From de444455a80fc481130187909d7ec2921892c1ab Mon Sep 17 00:00:00 2001 From: Tejas Sameera Date: Thu, 9 Jul 2026 17:00:41 +0000 Subject: [PATCH] ci: add Claude Code PR review and @claude responder workflows Add two GitHub Actions workflows powered by anthropics/claude-code-action: - claude-code-review.yml: auto-reviews every PR (opened/synchronize), posting inline and summary comments with a Neuron/Trainium-aware prompt. - claude-code.yml: responds to @claude mentions in issues, PR comments, and reviews (gated on the mention to control cost). Both authenticate to Amazon Bedrock via GitHub OIDC (no long-lived API key). Model, region, and role ARN are configurable via repo secrets/variables with sensible defaults. Setup for repo admins is documented in docs/claude-code-review.md. Fork PRs receive no credentials, so auto-review is a safe no-op for them and runs for in-repo branches. --- .github/workflows/claude-code-review.yml | 57 ++++++++++++ .github/workflows/claude-code.yml | 49 ++++++++++ docs/claude-code-review.md | 110 +++++++++++++++++++++++ 3 files changed, 216 insertions(+) create mode 100644 .github/workflows/claude-code-review.yml create mode 100644 .github/workflows/claude-code.yml create mode 100644 docs/claude-code-review.md diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml new file mode 100644 index 00000000..0a313e7d --- /dev/null +++ b/.github/workflows/claude-code-review.yml @@ -0,0 +1,57 @@ +# Automated Claude Code review for pull requests. +# Runs on every PR open/update and posts inline + summary review comments. +# +# Authentication uses Amazon Bedrock via GitHub OIDC (no long-lived API key). +# One-time setup is required by a repo admin -- see docs/claude-code-review.md. +name: Claude Code Review + +on: + pull_request: + types: [opened, synchronize] + +# Fork PRs do not receive secrets/OIDC credentials, so the review job is a no-op +# for them. Auto-review runs for pull requests from branches within this repo. +jobs: + review: + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + id-token: write # required for AWS OIDC + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 1 + + - name: Configure AWS credentials (OIDC) + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.CLAUDE_CODE_BEDROCK_ROLE_ARN }} + aws-region: ${{ vars.CLAUDE_CODE_AWS_REGION || 'us-west-2' }} + + - name: Review PR + uses: anthropics/claude-code-action@v1 + with: + use_bedrock: "true" + prompt: | + REPO: ${{ github.repository }} + PR NUMBER: ${{ github.event.pull_request.number }} + + Please review this pull request with a focus on: + - Correctness bugs and potential runtime errors + - Numerical / accuracy regressions in model or kernel code + - Neuron/Trainium-specific concerns (tensor/expert parallelism, + dtype handling, compilation constraints, sharding) + - Security implications + - Performance considerations + - Code quality and adherence to existing conventions + + Note: The PR branch is already checked out in the current working directory. + + Use `gh pr comment` for a concise top-level summary. + Use `mcp__github_inline_comment__create_inline_comment` (with `confirmed: true`) + to flag specific lines. Keep feedback actionable and avoid nitpicking. + Only post GitHub comments -- don't submit review text as chat messages. + claude_args: | + --model ${{ vars.CLAUDE_CODE_BEDROCK_MODEL || 'us.anthropic.claude-sonnet-4-5-20250929-v1:0' }} + --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)" diff --git a/.github/workflows/claude-code.yml b/.github/workflows/claude-code.yml new file mode 100644 index 00000000..d76b2364 --- /dev/null +++ b/.github/workflows/claude-code.yml @@ -0,0 +1,49 @@ +# Interactive Claude Code responder. +# Triggers when someone mentions @claude in an issue, PR comment, PR review, +# or review comment. Claude reads the context and responds / makes changes. +# +# Authentication uses Amazon Bedrock via GitHub OIDC (no long-lived API key). +# One-time setup is required by a repo admin -- see docs/claude-code-review.md. +name: Claude Code + +on: + issue_comment: + types: [created] + pull_request_review_comment: + types: [created] + pull_request_review: + types: [submitted] + issues: + types: [opened, assigned] + +jobs: + claude: + # Only run when @claude is mentioned, to avoid spending on every comment. + if: | + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + