Skip to content

Commit a3b6a96

Browse files
xxmplusxxmplus
committed
github: enable claude code review bot as an opt-in GH action
PRs with O-AI-Review label would get AI review
1 parent df7e1fc commit a3b6a96

File tree

1 file changed

+250
-0
lines changed

1 file changed

+250
-0
lines changed

‎.github/workflows/pr-analyzer-threestage.yml‎

Lines changed: 250 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,250 @@
1+
name: Claude Code PR Review
2+
3+
on:
4+
pull_request_target:
5+
types: [synchronize, ready_for_review, reopened]
6+
7+
jobs:
8+
claude-code-pr-review:
9+
runs-on: ubuntu-latest
10+
timeout-minutes: 60
11+
if: contains(github.event.pull_request.labels.*.name, 'O-AI-Review')
12+
permissions:
13+
contents: read
14+
pull-requests: write
15+
id-token: write
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v5
19+
with:
20+
ref: ${{ github.event.pull_request.head.sha || github.ref }}
21+
fetch-depth: 1
22+
23+
- name: Authenticate to Google Cloud
24+
uses: 'google-github-actions/auth@v3'
25+
with:
26+
project_id: 'vertex-model-runners'
27+
service_account: 'ai-review@dev-inf-prod.iam.gserviceaccount.com'
28+
workload_identity_provider: 'projects/72497726731/locations/global/workloadIdentityPools/ai-review/providers/ai-review'
29+
30+
- name: Stage 1 - Initial Bug Screening
31+
id: stage1
32+
uses: cockroachdb/claude-code-action@v1
33+
env:
34+
ANTHROPIC_VERTEX_PROJECT_ID: vertex-model-runners
35+
CLOUD_ML_REGION: global
36+
with:
37+
github_token: ${{ secrets.GITHUB_TOKEN }}
38+
use_vertex: "true"
39+
claude_args: |
40+
--model claude-sonnet-4-5@20250929
41+
--allowedTools "Read,Grep,Glob,Bash(gh pr diff:*),Bash(gh pr view:*)"
42+
prompt: |
43+
REPO: ${{ github.repository }}
44+
PR NUMBER: ${{ github.event.pull_request.number }}
45+
46+
Examine each line of code in this PR for potential bugs that could negatively impact
47+
CockroachDB and Pebble users. Focus on:
48+
- Basic logic errors
49+
- Obvious security vulnerabilities
50+
- Clear error handling problems
51+
- Type safety issues
52+
53+
When performing your analysis, be conservative but thorough. You should think:
54+
"would I be willing to go to jail if my analysis is incorrect?"
55+
56+
**CRITICAL**: You must respond with EXACTLY one of these formats:
57+
1. 'POTENTIAL_BUG_DETECTED - [brief description]' if you find a definite bug
58+
2. 'NO_BUG_FOUND' if no obvious bugs are found
59+
60+
If you detect bugs, clearly explain what you found and why it's problematic.
61+
62+
**OUTPUT REQUIREMENT**: End your response with a single line containing only:
63+
- `STAGE1_RESULT - POTENTIAL_BUG_DETECTED` or
64+
- `STAGE1_RESULT - NO_BUG_FOUND`
65+
66+
- name: Extract Stage 1 Result
67+
id: stage1_result
68+
if: steps.stage1.conclusion == 'success'
69+
run: |
70+
RESULT=$(jq -r '.[] | select(.type == "result") | .result' "${{ steps.stage1.outputs.execution_file }}")
71+
{
72+
echo 'result<<EOF'
73+
echo "$RESULT"
74+
echo 'EOF'
75+
} >> "$GITHUB_OUTPUT"
76+
echo "Stage 1 result extracted (${#RESULT} characters)"
77+
78+
- name: Stage 2 - Database Expert Review
79+
id: stage2
80+
if: contains(steps.stage1_result.outputs.result, 'STAGE1_RESULT - POTENTIAL_BUG_DETECTED')
81+
uses: cockroachdb/claude-code-action@v1
82+
env:
83+
ANTHROPIC_VERTEX_PROJECT_ID: vertex-model-runners
84+
CLOUD_ML_REGION: global
85+
with:
86+
github_token: ${{ secrets.GITHUB_TOKEN }}
87+
use_vertex: "true"
88+
claude_args: |
89+
--model claude-sonnet-4-5@20250929
90+
--allowedTools "Read,Grep,Glob,Bash(gh pr diff:*),Bash(gh pr view:*)"
91+
prompt: |
92+
REPO: ${{ github.repository }}
93+
PR NUMBER: ${{ github.event.pull_request.number }}
94+
95+
You are a database systems expert providing a second opinion. Stage 1 analysis
96+
found potential issues. Your job is to confirm or reject those findings.
97+
98+
**Stage 1 Results**:
99+
${{ steps.stage1_result.outputs.result }}
100+
101+
Review the Stage 1 findings and perform your own analysis. Do not identify
102+
new bugs unless they're glaringly obvious.
103+
104+
Be very thorough and conservative. Ask yourself: "would I risk losing my job
105+
over falsely identifying a bug?" If there's doubt, err on the side of
106+
NO_BUG_DETECTED.
107+
108+
**CRITICAL**: You must respond with EXACTLY one of these formats:
109+
1. 'POTENTIAL_BUG_DETECTED - [detailed description of confirmed bugs]'
110+
2. 'NO_BUG_FOUND' if bugs are not confirmed
111+
112+
**OUTPUT REQUIREMENT**: End your response with a single line containing only:
113+
- `STAGE2_RESULT - POTENTIAL_BUG_DETECTED [detailed description of confirmed bugs]` or
114+
- `STAGE2_RESULT - NO_BUG_FOUND`
115+
116+
- name: Extract Stage 2 Result
117+
id: stage2_result
118+
if: steps.stage2.conclusion == 'success'
119+
run: |
120+
RESULT=$(jq -r '.[] | select(.type == "result") | .result' "${{ steps.stage2.outputs.execution_file }}")
121+
{
122+
echo 'result<<EOF'
123+
echo "$RESULT"
124+
echo 'EOF'
125+
} >> "$GITHUB_OUTPUT"
126+
echo "Stage 2 result extracted (${#RESULT} characters)"
127+
128+
- name: Stage 3 - Principal Engineer Final Review
129+
id: stage3
130+
if: contains(steps.stage2_result.outputs.result, 'STAGE2_RESULT - POTENTIAL_BUG_DETECTED')
131+
uses: cockroachdb/claude-code-action@v1
132+
env:
133+
ANTHROPIC_VERTEX_PROJECT_ID: vertex-model-runners
134+
CLOUD_ML_REGION: global
135+
with:
136+
github_token: ${{ secrets.GITHUB_TOKEN }}
137+
use_vertex: "true"
138+
claude_args: |
139+
--model claude-sonnet-4-5@20250929
140+
--allowedTools "Read,Grep,Glob,Bash(gh pr diff:*),Bash(gh pr view:*)"
141+
prompt: |
142+
REPO: ${{ github.repository }}
143+
PR NUMBER: ${{ github.event.pull_request.number }}
144+
145+
You are a principal engineer performing the final, most critical analysis.
146+
Two previous stages have found potential issues that need final validation.
147+
148+
**Stage 1 Results**:
149+
${{ steps.stage1_result.outputs.result }}
150+
151+
**Stage 2 Results**:
152+
${{ steps.stage2_result.outputs.result }}
153+
154+
This is the final gate before flagging this PR as having critical bugs.
155+
Only confirm bugs that could cause:
156+
- Data loss or corruption
157+
- Performance degradation
158+
- Memory leaks
159+
- Race conditions
160+
- Incorrect errors, traps or panics
161+
- Security breaches
162+
- Cluster instability
163+
- Production outages
164+
165+
Be extremely conservative - only flag truly critical issues. If you're wrong,
166+
it could mean serious consequences for the project.
167+
168+
Use conservative language and minimize superlatives. Assume the reader has
169+
a heart condition - just articulate facts without emotion.
170+
171+
**CRITICAL**: You must respond with EXACTLY one of these formats:
172+
1. 'BUG_DETECTED: [description, line numbers and suggested fix]'
173+
2. 'NO_BUG_DETECTED' if issues are not critical enough
174+
175+
For each issue found, provide:
176+
1. The specific line(s) where the issue occurs
177+
2. A clear description of what is wrong
178+
3. A suggested fix
179+
180+
**OUTPUT REQUIREMENT**: End your response with a single line containing only:
181+
- `STAGE3_RESULT - POTENTIAL_BUG_CONFIRMED` or
182+
- `STAGE3_RESULT - NO_BUG_FOUND`
183+
184+
- name: Extract Stage 3 Result
185+
id: stage3_result
186+
if: steps.stage3.conclusion == 'success'
187+
run: |
188+
RESULT=$(jq -r '.[] | select(.type == "result") | .result' "${{ steps.stage3.outputs.execution_file }}")
189+
{
190+
echo 'result<<EOF'
191+
echo "$RESULT"
192+
echo 'EOF'
193+
} >> "$GITHUB_OUTPUT"
194+
echo "Stage 3 result extracted (${#RESULT} characters)"
195+
196+
- name: Final Analysis Report
197+
if: always()
198+
uses: cockroachdb/claude-code-action@v1
199+
env:
200+
ANTHROPIC_VERTEX_PROJECT_ID: vertex-model-runners
201+
CLOUD_ML_REGION: global
202+
with:
203+
github_token: ${{ secrets.GITHUB_TOKEN }}
204+
use_vertex: "true"
205+
claude_args: |
206+
--model claude-sonnet-4-5@20250929
207+
--allowedTools "Read,Grep,Glob,Bash(gh pr diff:*),Bash(gh pr view:*)"
208+
prompt: |
209+
REPO: ${{ github.repository }}
210+
PR NUMBER: ${{ github.event.pull_request.number }}
211+
212+
## Three-Stage Analysis Summary
213+
214+
Generate a final summary report based on the completed analysis stages:
215+
216+
**Stage 1 Result**: ${{ steps.stage1_result.outputs.result || 'Not completed' }}
217+
**Stage 2 Result**: ${{ steps.stage2_result.outputs.result || 'Skipped - Stage 1 found no bugs' }}
218+
**Stage 3 Result**: ${{ steps.stage3_result.outputs.result || 'Skipped - Stage 2 did not confirm bugs' }}
219+
220+
**Analysis Process**:
221+
- Stage 1 (Initial Screening): ${{ steps.stage1.conclusion }}
222+
- Stage 2 (Database Expert): ${{ steps.stage2.conclusion || 'Skipped' }}
223+
- Stage 3 (Principal Engineer): ${{ steps.stage3.conclusion || 'Skipped' }}
224+
225+
Provide a clear, concise summary of:
226+
1. How many stages were executed
227+
2. The final determination (critical bug found or no critical bugs)
228+
3. If bugs were found, what actions are recommended
229+
230+
**If all three stages detected bugs**, this indicates a potential issue that warrants investigation.
231+
232+
- name: Comment on PR if bugs confirmed
233+
if: contains(steps.stage3_result.outputs.result, 'STAGE3_RESULT - POTENTIAL_BUG_CONFIRMED')
234+
env:
235+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
236+
run: |
237+
gh pr comment ${{ github.event.pull_request.number }} --body "## Potential Bug(s) Detected
238+
239+
The three-stage Claude Code analysis has identified potential bug(s) in this PR that may warrant investigation.
240+
241+
**Next Steps:**
242+
Please review the detailed findings in the [workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).
243+
244+
**Note:** When viewing the workflow output, scroll to the bottom to find the Final Analysis Summary.
245+
246+
After you review the findings, please tag the issue as follows:
247+
- If the detected issue is real or was helpful in any way, please tag the issue with \`O-AI-Review-Real-Issue-Found\`
248+
- If the detected issue was not helpful in any way, please tag the issue with \`O-AI-Review-Not-Helpful\`"
249+
250+
gh pr edit ${{ github.event.pull_request.number }} --add-label "O-AI-Review-Potential-Issue-Detected"

0 commit comments

Comments
 (0)