Skip to content

feat(ci): review Dependabot PRs with Claude #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zfarrell wants to merge 1 commit into from
Closed

feat(ci): review Dependabot PRs with Claude #17

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 9 additions & 13 deletions .github/workflows/claude-pr-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,12 +22,12 @@ jobs:
with:
fetch-depth: 1

- name: Skip review for Dependabot bump
if: github.event.pull_request.user.login == 'dependabot[bot]'
run: echo "Dependabot bump — skipping Claude review."

# NOTE: Dependabot-triggered runs read from *Dependabot* secrets and get a
# read-only GITHUB_TOKEN. For Claude to review Dependabot PRs,
# HOTDATA_AUTOMATION_PRIVATE_KEY and ANTHROPIC_API_KEY must also be set as
# Dependabot secrets, and the App token (below) is used for any write
# operations since the default GITHUB_TOKEN cannot post comments here.
- name: Generate GitHub App token
if: github.event.pull_request.user.login != 'dependabot[bot]'
id: app-token
uses: actions/create-github-app-token@v3.2.0
with:
Expand All @@ -36,7 +36,6 @@ jobs:
owner: hotdata-dev

- uses: actions/checkout@v6.0.2
if: github.event.pull_request.user.login != 'dependabot[bot]'
with:
repository: hotdata-dev/github-workflows
ref: main
Expand All @@ -46,7 +45,6 @@ jobs:
sparse-checkout-cone-mode: false

- name: Load review prompt
if: github.event.pull_request.user.login != 'dependabot[bot]'
id: prompt
run: |
PROMPT=$(cat .github-workflows/docs/claude-pr-review-prompt.md)
Expand All @@ -55,11 +53,9 @@ jobs:
echo "EOF" >> $GITHUB_OUTPUT

- name: Verify jq is available
if: github.event.pull_request.user.login != 'dependabot[bot]'
run: jq --version

- name: Gather review context
if: github.event.pull_request.user.login != 'dependabot[bot]'
id: context
run: |
PR_NUMBER=${{ github.event.pull_request.number }}
Expand Down Expand Up @@ -94,13 +90,13 @@ jobs:
GH_TOKEN: ${{ github.token }}

- uses: anthropics/claude-code-action@v1
if: github.event.pull_request.user.login != 'dependabot[bot]'
id: review
continue-on-error: true
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ steps.app-token.outputs.token }}

@claude claude Bot Jun 8, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

super nit (not blocking): This now hands the org-scoped App token (owner: hotdata-dev, no repositories: restriction) to the Claude action, where it processes untrusted content — the PR diff and prior comment threads. Previously the action ran with the repo-scoped default GITHUB_TOKEN, so this widens the blast radius of any prompt injection: combined with Bash(gh pr comment:*) / Bash(gh pr review:*) in allowedTools (which permit --repo), a successful injection could act on other repos in the org or auto---approve.

The content is already marked untrusted in the prompt and the tool set is constrained, so this is inherent-design risk rather than a new bug. If you want to tighten it, consider scoping the App token with repositories: ${{ github.event.repository.name }} on the create-github-app-token step so the review token can only touch this repo.

track_progress: false
allowed_bots: "hotdata-automation[bot],aikido-autofix[bot]"
allowed_bots: "hotdata-automation[bot],aikido-autofix[bot],dependabot[bot]"
prompt: |
REPO: ${{ github.repository }}
PR NUMBER: ${{ github.event.pull_request.number }}
Expand All @@ -117,7 +113,7 @@ jobs:
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr review:*),Read"

- name: Notify on review failure
if: github.event.pull_request.user.login != 'dependabot[bot]' && (steps.review.outcome == 'failure' || steps.review.outcome == 'cancelled')
if: steps.review.outcome == 'failure' || steps.review.outcome == 'cancelled'
run: gh pr comment ${{ github.event.pull_request.number }} --body "Automated review unavailable (Claude step failed). Please review manually."
env:
GH_TOKEN: ${{ github.token }}
GH_TOKEN: ${{ steps.app-token.outputs.token }}