-
Notifications
You must be signed in to change notification settings - Fork 2
chore(ci): bring ClawReview 🦀 mascot + triage to beta #250
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
KrasimirKralev
merged 5 commits into
ID-Robots:beta
from
KrasimirKralev:chore/clawreview-beta-sync
Jul 5, 2026
Merged
Changes from all commits
Commits
Show all changes
5 commits
Select commit
Hold shift + click to select a range
11f1140
chore(ci): sync ClawReview + triage bots to beta
KrasimirKralev 10d332b
fix(ci): lazy-load the Anthropic SDK so the OAuth path needs no SDK
KrasimirKralev 01aea8c
feat(ci): reshape ClawReview into an informative mascot (not a reviewer)
KrasimirKralev c0edfae
fix(ci): apply CodeRabbit review — app-token if-guard + shared backend
KrasimirKralev 1a1a746
fix(ci): address CodeRabbit re-review — tolerant SDK parse + read-onl…
KrasimirKralev File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| name: ClawReview | ||
|
|
||
| # ClawBox's own PR bot 🦀 — structured advisory review + repo-policy checks + | ||
| # duplicate detection on every PR. Complements CodeRabbit. See | ||
| # scripts/pr-review.mjs. | ||
| # | ||
| # SECURITY: pull_request_target grants secret access on fork PRs, so this | ||
| # workflow must NEVER check out or execute PR code. The checkout below is the | ||
| # BASE repo (our trusted main); the PR is reviewed as data via the API diff. | ||
|
|
||
| on: | ||
| pull_request_target: | ||
| types: [opened, reopened, synchronize, ready_for_review] | ||
|
|
||
| # Empty default grant — only the job's explicit scopes apply. | ||
| permissions: {} | ||
|
|
||
| concurrency: | ||
| group: clawreview-${{ github.event.pull_request.number }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| review: | ||
| runs-on: ubuntu-latest | ||
| # Job-scoped so future jobs don't inherit write access. | ||
| permissions: | ||
| pull-requests: write | ||
| issues: write | ||
| contents: read | ||
| # Bot PRs (dependabot etc.) get CI + human review; ClawReview skips them. | ||
| # Drafts are skipped too (reviewed at ready_for_review) — no API spend | ||
| # while the author is still iterating. | ||
| if: ${{ !endsWith(github.event.pull_request.user.login, '[bot]') && !github.event.pull_request.draft }} | ||
| # Job-level so a step `if:` can read it — a step cannot see env it sets on | ||
| # itself. Gates the optional App-token step below. | ||
| env: | ||
| HAS_APP: ${{ secrets.CLAWREVIEW_APP_ID }} | ||
| steps: | ||
| - name: Checkout (base repo only — never the PR head) | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Setup Node | ||
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 | ||
| with: | ||
| node-version: 22 | ||
|
|
||
| - name: Install Claude backend | ||
| # Two transports, one wins at runtime (script picks by env): | ||
| # - CLAUDE_CODE_OAUTH_TOKEN set -> Claude Code CLI (subscription/OAuth, | ||
| # the team's preferred path; same runtime as claude-code-action) | ||
| # - else ANTHROPIC_API_KEY -> the SDK | ||
| # Install whichever backend the available secret needs; both pinned. | ||
| # Keep versions in sync with issue-triage.yml. | ||
| env: | ||
| HAS_OAUTH: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| run: | | ||
| if [ -n "$HAS_OAUTH" ]; then | ||
| npm install -g @anthropic-ai/claude-code@2.1.201 | ||
| else | ||
| npm install --prefix scripts --no-save @anthropic-ai/sdk@0.106.0 | ||
| fi | ||
|
|
||
| - name: Mint ClawReview app token | ||
| # Optional custom identity: when the ClawReview GitHub App is | ||
| # configured (CLAWREVIEW_APP_ID + CLAWREVIEW_APP_PRIVATE_KEY secrets), | ||
| # comments/labels post as clawreview[bot] with the crab avatar. | ||
| # Without the secrets this step skips and we fall back to | ||
| # github-actions[bot] — the bot works either way. | ||
