mirror of
https://github.com/hathach/tinyusb.git
synced 2026-08-18 11:02:16 +00:00
1ea04f7fe6
- claude.yml: gate @claude on author_association (OWNER/MEMBER/COLLABORATOR) so the write-scoped token and OAuth secret are never issued for an untrusted commenter on this public repo (defense-in-depth). - claude-code-review.yml: skip fork PRs in the job condition (head.repo.full_name == github.repository) since forks get no secrets and would only fail noisily; fix the misleading token comment; pass additional_permissions: actions: read so actions: read is effective. - hil SKILL.md: reword hostname guidance, use full test/hil/* paths, and show an explicit CONFIG= assignment so the local command is runnable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
49 lines
1.9 KiB
YAML
49 lines
1.9 KiB
YAML
name: Claude Code Review
|
|
|
|
on:
|
|
pull_request:
|
|
# opened/reopened/ready_for_review -> first auto review
|
|
# synchronize -> auto re-review on new pushes
|
|
#
|
|
# NOTE: pull_request (not _target) means fork PRs get a read-only GITHUB_TOKEN
|
|
# and NO repository secrets (CLAUDE_CODE_OAUTH_TOKEN), so they cannot be
|
|
# auto-reviewed. The job condition below skips them cleanly -> use @claude on
|
|
# those. Same-repo branches (yours or write-access contributors) auto-review.
|
|
types: [opened, synchronize, reopened, ready_for_review]
|
|
|
|
jobs:
|
|
claude-review:
|
|
# Skip drafts, and skip fork PRs (no secrets -> would only fail noisily)
|
|
if: >
|
|
github.event.pull_request.draft == false &&
|
|
github.event.pull_request.head.repo.full_name == github.repository
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: read
|
|
id-token: write
|
|
actions: read # Required for Claude to read CI results on PRs
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v6
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Run Claude Code Review
|
|
id: claude-review
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
|
# Pairs with the actions: read permission so Claude can read CI results
|
|
additional_permissions: |
|
|
actions: read
|
|
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
|
|
plugins: 'code-review@claude-code-plugins'
|
|
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
|
|
# Reuse one comment instead of posting a new one each push
|
|
use_sticky_comment: true
|
|
claude_args: '--max-turns 20'
|
|
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
|