Repository navigation
Add automated Claude PR review - #208
Merged
Merged
Conversation
Replaces the removed stock workflows (bf8fa56), which ran with pull-requests: read and never posted a comment. This one posts inline comments, auto-reviews same-repo PRs when opened or marked ready, and lets maintainers request a review on fork PRs with `@claude review`. The PR head is checked out read-only in pr-head/ so a fork cannot supply Claude settings or hooks. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
Comment on lines
+18
to
+20
| concurrency: | ||
| group: claude-review-${{ github.event.pull_request.number || github.event.issue.number }} | ||
| cancel-in-progress: true |
There was a problem hiding this comment.
Any PR comment cancels a review that is still running. Workflow-level concurrency applies before the job-level if runs. Every issue_comment on the PR (a human comment, a bot comment, or the review's own gh pr comment summary if it is posted with an app token) starts a run in the group claude-review-<N>, and cancel-in-progress: true cancels the review in progress. The new run is then skipped by the if. In practice, a comment posted during a review of up to 30 minutes stops it, often before any inline comments are posted.
Move the concurrency block into the review job. A job skipped by its if doesn't take a concurrency slot:
jobs:
review:
if: ...
concurrency:
group: claude-review-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: true
Comment on lines
+42
to
+45
| - name: Check out base branch (trusted) | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | ||
| with: | ||
| persist-credentials: false |
There was a problem hiding this comment.
This step doesn't check out the base branch on pull_request events. With no ref, actions/checkout uses github.sha. For pull_request that SHA is the test merge commit refs/pull/N/merge, which already contains the PR's changes. A run on this PR shows it: the workspace root HEAD is "Merge 9a39c9c… into 6c553bc…". So on automatic runs, Claude loads REVIEW.md, CLAUDE.md and .claude/ settings from the PR, not from trusted code. The header comment (lines 8-10) says the opposite.
Because the pull_request path only runs for same-repo branches, the practical risk is low. But the claim is wrong, and a PR can change the rules it is reviewed against. There is a second mismatch: on issue_comment, the default ref is the default branch (main), while PRs here target dev. So the REVIEW.md used there can differ from the one on the PR's base branch.
Suggested fix: pin the ref explicitly, e.g. ref: ${{ github.event.pull_request.base.sha || github.event.repository.default_branch }}. The issue_comment path could also resolve the PR's base ref with gh pr view first. Alternatively, correct the comment.
|
|
||
| ## Documentation | ||
|
|
||
| - `CHANGELOG.md` has an entry under the `dev` version with the PR number. |
There was a problem hiding this comment.
Missing CHANGELOG entry. This PR breaks the rule it adds: CHANGELOG.md has no #208 entry under v1.2.0dev. Earlier Claude workflow changes were logged (#150 added them, #160 removed them), so this re-addition should be logged too. For example, under Added: [#208](https://github.com/IntGenomicsLab/lrsomatic/pull/208) - Added automated Claude PR review (.github/workflows/claude-review.yml) and REVIEW.md (@ljwharbers).
|
Claude review: 3 findings. (1) Workflow-level |
ana-lu-rocha
pushed a commit
to ana-lu-rocha/lrsomatic
that referenced
this pull request
Oct 2, 2026
Same files as IntGenomicsLab#208 on dev. GitHub runs issue_comment workflows from the default branch, so the `@claude review` trigger needs this on main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds automated Claude PR review, replacing the stock workflows removed in bf8fa56. Those ran 13 times between March and April and never posted a comment, because the template set
pull-requests: readand never asked for comments..github/workflows/claude-review.yml@claude reviewon any PR, including fork PRs, which don't get secrets onpull_request.pr-head/, read-only. A fork PR therefore can't supply Claude settings, hooks or review rules. Claude's tools are limited to Read/Grep/Glob, the inline-comment tool andgh pr view/diff/comment.CLAUDE_CODE_OAUTH_TOKENsecret. The action is pinned by SHA (v1.0.236).REVIEW.md: lrsomatic-specific review checks drawn from past reviews:small-tag CI coverage gaps, snapshots undererrorStrategy 'ignore', CHM13 and custom-genome paths, container pairs, schema and docs. It also works as a guide for human reviewers.Things to know
main(Add Claude PR review workflow to main #209). claude-code-action refuses to run unless the PR's copy of the workflow is identical to the one on the default branch ("Workflow validation failed ... identical content to the version on the repository's default branch"). On top of that,issue_commentworkflows only run frommain. So this PR and Add Claude PR review workflow to main #209 are both skipped by design. After Add Claude PR review workflow to main #209 merges, every PR whoseclaude-review.ymlmatchesmaingets reviewed. Any future change to the workflow has to land onmain(viapatch) before it takes effect.Testing
PR checklist
🤖 Generated with Claude Code