Handle absence of /home gracefully #37

Workflow file for this run

.github/workflows/claude-review.yml at 4c3aee1

	# Integrates Claude Code as an AI assistant for reviewing pull requests.
	# Mention @claude in any PR comment to request a review. Claude authenticates
	# via AWS Bedrock using OIDC — no long-lived API keys required.
	#
	# Architecture: The workflow is split into three jobs for least-privilege:
	# 1. "setup" — posts/updates a "reviewing…" tracking comment (write permissions)
	# 2. "review" — runs Claude with read-only permissions, produces structured JSON
	# 3. "post" — reads the JSON and posts comments to the PR (write permissions)

	name: Claude Review

	on:
	# Strangely enough you have to use issue_comment to react to regular comments on PRs.
	# See https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_comment-use-issue_comment.
	issue_comment:
	types: [created]
	pull_request_review_comment:
	types: [created]
	pull_request_review:
	types: [submitted]

	concurrency:
	group: claude-review-${{ github.event.pull_request.number \|\| github.event.issue.number }}

	jobs:
	setup:
	runs-on: ubuntu-latest
	env:
	PR_NUMBER: ${{ github.event.pull_request.number \|\| github.event.issue.number }}

	if: \|
	github.repository_owner == 'systemd' &&
	((github.event_name == 'issue_comment' &&
	github.event.issue.pull_request &&
	contains(github.event.comment.body, '@claude review') &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association)) \|\|
	(github.event_name == 'pull_request_review_comment' &&
	contains(github.event.comment.body, '@claude review') &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association)) \|\|
	(github.event_name == 'pull_request_review' &&
	contains(github.event.review.body, '@claude review') &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.review.author_association)))

	permissions:
	contents: read
	pull-requests: write

	outputs:
	pr_number: ${{ steps.pr.outputs.number }}
	head_sha: ${{ steps.pr.outputs.head_sha }}
	comment_id: ${{ steps.tracking.outputs.comment_id }}

	steps:
	- name: Resolve PR metadata
	id: pr
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: \|
	echo "number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
	gh pr view --repo "${{ github.repository }}" "$PR_NUMBER" --json headRefOid --jq '.headRefOid' \| \
	xargs -I{} echo "head_sha={}" >> "$GITHUB_OUTPUT"

	- name: Create or update tracking comment
	id: tracking
	uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
	with:
	script: \|
	const owner = context.repo.owner;
	const repo = context.repo.repo;
	const prNumber = parseInt(process.env.PR_NUMBER, 10);
	const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
	const MARKER = "<!-- claude-pr-review -->";

	const issueComments = await github.paginate(
	github.rest.issues.listComments,
	{ owner, repo, issue_number: prNumber, per_page: 100 },
	);

	const existing = issueComments.find((c) => c.body && c.body.includes(MARKER));

	let commentId;
	if (existing) {
	console.log(`Updating existing tracking comment ${existing.id}.`);
	/* Prepend a re-reviewing banner but keep the previous review visible. */
	const prevBody = existing.body.replace(/\n\n\[Workflow run\]$[^)]*$$/, "");
	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: existing.id,
	body: `> Claude is re-reviewing this PR… ([workflow run](${runUrl}))\n\n${prevBody}`,
	});
	commentId = existing.id;
	} else {
	console.log("Creating new tracking comment.");
	const {data: created} = await github.rest.issues.createComment({
	owner,
	repo,
	issue_number: prNumber,
	body: `Claude is reviewing this PR… ([workflow run](${runUrl}))\n\n${MARKER}`,
	});
	commentId = created.id;
	}

	core.setOutput("comment_id", commentId);

	review:
	runs-on: ubuntu-latest
	needs: setup

	permissions:
	contents: read
	pull-requests: read # Fetch PR comments and reviews
	issues: read # Fetch issue comments
	id-token: write # Authenticate with AWS via OIDC
	actions: read

	outputs:
	structured_output: ${{ steps.claude.outputs.structured_output }}

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
	with:
	role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
	role-session-name: GitHubActions-Claude-${{ github.run_id }}
	aws-region: us-east-1

