ci: add the Claude PR review - #67
Open
ezekiel-alexrod wants to merge 1 commit into
Open
Conversation
Calls the shared review workflows from `scality/workflows`, pinned by digest: `claude-code-review` on human pull requests, `claude-code-dependency-review` on Renovate branches through `pull_request_target` so the bump job gets the secrets it needs. `ACTIONS_APP_PRIVATE_KEY` is passed explicitly — a reusable workflow inherits no secret, and without that key the shared workflow skips the agent-hub marketplace, the `scality-skills` plugin never loads and the review silently does nothing. The skill reads its criteria from `.claude/REVIEW.md`, added here: what this repo is, the invariants worth failing a review over, and the findings the linters already own.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This repo had no Claude review. It adds the two shared callers from
scality/workflowspinned by digest (v2.9.1):claude-code-reviewon humanpull requests, and
claude-code-dependency-reviewon Renovate branches throughpull_request_targetso the bump job gets the secrets it needs.ACTIONS_APP_PRIVATE_KEYis passed explicitly to both jobs. A reusable workflowinherits no secret, and without that key the shared workflow skips the agent-hub
marketplace, the
scality-skillsplugin never loads, and the review runs for a fewseconds and posts nothing. Every other repo in the fleet had that gap; it is being
fixed in parallel.
The skill reads its criteria from
.claude/REVIEW.md, added here and written fromthis codebase rather than from a template: CRL freshness through a
RequeueAfterderived fromnextUpdate, the revoked-serial set surviving regeneration,IssuerversusClusterIssuerscoping, and CA private keys never logged or copied out of their Secret. The file also lists what notto flag, so the review stays off ground the linters already cover.
The organisation secrets and the
ACTIONS_APP_IDvariable are already granted tothis repo, so nothing else is needed.
Note: this PR creates
review.yml, andclaude-code-actionrefuses to run when thecalling workflow differs from the default branch. So it cannot review itself — the
first real review will be the next PR. Validated end to end on
scality/image-cache#7, where the check run was posted and the criteria file was read.