issues: write + id-token: write # required for AWS OIDC + steps: + - uses: actions/checkout@v6 + with: + fetch-depth: 1 + + - name: Configure AWS credentials (OIDC) + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.CLAUDE_CODE_BEDROCK_ROLE_ARN }} + aws-region: ${{ vars.CLAUDE_CODE_AWS_REGION || 'us-west-2' }} + + - name: Run Claude Code + uses: anthropics/claude-code-action@v1 + with: + use_bedrock: "true" + claude_args: | + --model ${{ vars.CLAUDE_CODE_BEDROCK_MODEL || 'us.anthropic.claude-sonnet-4-5-20250929-v1:0' }} diff --git a/docs/claude-code-review.md b/docs/claude-code-review.md new file mode 100644 index 00000000..43856d23 --- /dev/null +++ b/docs/claude-code-review.md @@ -0,0 +1,110 @@ +# Claude Code on GitHub + +This repository uses [Claude Code](https://github.com/anthropics/claude-code-action) +to help review pull requests and respond to `@claude` mentions. + +Two workflows are provided: + +| Workflow | File | Trigger | +| --- | --- | --- | +| **Claude Code Review** | `.github/workflows/claude-code-review.yml` | Automatically on every PR (`opened`, `synchronize`) | +| **Claude Code** (interactive) | `.github/workflows/claude-code.yml` | When `@claude` is mentioned in an issue, PR comment, or review | + +Authentication is via **Amazon Bedrock using GitHub OIDC** — no long-lived +Anthropic API key is stored in the repository. + +## One-time setup (repo admin) + +The workflows will no-op until an admin completes the steps below. + +### 1. Create a GitHub OIDC identity provider in your AWS account + +If your account doesn't already have one: + +- Provider URL: `https://token.actions.githubusercontent.com` +- Audience: `sts.amazonaws.com` + +### 2. Create an IAM role the workflows can assume + +Create a role with a trust policy scoped to this repository. Example +(replace `` and confirm the `sub` scope matches your needs): + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Principal": { + "Federated": "arn:aws:iam:::oidc-provider/token.actions.githubusercontent.com" + }, + "Action": "sts:AssumeRoleWithWebIdentity", + "Condition": { + "StringEquals": { + "token.actions.githubusercontent.com:aud": "sts.amazonaws.com" + }, + "StringLike": { + "token.actions.githubusercontent.com:sub": "repo:aws-neuron/neuronx-distributed-inference:*" + } + } + } + ] +} +``` + +Attach a permissions policy allowing Bedrock model invocation: + +```json +{ + "Version": "2012-10-17", + "Statement": [ + { + "Effect": "Allow", + "Action": [ + "bedrock:InvokeModel", + "bedrock:InvokeModelWithResponseStream" + ], + "Resource": "*" + } + ] +} +``` + +> Scope `Resource` to specific model/inference-profile ARNs if your security +> posture requires it. Some Claude models on Bedrock use cross-region inference +> profiles, so grant access in every region the profile spans. + +### 3. Request Bedrock model access + +In the Bedrock console (in the region you'll use), request access to the Claude +model you intend to run — by default the workflows use +`us.anthropic.claude-sonnet-4-5-20250929-v1:0`. + +### 4. Configure the repository secret and variables + +Under **Settings → Secrets and variables → Actions**: + +**Secret (required):** + +- `CLAUDE_CODE_BEDROCK_ROLE_ARN` — ARN of the IAM role from step 2. + +**Variables (optional — sensible defaults are built in):** + +- `CLAUDE_CODE_AWS_REGION` — Bedrock region (default `us-west-2`). +- `CLAUDE_CODE_BEDROCK_MODEL` — Bedrock model id / inference-profile id + (default `us.anthropic.claude-sonnet-4-5-20250929-v1:0`). + +## Notes + +- **Fork pull requests**: This is a public repository. PRs opened from forks do + not receive OIDC credentials, so the auto-review job is a no-op for them. It + runs for PRs from branches within this repository. This is the safe default — + it avoids exposing credentials to untrusted PR code. To review fork PRs, a + maintainer can `@claude` on the PR from a trusted context, or the workflow can + later be extended with a label-gated `pull_request_target` trigger (review the + [security implications](https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/) + first). +- **Cost control**: The interactive workflow only runs when a comment/issue + contains `@claude`. The review workflow runs once per PR push. +- To disable a workflow without deleting it, disable it under the repo's + **Actions** tab, or delete the corresponding file.