BitGoJS/.github/workflows/claude-pr.yml at master · BitGo/BitGoJS · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: Claude PR

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]

jobs:
  claude-pr:
    if: |
      (
        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'issues' && contains(github.event.issue.body, '@claude'))
      ) && (
        github.event.comment.author_association == 'OWNER' ||
        github.event.comment.author_association == 'MEMBER'
      )
    runs-on: ubuntu-latest
    timeout-minutes: 10
    env:
      AWS_REGION: us-west-2
      AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
      AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      AWS_SESSION_TOKEN: ${{ secrets.AWS_SESSION_TOKEN }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v6

      - name: Configure AWS Credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::199765120567:role/${{ github.event.repository.name }}-iam-protected
          aws-region: us-west-2

      - name: Assume inference role
        id: inference-role
        run: |
          CREDS="$(aws sts assume-role \
            --role-arn arn:aws:iam::168000258654:role/BedrockInferenceRole \
            --role-session-name claude-inference-session \
            --query 'Credentials' \
            --output json)"

          AWS_ACCESS_KEY_ID="$(echo "$CREDS" | jq -r '.AccessKeyId')"
          AWS_SECRET_ACCESS_KEY="$(echo "$CREDS" | jq -r '.SecretAccessKey')"
          AWS_SESSION_TOKEN="$(echo "$CREDS" | jq -r '.SessionToken')"

          echo "::add-mask::$AWS_SECRET_ACCESS_KEY"
          { echo "aws-access-key-id=$AWS_ACCESS_KEY_ID"; echo "aws-secret-access-key=$AWS_SECRET_ACCESS_KEY"; echo "aws-session-token=$AWS_SESSION_TOKEN"; } >> "$GITHUB_OUTPUT"

      - name: Determine prompt to use
        id: determine-prompt
        env:
          COMMENT_BODY: ${{ github.event.comment.body }}
        run: |
          # Safely trim whitespace and check if it's just @claude
          TRIMMED_COMMENT=$(echo "$COMMENT_BODY" | xargs)

          if [ "$TRIMMED_COMMENT" = "@claude" ]; then
            echo "use-code-review-prompt=true" >> "$GITHUB_OUTPUT"
          else
            echo "use-code-review-prompt=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Read code review prompt
        id: read-prompt
        if: steps.determine-prompt.outputs.use-code-review-prompt == 'true'
        run: |
          PROMPT_CONTENT=$(cat .github/prompts/code-review.md)
          {
            echo "prompt-content<<EOF"
            echo "$PROMPT_CONTENT"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - uses: anthropics/claude-code-action@8d70a0dd265122bd65b8e09d3d959e65373ae2a1 # v1.0.260
        if: steps.determine-prompt.outputs.use-code-review-prompt == 'true'
        env:
          ANTHROPIC_MODEL: arn:aws:bedrock:us-west-2:168000258654:inference-profile/global.anthropic.claude-sonnet-5-5
          AWS_REGION: us-west-2
          AWS_ACCESS_KEY_ID: ${{ steps.inference-role.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.inference-role.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.inference-role.outputs.aws-session-token }}
          MAX_THINKING_TOKENS: '0'
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          use_bedrock: 'true'
          claude_args: --allowed-tools 'Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)'
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}

            Read this pull request with `gh pr view ${{ github.event.issue.number || github.event.pull_request.number }} --repo ${{ github.repository }}`
            and `gh pr diff ${{ github.event.issue.number || github.event.pull_request.number }} --repo ${{ github.repository }}`.
            Post the final review to the same pull request with `gh pr comment ${{ github.event.issue.number || github.event.pull_request.number }} --repo ${{ github.repository }}`.

            ${{ steps.read-prompt.outputs.prompt-content }}

      - uses: anthropics/claude-code-action@8d70a0dd265122bd65b8e09d3d959e65373ae2a1 # v1.0.260
        if: steps.determine-prompt.outputs.use-code-review-prompt == 'false'
        env:
          ANTHROPIC_MODEL: arn:aws:bedrock:us-west-2:168000258654:inference-profile/global.anthropic.claude-sonnet-5-5
          AWS_REGION: us-west-2
          AWS_ACCESS_KEY_ID: ${{ steps.inference-role.outputs.aws-access-key-id }}
          AWS_SECRET_ACCESS_KEY: ${{ steps.inference-role.outputs.aws-secret-access-key }}
          AWS_SESSION_TOKEN: ${{ steps.inference-role.outputs.aws-session-token }}
          MAX_THINKING_TOKENS: '0'
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          use_bedrock: 'true'