| id: app-token | ||
| if: env.HAS_APP != '' | ||
| uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 | ||
| with: | ||
| app-id: ${{ secrets.CLAWREVIEW_APP_ID }} | ||
| private-key: ${{ secrets.CLAWREVIEW_APP_PRIVATE_KEY }} | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| # Scope the token to exactly what this bot needs (comments + labels), | ||
| # not the App's full installation grant. | ||
| permission-pull-requests: write | ||
| permission-issues: write | ||
|
|
||
| - name: Review with Claude | ||
| env: | ||
| CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| GH_TOKEN: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }} | ||
| run: node scripts/pr-review.mjs | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| // Shared Claude backend for the ClawBox CI bots (pr-review + issue-triage). | ||
| // One place for the two transports so a change to either stays in sync: | ||
| // - CLAUDE_CODE_OAUTH_TOKEN set -> Claude Code CLI (`claude -p`), the | ||
| // official Pro/Max subscription path (same runtime as claude-code-action) | ||
| // - else -> the Anthropic SDK (API key) | ||
| // The SDK is imported lazily so the OAuth-only install (CLI, no SDK) doesn't | ||
| // crash at module load. | ||
| import { execFileSync } from "node:child_process"; | ||
|
|
||
| // Extract a JSON object from possibly-fenced/wrapped model text. | ||
| export function parseModelJson(text) { | ||
| const stripped = text.replace(/^```(?:json)?\s*/m, "").replace(/```\s*$/m, "").trim(); | ||
| try { return JSON.parse(stripped); } catch { /* fall through */ } | ||
| const m = stripped.match(/\{[\s\S]*\}/); | ||
| if (!m) throw new Error("no JSON object in model response"); | ||
| return JSON.parse(m[0]); | ||
| } | ||
|
|
||
| function viaClaudeCli({ system, schema, userContent, model, timeoutMs, maxBuffer }) { | ||
| const prompt = [ | ||
| system, | ||
| "\nRespond with ONLY a JSON object matching this schema (no prose, no fences):", | ||
| JSON.stringify(schema), | ||
| "\n---\n", | ||
| userContent, | ||
| ].join("\n"); | ||
| const out = execFileSync("claude", ["-p", "--model", model, "--output-format", "json"], { | ||
| encoding: "utf8", | ||
| input: prompt, | ||
| stdio: ["pipe", "pipe", "inherit"], | ||
| timeout: timeoutMs, | ||
| maxBuffer, | ||
| }); | ||
| const wrapper = JSON.parse(out); | ||
| if (wrapper.is_error) throw new Error(`claude cli error: ${String(wrapper.result).slice(0, 200)}`); | ||
| return parseModelJson(String(wrapper.result)); | ||
| } | ||
|
|
||
| async function viaSdk({ system, schema, userContent, model, maxTokens }) { | ||
| const { default: Anthropic } = await import("@anthropic-ai/sdk"); | ||
| const client = new Anthropic(); // reads ANTHROPIC_API_KEY from env | ||
| const resp = await client.messages.create({ | ||
| model, | ||
| max_tokens: maxTokens, | ||
| system, | ||
| output_config: { format: { type: "json_schema", schema } }, | ||
| messages: [{ role: "user", content: userContent }], | ||
| }); | ||
| const text = resp.content.find((b) => b.type === "text")?.text; | ||
| // Throw rather than default to "{}" — an empty object downstream would create | ||
| // and apply labels literally named "undefined". Callers' outer catch exits 0. | ||
| if (!text) throw new Error("no text block in model response"); | ||
| // Tolerant parse (same as the CLI path) in case the model fences the JSON. | ||
| return parseModelJson(text); | ||
| } | ||
|
|
||
| // Run one structured-output call and return the validated JSON object. | ||
| // OAuth transport preferred; API-key SDK is the fallback. | ||
| export function callClaude(opts) { | ||
| if (process.env.CLAUDE_CODE_OAUTH_TOKEN) return viaClaudeCli(opts); | ||
| return viaSdk(opts); | ||
| } |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.