Christoph Görn 48809bd3a5

docs: 📝 battle-test forgejo-action-code-review, resolve C4 spike

Adversarial review surfaced 9 critiques: 7 patched, 1 resolved by spike,
1 deferred. Most damaging: --comment/--dry-run flag inversion and
fabricated dedup SHA-trailer mechanism — both indicated the change was
written against the dep change's design rather than the shipped skill
artifact.

Artifacts:
- new design.md with 12 decisions (D2 no-PR-head-checkout, D6 dedup,
  D7 ephemeral token, D9 dist split, D10 failure matrix, D11 skill
  invocation prompt, D12 --allowedTools whitelist) and Risks
- new battle-test.md with critique inventory, dispositions, patches
- proposal.md: corrected cost range, flag, --allowedTools detail
- spec.md: 9 patches — split copy-paste vs uses: paths, no PR-head
  checkout, dedup contract, allowed-tools restriction, max_turns soft
  cap, PR# pass requirement

C4 spike (2026-05-13) validated D2+D7 on Codeberg Forgejo v11.x.
Ephemeral GITEA_TOKEN + permissions: pull-requests: write permits
create_pull_review on fork PR; pull_request_target executes BASE
workflow file (display label pull_request is cosmetic). Spike
artifacts retained for reproducibility.

C5 spike (cross-repo workflow_call) scaffolded but deferred; tracked
in forgejo-mcp-33k. Cleanup of Codeberg test repos tracked in
forgejo-mcp-p0y.

2026-05-13 08:34:17 +02:00

3 KiB

Raw Permalink Blame History

Forgejo Action for Claude Code Review

Why

The /code-review skill (from the forgejo-code-review-skill change) works interactively in Claude Code. But the real value for teams is automated review on every PR — triggered by Forgejo Actions, posting findings directly as PR review comments. GitHub has anthropics/claude-code-action for this; Forgejo has nothing. This action bridges that gap, making AI-assisted code review available to any Forgejo instance (Codeberg, self-hosted).

What Changes

Add a reusable Forgejo Actions workflow (.forgejo/workflows/claude-code-review.yml) that runs Claude Code with forgejo-mcp on PR events
The workflow installs Claude Code, configures forgejo-mcp as an MCP server, and invokes /code-review <PR#> in non-interactive (-p) mode (skill posts by default; --dry-run is not passed)
Findings are posted as a Forgejo PR review with inline comments via create_pull_review
Supports pull_request_target trigger for fork PRs (secrets access) with safe checkout patterns
Configurable via workflow inputs: model tier, confidence threshold, max turns, additional review instructions
Invokes Claude Code with --allowedTools restricted to forgejo-mcp PR review tools only (no Bash, no Read) — see design D12

Capabilities

New Capabilities

action-code-review: The Forgejo Actions workflow definition, environment setup (Claude Code installation, MCP server configuration, secret management), base-only checkout (PR contents read via forgejo-mcp API, never executed on runner), and integration between Claude Code's -p mode and forgejo-mcp's review tools. Covers trigger configuration, runner requirements, cost controls (--max-turns as soft cap, --allowedTools restricted to MCP review tools per design D12), cost_usd surfacing, dedup via SHA trailer, and output handling.

Modified Capabilities

Impact

New files: .forgejo/workflows/claude-code-review.yml (the action workflow), documentation for setup
Dependencies: Requires the /code-review skill from forgejo-code-review-skill change. Requires a Forgejo runner with Node.js (for Claude Code installation). Requires ANTHROPIC_API_KEY and FORGEJO_TOKEN as repository secrets.
Security considerations: Uses pull_request_target for fork PR support — must checkout PR code carefully to avoid code injection. The workflow runs forgejo-mcp with a scoped token (only PR review permissions needed).
Cost implications: Each PR review run costs ~$0.10-$5.00 depending on diff size, model tier, and subagent dispatch fan-out. --max-turns caps main-loop turns (soft cost cap); per-run cost_usd is surfaced in the step summary for monitoring. Large PRs scale cost super-linearly with subagent count.
No breaking changes: Purely additive. The workflow is opt-in per repository.
Dependency on other change: Depends on forgejo-code-review-skill being completed first (the skill prompt is what Claude Code executes)

3 KiB Raw Permalink Blame History