Conversation
Two new workflows: - claude-review.yml: Auto-reviews non-draft PRs and responds to @claude mentions, focused on significant concerns (bugs, security, architecture) - pr-overview.yml: Generates structured PR summaries with walkthrough, change table, and review notes Both use the existing review skill and CLAUDE.md conventions as reference. Requires ANTHROPIC_API_KEY, CLAUDE_APP_ID, and CLAUDE_APP_PRIVATE_KEY secrets. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughTwo new GitHub Actions workflows are added for automated PR analysis using Claude. The first workflow ( Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/claude-review.yml (1)
6-9: Consider rate limiting or author restrictions for comment triggers.The workflow triggers on any comment containing
@claude, including from external contributors. While GitHub Actions secrets aren't exposed to fork PRs by default, this could still:
- Consume API quota if many users trigger it
- Allow anyone to invoke Claude on public PRs
Consider adding an author check (e.g.,
github.event.comment.author_associationin['MEMBER', 'OWNER', 'COLLABORATOR']) if you want to restrict who can trigger Claude via comments.Example author restriction
(github.event_name == 'issue_comment' && github.event.issue.pull_request && - contains(github.event.comment.body, '@claude')) || + contains(github.event.comment.body, '@claude') && + contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.comment.author_association)) || (github.event_name == 'pull_request_review_comment' && - contains(github.event.comment.body, '@claude')) + contains(github.event.comment.body, '@claude') && + contains(fromJSON('["MEMBER", "OWNER", "COLLABORATOR"]'), github.event.comment.author_association))🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/claude-review.yml around lines 6 - 9, The workflow currently triggers on issue_comment and pull_request_review_comment for any created comment; restrict execution by checking github.event.comment.author_association before running jobs. Update the workflow jobs to include an if condition that allows only trusted associations (e.g., github.event.comment.author_association in ['MEMBER','OWNER','COLLABORATOR']), or implement an equivalent step that exits early when github.event.comment.author_association is not in the allowed set, so only authorized users can trigger the Claude comment handlers..github/workflows/pr-overview.yml (1)
3-5: Both workflows trigger simultaneously on the same PR events.This workflow and
claude-review.ymlboth trigger onpull_request: [opened, reopened, ready_for_review]. When a PR is opened or marked ready, both workflows will run concurrently, potentially posting two separate Claude comments (one overview, one review).If this is intentional, consider adding a brief delay or coordination mechanism to avoid flooding the PR with simultaneous bot comments. If not intentional, consider differentiating triggers or consolidating into a single workflow.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/pr-overview.yml around lines 3 - 5, The PR overview workflow is configured with the same pull_request trigger (types: [opened, reopened, ready_for_review]) as claude-review.yml, causing both workflows to run concurrently; update the on: pull_request block in pr-overview.yml (the line with types: [opened, reopened, ready_for_review]) to avoid overlap—either narrow the event types (e.g., only opened), add a distinguishing condition (if: github.event.pull_request.draft == false or check a label), or sequence the runs using workflow_run or GitHub Actions concurrency/cancel-in-progress so only one Claude comment posts at a time.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/claude-review.yml:
- Around line 6-9: The workflow currently triggers on issue_comment and
pull_request_review_comment for any created comment; restrict execution by
checking github.event.comment.author_association before running jobs. Update the
workflow jobs to include an if condition that allows only trusted associations
(e.g., github.event.comment.author_association in
['MEMBER','OWNER','COLLABORATOR']), or implement an equivalent step that exits
early when github.event.comment.author_association is not in the allowed set, so
only authorized users can trigger the Claude comment handlers.
In @.github/workflows/pr-overview.yml:
- Around line 3-5: The PR overview workflow is configured with the same
pull_request trigger (types: [opened, reopened, ready_for_review]) as
claude-review.yml, causing both workflows to run concurrently; update the on:
pull_request block in pr-overview.yml (the line with types: [opened, reopened,
ready_for_review]) to avoid overlap—either narrow the event types (e.g., only
opened), add a distinguishing condition (if: github.event.pull_request.draft ==
false or check a label), or sequence the runs using workflow_run or GitHub
Actions concurrency/cancel-in-progress so only one Claude comment posts at a
time.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
Run ID: a7a7cf16-54f1-4e1a-8d5a-17b1db84f4fe
📒 Files selected for processing (2)
.github/workflows/claude-review.yml.github/workflows/pr-overview.yml
1 participant
Summary
claude-review.yml— auto-reviews non-draft PRs on open/reopen/ready_for_review, and responds to@claudementions in PR comments. Focused on significant concerns (bugs, security, architecture) rather than nitpicks.pr-overview.yml— generates a structured PR summary (walkthrough, changes table, review notes) on non-draft PRs.Both leverage the existing review skill (
.claude/skills/ably-review/SKILL.md) and project conventions (CLAUDE.md) as reference material.Setup required
Three secrets need to be configured in GitHub repo settings (Settings > Secrets and variables > Actions):
ANTHROPIC_API_KEY— Anthropic API key for ClaudeCLAUDE_APP_ID— GitHub App IDCLAUDE_APP_PRIVATE_KEY— GitHub App private keyTest plan
@claudemention in a PR comment triggers a response🤖 Generated with Claude Code
Summary by CodeRabbit
Release Notes