ci: add Claude + Codex automated PR code review - #14
Merged
Conversation
Mirror the Agora-Build/Vox review workflows. Both trigger on PRs from trusted authors (OWNER/MEMBER/COLLABORATOR) and post a review comment. - claude-code-review.yml: read-only agent job (anthropics/claude-code-action) produces the review as an artifact; an isolated model-free job with pull-requests:write posts it — so no untrusted PR text ever reaches a writer token. - codex-code-review.yml: openai/codex-action in read-only sandbox, posts its final message. Requires repo secrets ANTHROPIC_API_KEY, ANTHROPIC_BASE_URL, OPENAI_API_KEY, OPENAI_BASE_URL (copy from the Vox repo). 🤖 Built with SMT <smt@agora.build>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds automated PR code-review workflows mirroring
Agora-Build/Vox:.github/workflows/claude-code-review.yml— split-job design: a read-only agent job (anthropics/claude-code-action) produces the review as an artifact, and a separate model-free job withpull-requests: writeposts it. So even a prompt-injecting PR can't reach a write token..github/workflows/codex-code-review.yml—openai/codex-actionin a read-only sandbox, posts its final message.Both trigger on
pull_request(opened/synchronize/ready_for_review/reopened) and are gated to trusted authors (OWNER/MEMBER/COLLABORATOR) so untrusted fork PRs never get secrets. Copied verbatim from Vox (they're repo-agnostic — use${{ github.repository }}/context.repo).Atem currently has only
CF_ACCOUNT_ID,CF_API_TOKEN,NPM_TOKEN. These workflows need four more (present in Vox):ANTHROPIC_API_KEY,ANTHROPIC_BASE_URL(Claude)OPENAI_API_KEY,OPENAI_BASE_URL(Codex — no trailing slash)Until they're added, the review jobs will fail on PRs.
Generated with SMT smt@agora.build