by binding #1161
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude PR Review | |
| # Automated review on PR open, a silent watchdog that only comments when | |
| # it finds actionable issues. On-demand help lives in claude-mentions.yml. | |
| on: | |
| pull_request_target: | |
| types: [opened, ready_for_review, reopened, labeled, unlabeled] | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| jobs: | |
| claude-pr-review: | |
| if: | | |
| !contains(github.event.pull_request.labels.*.name, 'no-claude-review') && | |
| ((github.event.action != 'labeled' && github.event.action != 'unlabeled') || | |
| (github.event.action == 'labeled' && github.event.label.name == 'claude-recheck') || | |
| (github.event.action == 'unlabeled' && github.event.label.name == 'no-claude-review' && contains(github.event.pull_request.labels.*.name, 'claude-recheck'))) | |
| name: claude-pr-review | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| id-token: write | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| actions: read | |
| steps: | |
| - name: Check if PR has no-claude-review label | |
| id: check-label | |
| run: | | |
| LABELS=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }} --jq '.labels[].name') | |
| if echo "$LABELS" | grep -q "no-claude-review"; then | |
| echo "has_no_review_label=true" >> $GITHUB_OUTPUT | |
| echo "⚠️ PR has 'no-claude-review' label. Skipping automated review." | |
| exit 0 | |
| else | |
| echo "has_no_review_label=false" >> $GITHUB_OUTPUT | |
| fi | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| - name: Check if PR author is org member | |
| id: check | |
| run: | | |
| PR_AUTHOR="${{ github.event.pull_request.author_association }}" | |
| # Check if user is org member or owner | |
| if [[ "$PR_AUTHOR" == "MEMBER" || "$PR_AUTHOR" == "OWNER" ]]; then | |
| echo "is_member=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "is_member=false" >> $GITHUB_OUTPUT | |
| echo "⚠️ PR author is not a member of sigp organization. Skipping automated review." | |
| exit 0 | |
| fi | |
| # Generate the app token before checkout so it can be used for | |
| # git operations. claude-code-action calls setupBranch() (which | |
| # fetches PR refs via `git fetch origin pull/N/head:...`) before | |
| # configureGitAuth(), so the token embedded in origin by | |
| # actions/checkout must already have permission to fetch fork | |
| # PR refs. | |
| - name: Generate GitHub App token | |
| if: steps.check.outputs.is_member == 'true' | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| with: | |
| app-id: ${{ vars.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| - name: Checkout repository | |
| if: steps.check.outputs.is_member == 'true' | |
| uses: actions/checkout@v6 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| # Fork PR checkout is gated on the is_member check above, | |
| # so only org members' code ever reaches this step. | |
| allow-unsafe-pr-checkout: true | |
| - name: Configure AWS Credentials (OIDC) | |
| if: steps.check.outputs.is_member == 'true' | |
| uses: aws-actions/configure-aws-credentials@v6 | |
| with: | |
| role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }} | |
| aws-region: us-west-2 | |
| - name: Read review prompt | |
| if: steps.check.outputs.is_member == 'true' | |
| id: review-prompt | |
| # Always load the prompt from the default branch (trusted source), | |
| # independent of whichever PR/fork ref was checked out above. | |
| # Keep this block in sync with .github/workflows/claude-mentions.yml. | |
| run: | | |
| { | |
| echo "content<<PROMPT_EOF" | |
| git fetch https://github.com/${{ github.repository }}.git ${{ github.event.repository.default_branch }} --depth=1 | |
| git show FETCH_HEAD:.github/prompts/review.md | |
| echo "PROMPT_EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| # Save the diff to a file the agent can page through with Read. | |
| # Reading it via `gh pr diff` wastes agent turns: large diffs | |
| # overflow the tool-output limit and the tight tool allowlist | |
| # blocks saving the output to a file. | |
| - name: Save PR diff | |
| if: steps.check.outputs.is_member == 'true' | |
| run: | | |
| gh pr diff ${{ github.event.pull_request.number }} --repo ${{ github.repository }} > "${GITHUB_WORKSPACE}/.claude-pr-diff.txt" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| - name: Run Claude Code Action | |
| if: steps.check.outputs.is_member == 'true' | |
| timeout-minutes: 25 | |
| env: | |
| ACTIONS_STEP_DEBUG: true | |
| uses: anthropics/claude-code-action@v1.0.127 | |
| with: | |
| github_token: ${{ steps.app-token.outputs.token }} | |
| use_bedrock: "true" | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| The full unified diff of this PR is saved at .claude-pr-diff.txt in | |
| the repository root. Read it with the Read tool (use offset/limit to | |
| page through large diffs) instead of running `gh pr diff`. | |
| You are an automated silent watchdog reviewer. Your job is to catch | |
| real problems — NOT to provide a comprehensive review or commentary. | |
| CRITICAL RULE: If you find NO actionable issues, do NOT post any | |
| PR comments or inline comments. Simply respond with: | |
| "No actionable issues found." | |
| and stop. Do not elaborate, summarize, or praise. | |
| ${{ steps.review-prompt.outputs.content }} | |
| claude_args: | | |
| --max-turns 80 | |
| --model us.anthropic.claude-opus-4-8 | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Read,Grep,Bash(git status:*),Bash(git diff:*),Bash(git show:*),Bash(git log:*),Bash(git rev-parse:*),Bash(git merge-base:*),Bash(git grep:*)" | |
| - name: Remove claude-recheck label if present | |
| if: steps.check.outputs.is_member == 'true' && github.event.action == 'labeled' && github.event.label.name == 'claude-recheck' | |
| run: | | |
| gh api repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/labels/claude-recheck -X DELETE || true | |
| env: | |
| GH_TOKEN: ${{ github.token }} |