Add DeepWork Review GitHub Action by Copilot · Pull Request #1 · Unsupervisedcom/deepwork-action

Copilot · 2026-04-08T19:12:53Z

Implements this repo as a working composite GitHub Action: runs Claude Code with the DeepWork plugin on a PR, applies all review-driven improvements autonomously, commits them back to the PR branch, and posts inline review comments explaining each change.

Action structure

action.yml — composite action; 7 steps covering plugin setup, review state caching, Claude run, commit/push, and comment posting
prompts/review.txt — CI-mode prompt: invokes /review, suppresses AskUserQuestion, applies all findings (not just "obvious" ones), and writes a structured change manifest to /tmp/deepwork_changes.json
scripts/post-review-comments.py — posts a single GitHub PR review with one inline comment per changed file; uses Claude's /tmp/deepwork_changes.json summary for descriptions, falls back to diff statistics
.github/workflows/example.yml — minimal caller workflow to copy; triggers on pull_request with types [opened, synchronize]

Key design decisions

anthropics/claude-code-base-action@beta — Claude Code is installed and run via the official Anthropic-managed action, which uses the curl-based installer (https://claude.ai/install.sh) rather than npm
Plugin installation via native plugin system — DeepWork is installed using claude plugin marketplace add + claude plugin install through the base action's plugin_marketplaces/plugins inputs, eliminating the need for sparse-cloning or manual MCP config manipulation
--dangerously-skip-permissions for fully non-interactive CI execution
Base-branch diff detection (origin/<base> → <base> → HEAD~1 fallback) for correctness on shallow clones
.deepwork/tmp cached per PR via actions/cache@v4 so already-passed reviews are not re-run on subsequent pushes to the same PR; uses a run_id-suffixed save key with a PR-scoped restore-keys prefix to always write a fresh entry while restoring the most recent prior state — THIS IS A MAJOR TOKEN COST SAVER!!!
Default model is claude-opus-4-6 for best review quality
Bot-identity loop prevention — the example workflow uses if: github.actor != 'deepwork-action[bot]' at the job level instead of a [skip ci] commit message suffix, so auto-fix commits can still trigger other CI workflows while the DeepWork review job itself never re-runs on its own commits
Trigger scoped to [opened, synchronize] — fires when a PR is first created and on every subsequent push to the PR branch (synchronize); reopened is omitted as it is rarely needed

Usage

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
    ref: ${{ github.event.pull_request.head.ref }}
    token: ${{ secrets.GITHUB_TOKEN }}

- uses: Unsupervisedcom/deepwork-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    github_token: ${{ secrets.GITHUB_TOKEN }}

Original prompt

This repo is a prebuilt github action that should run Claude Code on a PR and invoke https://github.com/Unsupervisedcom/deepwork/ in it (installed as a plugin) and run /review to trigger DeepWork reviews.

It needs to be instructed to make all changes that it thinks make sense for the context of the PR. Those changes should then be auto-committed onto the PR with comments added to each change afterwards (in the main file review context, not the single commit context) calling out the change so that it can be reviewed by the user.

- action.yml: composite action that installs Claude Code, uv, clones the deepwork plugin, runs /review in CI mode, commits all changes, and posts inline PR review comments - prompts/review.txt: CI-mode prompt (no AskUserQuestion, make all changes, write /tmp/deepwork_changes.json) - scripts/post-review-comments.py: posts GitHub PR review with one inline comment per changed file; falls back to diff stats if Claude's change summary is absent; uses base branch for robust diff detection - scripts/merge-mcp-config.py: safely merges deepwork MCP server entry into an existing .mcp.json (or creates one), backed up and restored - .github/workflows/example.yml: ready-to-copy example workflow - README.md: full usage docs, inputs table, prerequisites - .gitignore: exclude __pycache__ Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/012963c8-b297-4729-9b7b-26919e945901 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/012963c8-b297-4729-9b7b-26919e945901 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

action.yml

nhorton

@copilot - modify this PR so that it uses action caching to persist the .deepwork/tmp folder between runs for the same PR too. That will keep it from re-running the same review over and over.

action.yml

- Upgrade setup-node from v4/node-20 to v6/node-24 - Add actions/cache step to persist .deepwork/tmp across runs on the same PR, using a run-id suffix so the cache is always updated and restore-keys picks up the latest prior entry for the same PR number Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/1f9e2774-9151-4bc9-8826-569167d36ad3 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Copilot · 2026-04-08T21:41:42Z

@copilot - modify this PR so that it uses action caching to persist the .deepwork/tmp folder between runs for the same PR too. That will keep it from re-running the same review over and over.