	- name: Run Claude Code
	id: claude
	uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44
	env:
	REVIEW_SCHEMA: >-
	{
	"type": "object",
	"required": ["comments", "summary"],
	"properties": {
	"summary": {
	"type": "string",
	"description": "A markdown summary of the review to post as a top-level tracking comment"
	},
	"comments": {
	"type": "array",
	"items": {
	"type": "object",
	"required": ["file", "severity", "body"],
	"properties": {
	"file": {
	"type": "string",
	"description": "Path to the file relative to the repo root"
	},
	"line": {
	"type": "integer",
	"description": "Line number in the diff (new file side) to attach the comment to"
	},
	"severity": {
	"type": "string",
	"enum": ["must-fix", "suggestion", "nit"]
	},
	"body": {
	"type": "string",
	"description": "The review comment body in markdown"
	}
	}
	}
	}
	}
	}
	with:
	use_bedrock: "true"
	# We still have to pass GITHUB_TOKEN here because claude-code-action
	# requires it, but we restrict Claude's tools to read-only operations
	# so it cannot post comments or modify the PR.
	github_token: ${{ secrets.GITHUB_TOKEN }}
	track_progress: false
	show_full_output: "true"
	additional_permissions: \|
	actions: read
	claude_args: \|
	--model us.anthropic.claude-opus-4-6-v1
	--max-turns 100
	--allowedTools "
	Read,LS,Grep,Glob,Task,
	Bash(cat:),Bash(test:),Bash(printf:),Bash(jq:),Bash(head:),Bash(tail:),
	Bash(git:),Bash(grep:),Bash(find:),Bash(ls:),Bash(wc:*),
	Bash(diff:),Bash(sed:),Bash(awk:),Bash(sort:),Bash(uniq:*),
	mcp__github__get_pull_request,
	mcp__github__get_pull_request_diff,
	mcp__github__get_pull_request_files,
	mcp__github__get_pull_request_reviews,
	mcp__github__get_pull_request_comments,
	mcp__github__get_pull_request_review_comments,
	mcp__github__get_pull_request_status,
	mcp__github__get_issue_comments,
	mcp__github_ci__get_ci_status,
	mcp__github_ci__get_workflow_run_details,
	mcp__github_ci__download_job_log,
	"
	--json-schema '${{ env.REVIEW_SCHEMA }}'
	prompt: \|
	REPO: ${{ github.repository }}
	PR NUMBER: ${{ needs.setup.outputs.pr_number }}
	HEAD SHA: ${{ needs.setup.outputs.head_sha }}

	You are a code reviewer for the ${{ github.repository }} project. Review this pull request and
	produce a structured JSON result containing your review comments. Do NOT attempt
	to post comments yourself — just return the JSON. You are in the upstream repo
	without the patch applied. Do not apply it.

	## Phase 1: Gather context

	Use the GitHub MCP server tools to fetch PR data. For all tools, pass
	owner `${{ github.repository_owner }}`, repo `${{ github.event.repository.name }}`,
	and pullNumber/issue_number ${{ needs.setup.outputs.pr_number }}:
	- `mcp__github__get_pull_request_diff` to get the PR diff
	- `mcp__github__get_pull_request` to get the PR title, body, and metadata
	- `mcp__github__get_pull_request_comments` to get top-level PR comments
	- `mcp__github__get_pull_request_reviews` to get PR reviews

	Also fetch issue comments using `mcp__github__get_issue_comments` with
	issue_number ${{ needs.setup.outputs.pr_number }}.

	Look for an existing tracking comment (containing `<!-- claude-pr-review -->`)
	in the issue comments. If one exists, you will use it as the basis for
	your `summary` in Phase 3.

	Check CI status for the PR head commit using `mcp__github_ci__get_ci_status`.
	If any workflow runs have failed, use `mcp__github_ci__get_workflow_run_details`
	and `mcp__github_ci__download_job_log` to fetch the failure logs. Pass these
	logs to the review subagents in Phase 2 so they can identify whether the PR
	changes caused the failures.

	## Phase 2: Parallel review subagents

	Review:
	- Code quality, style, and best practices
	- Potential bugs, issues, incorrect logic
	- Security implications
	- CLAUDE.md compliance
	- CI failures (if any logs were fetched in Phase 1)

	For every category, launch subagents to review them in parallel. Group related sections
	as needed — use 2-4 subagents based on PR size and scope.

	Give each subagent the PR title, description, full patch, and the list of changed files.

	Each subagent must return a JSON array of issues:
	`[{"file": "path", "line": <number>, "severity": "must-fix\|suggestion\|nit", "body": "..."}]`

	`line` must be a line number from the NEW side of the diff **that appears inside
	a diff hunk** (i.e. a line that is shown in the patch output). GitHub's review
	comment API rejects lines outside the diff context, so never reference lines
	that are not visible in the patch.

	Each subagent MUST verify its findings before returning them:
	- For style/convention claims, check at least 3 existing examples in the codebase to confirm
	the pattern actually exists before flagging a violation.
	- For "use X instead of Y" suggestions, confirm X actually exists and works for this case.
	- If unsure, don't include the issue.

	## Phase 3: Collect, deduplicate, and summarize

	After ALL subagents complete:
	1. Collect all issues. Merge duplicates (same file, lines within 3 of each other, same problem).
	2. Drop low-confidence findings.
	3. Check the existing inline review comments fetched in Phase 1. Do NOT include a
	comment if one already exists on the same file and line about the same problem.
	Also check for author replies that dismiss or reject a previous comment — do NOT
	re-raise an issue the PR author has already responded to disagreeing with.
	4. Prefix ALL comment bodies with a severity tag: `must-fix: `, `suggestion: `,
	or `nit: `.
	5. Write a `summary` field in markdown for a top-level tracking comment.

	If no existing tracking comment was found (first run):
	Use this format:

	```
	## Claude review of PR #<number> (<HEAD SHA>)

	<!-- claude-pr-review -->

	### Must fix
	- [ ] short title — `file:line` — brief explanation

	### Suggestions
	- [ ] short title — `file:line` — brief explanation

	### Nits
	- [ ] short title — `file:line` — brief explanation
	```

	Omit empty sections. Each checkbox item must correspond to an entry in `comments`.
	If there are no issues at all, write a short message saying the PR looks good.

	Throughout all phases, track any errors that prevented you from doing
	your job fully: permission denials (403, "Resource not accessible by
	integration"), tools that were not available, rate limits, or any other
	failures that degraded the review quality. If there were any, append a
	`### Errors` section listing each failed tool/action and the error
	message, so maintainers can fix the workflow configuration.

	If an existing tracking comment was found (subsequent run):
	Use the existing comment as the starting point. Preserve the order and wording
	of all existing items. Then apply these updates:
	- Update the HEAD SHA in the header line.
	- For each existing item, re-check whether the issue is still present in the
	current diff. If it has been fixed, mark it checked: `- [x]`.
	- If the PR author replied dismissing an item, mark it:
	`- [x] ~~short title~~ (dismissed)`.
	- Preserve checkbox state that was already set by previous runs or by hand.
	- Append any NEW issues found in this run that aren't already listed,
	in the appropriate severity section, after the existing items.
	- Do NOT reorder, reword, or remove existing items.

