Add Claude review workflow (0xsequence#1001)#560
Merged
Conversation
|
|
Reviewer's GuideIntroduces a Claude Code GitHub Actions workflow for AI-assisted code reviews and issue handling, updates Next.js to 15.5.16 in docs and web packages, and relaxes the pnpm minimum release age from two weeks to one week with corresponding lockfile updates. Sequence diagram for the new Claude Code GitHub Actions workflowsequenceDiagram
actor Developer
participant GitHub
participant ClaudeWorkflow as Claude_Code_workflow
participant ClaudeAction as anthropics_claude_code_action_v1
participant AnthropicAPI
Developer->>GitHub: issue_comment / review / issue with @claude
GitHub->>ClaudeWorkflow: issue_comment / pull_request_review / issues event
ClaudeWorkflow->>ClaudeWorkflow: evaluate if condition
ClaudeWorkflow->>ClaudeAction: run anthropics/claude-code-action@v1
ClaudeAction->>AnthropicAPI: call Claude using anthropic_api_key
AnthropicAPI-->>ClaudeAction: review / suggestions
ClaudeAction-->>GitHub: update PR / issue via GitHub API
GitHub-->>Developer: updated comments / reviews from Claude
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The
minimumReleaseAgechange inpnpm-workspace.yamlcontradicts the existing comment# DO NOT REMOVE OR MODIFY ... without approval; if this adjustment is intentional, consider updating the comment or referencing the approval to avoid confusion for future maintainers. - The Claude workflow currently listens to multiple events (
issue_comment,pull_request_review_comment,issues,pull_request_review) and checks for@claudein several places; you may want to narrow or centralize the trigger conditions (for example, only comments) to reduce accidental invocations and simplify theifexpression.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `minimumReleaseAge` change in `pnpm-workspace.yaml` contradicts the existing comment `# DO NOT REMOVE OR MODIFY ... without approval`; if this adjustment is intentional, consider updating the comment or referencing the approval to avoid confusion for future maintainers.
- The Claude workflow currently listens to multiple events (`issue_comment`, `pull_request_review_comment`, `issues`, `pull_request_review`) and checks for `@claude` in several places; you may want to narrow or centralize the trigger conditions (for example, only comments) to reduce accidental invocations and simplify the `if` expression.
## Individual Comments
### Comment 1
<location path=".github/workflows/claude.yml" line_range="33-35" />
<code_context>
+ with:
+ fetch-depth: 1
+
+ - name: Run Claude Code
+ id: claude
+ uses: anthropics/claude-code-action@v1
+ with:
+ anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY_GITHUB_ACTIONS }}
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Pin the GitHub Action to a specific commit SHA instead of a floating major tag to reduce supply-chain risk.
Using a floating tag like `@v1` means future (including potentially breaking or compromised) changes are picked up automatically. For security-sensitive workflows, especially those with PR/issue access, reference a specific commit SHA instead (e.g., `anthropics/claude-code-action@<commit-sha>`) and update it deliberately when you want to adopt changes.
Suggested implementation:
```
- name: Run Claude Code
id: claude
# Pin to a specific commit SHA to avoid floating tags and reduce supply-chain risk
# Replace <commit-sha> with a vetted commit from https://github.com/anthropics/claude-code-action/commits/main
uses: anthropics/claude-code-action@<commit-sha>
with:
```
1. Go to https://github.com/anthropics/claude-code-action/commits/main and copy the full commit SHA of the version you want to pin.
2. Replace `<commit-sha>` in the `uses: anthropics/claude-code-action@<commit-sha>` line with that exact SHA (e.g., `uses: anthropics/claude-code-action@abcdef1234567890...`).
3. Optionally add a comment noting the pinned version (e.g., tag or date) to make future updates easier.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the next dependency from version 15.5.15 to 15.5.16 across the documentation and web packages, with the lockfile resolving to 15.5.18. It also adds libc platform metadata to several packages in the lockfile. A critical feedback point was raised regarding the modification of minimumReleaseAge in pnpm-workspace.yaml, which reduces the safety buffer for new package releases and violates the stated project policy against modifying this setting without explicit approval.
| @@ -1,4 +1,4 @@ | |||
| minimumReleaseAge: 20160 # 60 * 24 * 7 * 2 = do not install package releases that are not at least 2 weeks old | |||
| minimumReleaseAge: 10080 # 60 * 24 * 7 = do not install package releases that are not at least 1 week old | |||
There was a problem hiding this comment.
The modification of minimumReleaseAge from 2 weeks to 1 week violates the project policy stated on line 2, which explicitly forbids changes to this setting without approval. Reducing this value decreases the safety buffer against potentially malicious or broken recent package releases. This configuration should only be adjusted with explicit approval from the appropriate stakeholders.
minimumReleaseAge: 20160 # 60 * 24 * 7 * 2 = do not install package releases that are not at least 2 weeks old
This was referenced May 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by Sourcery
Integrate Claude Code as a GitHub workflow and adjust dependency and workspace configuration.
New Features:
Build:
CI: