claude-code-review.yml

name: Claude Code Review (gated)

# DORMANT BY DEFAULT — this workflow does NOT auto-run on PR open/push.
#
# It fires only when something explicitly triggers it:
#   1. Caretaker applies the ``claude-code`` label (happens when
#      ``pr_reviewer.complex_reviewer = "claude_code"`` in caretaker
#      config and a complex PR is dispatched).
#   2. A human applies the same label manually.
#   3. A human runs the workflow from the Actions tab (workflow_dispatch).
#
# To prefer the in-pod opencode_local backend (no consumer-side workflow
# at all), set in ``.github/maintainer/config.yml``:
#
#     pr_reviewer:
#       complex_reviewer: opencode_local
#       enabled_backends: [claude_code, opencode, opencode_local, pr_agent]
#
# and never apply the ``claude-code`` label. This workflow stays
# present as a fallback / opt-in path; the backend is the default.

on:
  pull_request:
    types: [labeled]
  workflow_dispatch:
    inputs:
      pr_number:
        description: "PR number to review"
        required: true
        type: number

jobs:
  claude-review:
    # Only run when the claude-code label was just applied, or when
    # the workflow was dispatched manually.
    if: |
      github.event_name == 'workflow_dispatch' ||
      (github.event_name == 'pull_request' && github.event.label.name == 'claude-code')

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Resolve PR number
        id: pr
        run: |
          if [ -n "${{ github.event.pull_request.number }}" ]; then
            echo "number=${{ github.event.pull_request.number }}" >> "$GITHUB_OUTPUT"
          else
            echo "number=${{ inputs.pr_number }}" >> "$GITHUB_OUTPUT"
          fi

      - name: Preflight — check Claude OAuth token availability
        id: preflight
        env:
          OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
        run: |
          if [ -z "$OAUTH_TOKEN" ]; then
            echo "::warning::CLAUDE_CODE_OAUTH_TOKEN is not set — falling back to Copilot review"
            echo "claude_available=false" >> "$GITHUB_OUTPUT"
          else
            echo "claude_available=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Run Claude Code Review
        id: claude-review
        if: steps.preflight.outputs.claude_available == 'true'
        continue-on-error: true
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
          plugins: 'code-review@claude-code-plugins'
          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ steps.pr.outputs.number }}'
          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
          # or https://code.claude.com/docs/en/cli-reference for available options

      - name: Fallback — request Copilot review
        if: |
          steps.preflight.outputs.claude_available != 'true' ||
          steps.claude-review.outcome == 'failure'
        uses: actions/github-script@v7
        with:
          script: |
            const prNumber = parseInt('${{ steps.pr.outputs.number }}', 10);
            const reason = '${{ steps.preflight.outputs.claude_available }}' === 'true'
              ? 'Claude review action failed'
              : 'Claude OAuth token unavailable';
            core.info(`${reason} — requesting Copilot review for PR #${prNumber}`);
            try {
              await github.rest.pulls.requestReviewers({
                owner: context.repo.owner,
                repo: context.repo.repo,
                pull_number: prNumber,
                reviewers: ['copilot-pull-request-reviewer'],
              });
              core.info(`Requested Copilot review for PR #${prNumber}`);
            } catch (error) {
              core.warning(`Copilot review request failed: ${error.message}`);
            }