	Return the final JSON object with your `comments` array and `summary` string.
	Do NOT attempt to post comments or use any MCP tools to modify the PR.

	post:
	runs-on: ubuntu-latest
	needs: [setup, review]
	if: always() && needs.setup.result == 'success'

	permissions:
	pull-requests: write

	steps:
	- name: Post review comments
	uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
	env:
	STRUCTURED_OUTPUT: ${{ needs.review.outputs.structured_output }}
	REVIEW_RESULT: ${{ needs.review.result }}
	PR_NUMBER: ${{ needs.setup.outputs.pr_number }}
	HEAD_SHA: ${{ needs.setup.outputs.head_sha }}
	COMMENT_ID: ${{ needs.setup.outputs.comment_id }}
	with:
	script: \|
	const owner = context.repo.owner;
	const repo = context.repo.repo;
	const prNumber = parseInt(process.env.PR_NUMBER, 10);
	const headSha = process.env.HEAD_SHA;
	const commentId = parseInt(process.env.COMMENT_ID, 10);
	const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
	const MARKER = "<!-- claude-pr-review -->";

	/* If the review job failed or was cancelled, update the tracking
	* comment to reflect that and bail out. */
	if (process.env.REVIEW_RESULT !== "success") {
	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: commentId,
	body: `Claude review failed — see [workflow run](${runUrl}) for details.\n\n${MARKER}`,
	});
	core.setFailed("Review job did not succeed.");
	return;
	}

	/* Parse Claude's structured output. */
	const raw = process.env.STRUCTURED_OUTPUT;
	console.log("Structured output from Claude:");
	console.log(raw \|\| "(empty)");

	let comments = [];
	let summary = "";
	if (raw) {
	try {
	const review = JSON.parse(raw);
	if (Array.isArray(review.comments))
	comments = review.comments;
	if (typeof review.summary === "string")
	summary = review.summary;
	} catch (e) {
	core.warning(`Failed to parse structured output: ${e.message}`);
	}
	}

	console.log(`Claude produced ${comments.length} review comment(s).`);

	/* Post each inline comment individually. Deduplication against existing
	* comments is handled by Claude in the prompt, so we just post whatever
	* it returns. Using individual comments (rather than a review) means
	* re-runs only add new comments instead of creating a whole new review. */
	const inlineComments = comments.filter((c) => c.line);
	const skipped = comments.length - inlineComments.length;
	if (skipped > 0)
	console.log(`Skipping ${skipped} file-level comment(s) (no line number).`);

	let posted = 0;
	for (const c of inlineComments) {
	console.log(` Posting comment on ${c.file}:${c.line}`);
	try {
	await github.rest.pulls.createReviewComment({
	owner,
	repo,
	pull_number: prNumber,
	commit_id: headSha,
	path: c.file,
	line: c.line,
	body: `Claude: ${c.body}`,
	});
	posted++;
	} catch (e) {
	/* GitHub rejects comments on lines outside the diff context. Log
	* and continue — the tracking comment still contains all findings. */
	console.log(` Warning: failed to post comment on ${c.file}:${c.line}: ${e.message}`);
	}
	}

	if (posted > 0)
	console.log(`Posted ${posted}/${inlineComments.length} inline comment(s).`);
	else if (inlineComments.length > 0)
	console.log(`Could not post any of ${inlineComments.length} inline comment(s) — see warnings above.`);
	else
	console.log("No inline comments to post.");

	const failed = inlineComments.length > 0 && posted < inlineComments.length;

	/* Update the tracking comment with Claude's summary. */
	if (!summary)
	summary = "Claude review: no issues found :tada:\n\n" + MARKER;
	else if (!summary.includes(MARKER))
	summary += "\n\n" + MARKER;
	summary += `\n\n[Workflow run](${runUrl})`;

	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: commentId,
	body: summary,
	});

	console.log("Tracking comment updated successfully.");

	if (failed)
	core.setFailed(`Failed to post ${comments.length - posted}/${comments.length} inline comment(s).`);

Navigation Menu

Uh oh!

Handle absence of /home gracefully #37

Workflow file

Handle absence of /home gracefully #37

Uh oh!

Workflow file for this run