用 Claude Code 做 GitHub PR 治理：5 种自动化方案完整指南

# 在项目根目录打开 Claude Code，运行
/install-github-app

   permissions:
     contents: read
     pull-requests: write
     id-token: write

name: Claude Auto Review
on:
  pull_request:
    types: [opened, synchronize, ready_for_review]

jobs:
  review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          track_progress: true
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            Review this pull request with focus on:
            - Code quality and best practices
            - Potential bugs and edge cases
            - Security implications
            - Test coverage gaps

            Use inline comments for specific code issues.
            Use `gh pr comment` for overall summary.

          claude_args: |
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

name: Review Critical Paths
on:
  pull_request:
    types: [opened, synchronize]
    paths:
      - "src/auth/**"
      - "src/api/**"
      - "src/payment/**"
      - "config/security.yml"

jobs:
  critical-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            This PR modifies critical authentication, API, or payment files.

            Focus your review on:
            - Authentication and authorization flows
            - Input validation and data sanitization
            - Potential SQL injection or XSS vulnerabilities
            - API contract changes that may break consumers
            - Payment logic correctness and idempotency

            Note: The PR branch is already checked out.

          claude_args: |
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*)"

name: External Contributor Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  external-review:
    # 只对首次贡献者触发
    if: github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            CONTRIBUTOR: ${{ github.event.pull_request.user.login }}

            This is a first-time contribution from @${{ github.event.pull_request.user.login }}.

            Please provide a comprehensive review:
            - Code quality and adherence to project conventions
            - Tests: are new behaviors covered?
            - Documentation: public APIs documented?
            - Breaking changes clearly noted?
            - License and attribution (no copy-pasted code without attribution)

            Be constructive and welcoming. Explain the "why" behind suggestions
            so the contributor learns, not just "change this."

          claude_args: |
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

name: Security-Focused Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  security-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            Perform a security-focused code review aligned with OWASP Top 10:

            1. Injection (SQL, NoSQL, command injection)
            2. Broken Authentication (session management, token handling)
            3. Sensitive Data Exposure (unencrypted PII, secrets in code)
            4. Security Misconfiguration (default credentials, verbose errors)
            5. Cross-Site Scripting (reflected, stored, DOM-based)
            6. Insecure Deserialization
            7. Known Vulnerable Dependencies (flag any new imports)
            8. Insufficient Logging (missing audit trails for sensitive ops)

            Format findings as:
            - [CRITICAL]: Must fix before merge
            - [HIGH]: Should fix before merge
            - [MEDIUM]: Fix in follow-up PR
            - [INFO]: Note for awareness, no action required

          claude_args: |
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*)"

name: Team Review Checklist
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  checklist-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      id-token: write
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}

            Review against our team checklist and mark each item:
            ✅ Pass | ❌ Fail (with specific location) | ⚠️ Needs attention

            CHECKLIST:
            [ ] Functions under 50 lines; complex logic extracted
            [ ] No direct DB queries outside repository layer
            [ ] New endpoints have rate limiting
            [ ] Error messages don't expose stack traces in prod
            [ ] New env variables documented in .env.example
            [ ] Migrations are reversible (down migration exists)
            [ ] API responses follow existing schema conventions
            [ ] No hardcoded secrets or API keys

            Post the checklist result as a PR comment with pass/fail for each item.
            Add inline comments on specific lines that fail.

          claude_args: |
            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

paths:
  - "**/*.py"
  - "**/*.ts"

env:
  ANTHROPIC_BASE_URL: ${{ secrets.ANTHROPIC_BASE_URL }}

concurrency:
  group: review-${{ github.event.pull_request.number }}
  cancel-in-progress: true