feat: enable Claude PR review#280
Merged
Merged
Conversation
crowecawcaw
force-pushed
the
feature/enable-claude-pr-review
branch
from
June 12, 2026 22:19
bc7bdc5 to
23312bb
Compare
leongdl
approved these changes
Jun 25, 2026
crowecawcaw
enabled auto-merge (squash)
June 25, 2026 22:33
jericht
approved these changes
Jul 8, 2026
jericht
force-pushed
the
feature/enable-claude-pr-review
branch
from
July 8, 2026 22:02
ab9eacf to
6781f77
Compare
Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
epmog
force-pushed
the
feature/enable-claude-pr-review
branch
from
July 9, 2026 21:04
6781f77 to
ef87a53
Compare
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enables the automated, advisory Claude PR-review integration in this repository, matching what is already enabled across the AWS Deadline Cloud repos (e.g. aws-deadline/deadline-cloud (#1195)).
What this adds
Two thin caller workflows under
.github/workflows/:claude_pr_review_collect.yml— Stage 1. Runs onpull_request(opened, synchronize). It does no work and records nothing; it exists only so its completion fires theworkflow_runevent that starts the review stage. It produces no data the review stage trusts.claude_pr_review.yml— Stage 2. Triggered by the collect workflow's completion viaworkflow_run, so GitHub runs it from the default branch with this repo's secrets — a fork PR cannot alter the review behavior, permissions, or credential setup. Derives the PR number, head SHA, and base SHA from the server-populatedworkflow_runpayload (which a fork cannot forge).All the actual review logic — Bedrock authentication, the SHA-pinned action, the restricted read-only tool surface, the read-only PR-head checkout, and per-run turn/token/time limits — lives in the shared reusable workflow at
aws-deadline/.github/.github/workflows/reusable_claude_pr_review.yml@mainline. These files are thin callers that forward theworkflow_runidentifiers and theAWS_CLAUDE_PR_REVIEW_ROLEsecret.Prerequisite
The
AWS_CLAUDE_PR_REVIEW_ROLEsecret (the OIDC role that can mint a Bedrock bearer token) must be configured for this repository for the review stage to run.