# Claude Code PR Review — copy to .github/workflows/claude-pr-review.yml
# Responds to @claude mentions in PR/issue comments and auto-reviews new PRs
name: Claude Code

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request:
    types: [opened, synchronize]

jobs:
  # Respond to @claude mentions in comments
  claude-comment:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude'))
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          claude_args: "--max-turns 10 --model claude-sonnet-4-6"

  # Auto-review new PRs and sync pushes
  claude-review:
    if: github.event_name == 'pull_request'
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this pull request. Focus on:
            1. Logic errors and bugs (not style — linters handle that)
            2. Security vulnerabilities (injection, auth bypass, secrets)
            3. Breaking changes or missing migrations
            4. Test coverage gaps for new functionality
            Post findings as review comments on specific lines.
            If everything looks good, approve with a brief summary.
          claude_args: "--max-turns 5 --model claude-sonnet-4-6"
