feat: enable Claude PR review - #463
Merged
Merged
Conversation
Add the two-stage Claude PR-review caller workflows, matching the integration already enabled in aws-deadline/deadline-cloud (#1195): - claude_pr_review_collect.yml: Stage 1, runs on pull_request and exists only to fire the workflow_run event that starts the review stage. It produces no data the review stage trusts. - claude_pr_review.yml: Stage 2, triggered by the collect workflow's completion. Runs from the default branch with this repo's secrets, so a fork PR cannot alter review behavior, permissions, or credentials. All review logic (Bedrock auth, the pinned action, the restricted tool surface, the read-only PR-head checkout, and per-run limits) lives in the reusable workflow in aws-deadline/.github; these are thin callers that forward the workflow_run identifiers and the role-ARN secret. Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
github-actions
Bot
added
the
waiting-on-maintainers
karthikbekalp
approved these changes
Jun 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enables the automated, advisory Claude PR-review integration in this repository, matching what is already enabled in aws-deadline/deadline-cloud (#1195).
What this adds
Two thin caller workflows under
.github/workflows/:claude_pr_review_collect.yml— Stage 1. Runs onpull_request(opened, synchronize). It does no work and records nothing; it exists only so its completion fires theworkflow_runevent that starts the review stage. It produces no data the review stage trusts.claude_pr_review.yml— Stage 2. Triggered by the collect workflow's completion viaworkflow_run, so GitHub runs it from the default branch with this repo's secrets — a fork PR cannot alter the review behavior, permissions, or credential setup. Derives the PR number, head SHA, and base SHA from the server-populatedworkflow_runpayload (which a fork cannot forge).All the actual review logic — Bedrock authentication, the SHA-pinned action, the restricted read-only tool surface, the read-only PR-head checkout, and per-run turn/token/time limits — lives in the shared reusable workflow at
aws-deadline/.github/.github/workflows/reusable_claude_pr_review.yml@mainline. These files are thin callers that forward theworkflow_runidentifiers and theAWS_CLAUDE_PR_REVIEW_ROLEsecret.Prerequisite
The
AWS_CLAUDE_PR_REVIEW_ROLEsecret (the OIDC role that can mint a Bedrock bearer token) must be configured for this repository for the review stage to run.