Done in 654752c. Added an actions/cache@v4 step that persists .deepwork/tmp per PR. The key is deepwork-review-pr-<pr_number>-<run_id> so each run saves an updated entry, and restore-keys: deepwork-review-pr-<pr_number>- restores the most recent cache for that PR — meaning reviews that already passed won't re-run on subsequent pushes to the same PR.

nhorton

@copilot - address all the changes in this review and any other one-off comments

action.yml

README.md

… MCP config hack - Replace npm + sparse-clone + --plugin-dir approach with the official anthropics/claude-code-base-action@beta, which installs Claude Code via curl and handles plugin installation natively through its plugin_marketplaces and plugins inputs - Remove "Set up Node.js" step (no longer needed; base action manages it) - Remove "Install Claude Code CLI" step (base action installs via curl) - Remove "Clone deepwork Claude plugin" step; replaced by: plugin_marketplaces: https://github.com/Unsupervisedcom/deepwork.git plugins: deepwork@deepwork-plugins - Remove "Prepare MCP config" and "Restore MCP config" steps (proper plugin install handles MCP config automatically) - Delete scripts/merge-mcp-config.py (no longer needed) - Update README to reflect new architecture and mention caching Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/9b5cd224-5209-435a-b81f-b5a83cd55f8b Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Copilot · 2026-04-08T21:51:48Z

@copilot - address all the changes in this review and any other one-off comments

All review feedback addressed in bc66f07. Summary of changes:

Claude Code now installed via anthropics/claude-code-base-action@beta (curl-based, Anthropic-managed)
Plugin installed via native plugin_marketplaces/plugins inputs (deepwork@deepwork-plugins)
Removed --plugin-dir, MCP config manipulation steps, and scripts/merge-mcp-config.py
README updated

.github/workflows/example.yml

action.yml

README.md

nhorton

@copilot - address the review comments and the individual suggestions made before this review

nhorton · 2026-04-08T22:00:02Z

README.md

+- Claude Code is installed and run via the official [`anthropics/claude-code-base-action`](https://github.com/anthropics/claude-code-base-action).
+- The action runs with `--dangerously-skip-permissions` in a sandboxed GitHub Actions runner. It has no access to secrets beyond what you explicitly provide.
+- Auto-fix commits are signed with the `deepwork-action[bot]` identity.
+- The `[skip ci]` suffix on the default commit message prevents the action from triggering itself recursively.


This seems not ideal. Triggering other CI actions from the changes would make sense, and this name is confusing.

Can we instead skip commits that are signed by the deepwork-action[bot]` identity?

Done in f1a5126. Removed [skip ci] from the default commit_message. The example workflow (and the README usage snippet) now include if: github.actor != 'deepwork-action[bot]' at the job level, so the workflow simply never starts when the push was made by the bot identity — no magic commit message required.

.github/workflows/example.yml

…guard - Change default model to claude-opus-4-6 in action.yml, README, and example.yml - Remove [skip ci] from default commit_message; instead add `if: github.actor != 'deepwork-action[bot]'` guard to example workflow job so the action never re-triggers on its own commits - Add "THIS IS A MAJOR TOKEN COST SAVER!!!" to README caching section - Update README security section to describe the bot-identity approach Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/799d7276-12e1-4540-9650-c480b0a44b83 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Copilot · 2026-04-08T22:05:17Z

@copilot - address the review comments and the individual suggestions made before this review

All addressed in f1a5126:

Default model → claude-opus-4-6 (action.yml, README, example.yml)
[skip ci] → replaced with if: github.actor != 'deepwork-action[bot]' job guard
README caching section updated with the token-cost note
README security section updated to document the bot-identity approach

nhorton

@copilot

nhorton · 2026-04-08T22:12:37Z

.github/workflows/example.yml

+  pull_request:
+    types: [opened, synchronize, reopened]


I don't think this it the right thing to run on. Shouldn't this run on push and not opened and such?

In GitHub Actions, pull_request + synchronize is the "run on push to a PR branch" event — using bare push would lose all the PR context (github.event.pull_request.number, base.ref, etc.) that the action needs for caching, checkout, and posting review comments.

Simplified the types to [opened, synchronize] (dropped reopened) in 1290b16 — synchronize fires on every push to the PR branch, and opened handles the initial PR creation.

