fix: AskUserQuestion 默认永不超时 + 移除误导性 primary 高亮 #458
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude PR Review | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, ready_for_review, reopened] | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| review: | |
| if: ${{ !github.event.pull_request.draft }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| - uses: oven-sh/setup-bun@v2 | |
| - name: Cache bun dependencies | |
| uses: actions/cache@v4 | |
| with: | |
| path: ~/.bun/install/cache | |
| key: bun-${{ runner.os }}-${{ hashFiles('bun.lockb', 'package.json') }} | |
| restore-keys: | | |
| bun-${{ runner.os }}- | |
| - name: Install dependencies | |
| run: bun install --frozen-lockfile | |
| - uses: anthropics/claude-code-action@v1 | |
| with: | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | |
| github_token: ${{ github.token }} | |
| track_progress: true | |
| claude_args: | | |
| --model opus | |
| --max-budget-usd 10 | |
| --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh api:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr checks:*),Bash(git log:*),Bash(git blame:*),Bash(git diff:*),Read,Glob,Grep" | |
| prompt: | | |
| REPO: ${{ github.repository }} | |
| PR NUMBER: ${{ github.event.pull_request.number }} | |
| You are a senior code reviewer. Your goal is to find real, actionable issues — not to generate noise. | |
| ## Step 1: Handle Previous Review Comments | |
| IMPORTANT: Before starting your review, check for and resolve your own previous comments. | |
| 1. Run `gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/comments --jq '[.[] | select(.user.login == "claude[bot]")]'` to get all your previous inline review comments. | |
| 2. Run `gh pr diff ${{ github.event.pull_request.number }}` to get the current diff. | |
| 3. For each previous comment you left: | |
| - Read the CURRENT version of the file at the commented line to check if the issue is fixed. | |
| - If FIXED: reply to that comment via `gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/comments/{comment_id}/replies -f body="✅ Fixed. {brief description of the fix}"`, then resolve the conversation (see step 5). | |
| - If STILL EXISTS: reply noting it persists, do NOT create a duplicate inline comment for the same issue. | |
| - If PARTIALLY FIXED: reply explaining what remains. | |
| 4. Only create NEW inline comments for genuinely new issues not already covered by previous comments. | |
| 5. After replying to ALL fixed comments, resolve their conversation threads: | |
| a. Get review thread IDs: `gh api graphql -f query='{ repository(owner:"${{ github.repository_owner }}", name:"${{ github.event.repository.name }}") { pullRequest(number:${{ github.event.pull_request.number }}) { reviewThreads(first:100) { nodes { id isResolved comments(first:1) { nodes { databaseId body } } } } } } }'` | |
| b. Match each fixed comment's databaseId to find the thread node ID. | |
| c. Resolve each thread: `gh api graphql -f query='mutation { resolveReviewThread(input:{threadId:"THREAD_NODE_ID"}) { thread { isResolved } } }'` | |
| ## Step 2: Setup | |
| 1. Read CLAUDE.md to understand the project architecture and conventions. | |
| 2. Run `gh pr view ${{ github.event.pull_request.number }}` to understand the PR intent. | |
| ## Step 3: Review Process | |
| For EACH changed file in the diff: | |
| 1. Read the FULL source file (not just the diff) to understand context. | |
| 2. Use `git blame` on suspicious lines to understand the change history. | |
| 3. Trace function calls to verify correctness across module boundaries. | |
| ## What to Look For | |
| - **Bugs**: Logic errors, off-by-one, null/undefined access, race conditions, unhandled promise rejections | |
| - **Security**: Injection risks (command, SQL, XSS), secret exposure, unsafe permissions, missing input validation | |
| - **Architecture**: Does the change follow patterns in CLAUDE.md? ESM imports with .js extensions? Proper singleton usage? | |
| - **TypeScript**: Unsafe `any` types, incorrect generics, missing error types, async/await pitfalls | |
| - **Resource leaks**: Unclosed connections, missing event listener cleanup, timer leaks | |
| ## Confidence Scoring | |
| For each issue, assign a confidence score (0-100): | |
| - 90-100: Certain this is a real bug or security issue | |
| - 75-89: Highly confident, likely a real problem | |
| - 50-74: Moderate confidence, worth mentioning | |
| - Below 50: Do NOT report — too likely to be a false positive | |
| Only report issues with confidence ≥ 75. | |
| ## False Positive Filters — Do NOT report: | |
| - Pre-existing issues not introduced in this PR | |
| - Style preferences or nitpicks | |
| - Issues that linters/formatters will catch | |
| - Missing comments on self-explanatory code | |
| - Hypothetical future problems | |
| - Code that "could be improved" but works correctly | |
| ## Step 4: Output | |
| - Use `mcp__github_inline_comment__create_inline_comment` to post NEW inline comments only for issues not already covered. | |
| - Post a summary comment via `gh pr comment` with: | |
| - One-line verdict: ✅ Approved / ⚠️ Issues Found | |
| - If previous issues were resolved, note: "N previous issues fixed" | |
| - If issues found: bulleted list with severity (🔴 critical / 🟡 warning) and confidence score | |
| - Brief overall assessment of the PR quality |