…ronize Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/bfca66ea-ca2d-447c-a7d7-f829f2ee6ad4 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Capture the full investigation of the DeepWork plugin MCP server failing to start inside anthropics/claude-code-action@v1, including: - Symptom (plugin install reports success; mcp_servers init payload reports plugin:deepwork:deepwork status: failed; silent, no error message; same plugin works fine outside CI). - Why slash commands still work (/review is a skill file, no MCP needed) vs. what's missing (get_configured_reviews, mark_review_as_passed, start_workflow, DeepSchema validation, the workflow state machine). - Root-cause hypotheses ranked by probability: 1. 70% — PR file restoration wipes plugin MCP registration 2. 60% — No automatic plugin → session MCP merge path 3. 30% — MCP_TIMEOUT/MCP_TOOL_TIMEOUT empty env vars - Three open upstream issues that match our exact symptoms: - anthropics/claude-code-action#813 (silent MCP failures) - anthropics/claude-code-action#1004 (--mcp-config silently dropped) - anthropics/claude-code-action#95 (no plugin → session MCP merge path) - Definitive diagnostic experiment to confirm root cause #1. - Speculative fix logic for the .claude/settings.json file added in the rule-5 reversal commit (enables plugin at project scope; only effective for PRs opened after the file lands on main, because PR file restoration pulls from origin/main). - BLOCKING status: PR parked as draft until upstream fixes land. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Initial plan

4b26b33

Copilot AI assigned Copilot and nhorton Apr 8, 2026

Copilot started work on behalf of nhorton April 8, 2026 19:12 View session

Copilot AI and others added 2 commits April 8, 2026 19:44

Remove accidentally committed __pycache__ files

5c3552d

Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/012963c8-b297-4729-9b7b-26919e945901 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add auto-commit functionality for PR review changes~~ Add DeepWork Review GitHub Action Apr 8, 2026

Copilot finished work on behalf of nhorton April 8, 2026 19:45

Copilot AI requested a review from nhorton April 8, 2026 19:45

nhorton reviewed Apr 8, 2026

View reviewed changes

action.yml Outdated Show resolved Hide resolved

nhorton reviewed Apr 8, 2026

View reviewed changes

Copilot started work on behalf of nhorton April 8, 2026 21:39 View session

nhorton reviewed Apr 8, 2026

View reviewed changes

action.yml Outdated Show resolved Hide resolved

Copilot finished work on behalf of nhorton April 8, 2026 21:42

Copilot AI requested a review from nhorton April 8, 2026 21:42

nhorton requested changes Apr 8, 2026

View reviewed changes

action.yml Outdated Show resolved Hide resolved

action.yml Outdated Show resolved Hide resolved

action.yml Outdated Show resolved Hide resolved

README.md Show resolved Hide resolved

Copilot started work on behalf of nhorton April 8, 2026 21:43 View session

Copilot finished work on behalf of nhorton April 8, 2026 21:52

Copilot AI requested a review from nhorton April 8, 2026 21:52

nhorton reviewed Apr 8, 2026

View reviewed changes

.github/workflows/example.yml Show resolved Hide resolved

Apply suggestion from @nhorton

c682810

nhorton reviewed Apr 8, 2026

View reviewed changes

action.yml Outdated Show resolved Hide resolved

nhorton reviewed Apr 8, 2026

View reviewed changes

README.md Outdated Show resolved Hide resolved

nhorton reviewed Apr 8, 2026

View reviewed changes

README.md Outdated Show resolved Hide resolved

nhorton requested changes Apr 8, 2026

View reviewed changes

Copilot started work on behalf of nhorton April 8, 2026 22:02 View session

Copilot finished work on behalf of nhorton April 8, 2026 22:06

Copilot AI requested a review from nhorton April 8, 2026 22:06

nhorton requested changes Apr 8, 2026

View reviewed changes

Copilot started work on behalf of nhorton April 8, 2026 22:13 View session

Simplify pull_request trigger types: drop reopened, keep opened+synch…

1290b16

…ronize Agent-Logs-Url: https://github.com/Unsupervisedcom/deepwork-action/sessions/bfca66ea-ca2d-447c-a7d7-f829f2ee6ad4 Co-authored-by: nhorton <204146+nhorton@users.noreply.github.com>

Copilot finished work on behalf of nhorton April 8, 2026 22:16

Copilot AI requested a review from nhorton April 8, 2026 22:16

nhorton marked this pull request as ready for review April 8, 2026 22:43

nhorton merged commit 53ca21a into main Apr 8, 2026
1 check failed

Conversation

Copilot AI commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Action structure

Key design decisions

Usage

Uh oh!

Uh oh!

nhorton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI commented Apr 8, 2026

Uh oh!

nhorton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 8, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nhorton left a comment

Choose a reason for hiding this comment

Uh oh!

nhorton Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI commented Apr 8, 2026

Uh oh!

nhorton left a comment

Choose a reason for hiding this comment

Uh oh!

nhorton Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Apr 8, 2026 •

edited

Loading