48809bd3a5Adversarial review surfaced 9 critiques: 7 patched, 1 resolved by spike, 1 deferred. Most damaging: --comment/--dry-run flag inversion and fabricated dedup SHA-trailer mechanism — both indicated the change was written against the dep change's design rather than the shipped skill artifact. Artifacts: - new design.md with 12 decisions (D2 no-PR-head-checkout, D6 dedup, D7 ephemeral token, D9 dist split, D10 failure matrix, D11 skill invocation prompt, D12 --allowedTools whitelist) and Risks - new battle-test.md with critique inventory, dispositions, patches - proposal.md: corrected cost range, flag, --allowedTools detail - spec.md: 9 patches — split copy-paste vs uses: paths, no PR-head checkout, dedup contract, allowed-tools restriction, max_turns soft cap, PR# pass requirement C4 spike (2026-05-13) validated D2+D7 on Codeberg Forgejo v11.x. Ephemeral GITEA_TOKEN + permissions: pull-requests: write permits create_pull_review on fork PR; pull_request_target executes BASE workflow file (display label pull_request is cosmetic). Spike artifacts retained for reproducibility. C5 spike (cross-repo workflow_call) scaffolded but deferred; tracked in forgejo-mcp-33k. Cleanup of Codeberg test repos tracked in forgejo-mcp-p0y.
33 lines
3 KiB
Markdown
33 lines
3 KiB
Markdown
# Forgejo Action for Claude Code Review
|
|
|
|
## Why
|
|
|
|
The `/code-review` skill (from the `forgejo-code-review-skill` change) works interactively in Claude Code. But the real value for teams is **automated review on every PR** — triggered by Forgejo Actions, posting findings directly as PR review comments. GitHub has `anthropics/claude-code-action` for this; Forgejo has nothing. This action bridges that gap, making AI-assisted code review available to any Forgejo instance (Codeberg, self-hosted).
|
|
|
|
## What Changes
|
|
|
|
- Add a reusable Forgejo Actions workflow (`.forgejo/workflows/claude-code-review.yml`) that runs Claude Code with forgejo-mcp on PR events
|
|
- The workflow installs Claude Code, configures forgejo-mcp as an MCP server, and invokes `/code-review <PR#>` in non-interactive (`-p`) mode (skill posts by default; `--dry-run` is not passed)
|
|
- Findings are posted as a Forgejo PR review with inline comments via `create_pull_review`
|
|
- Supports `pull_request_target` trigger for fork PRs (secrets access) with safe checkout patterns
|
|
- Configurable via workflow inputs: model tier, confidence threshold, max turns, additional review instructions
|
|
- Invokes Claude Code with `--allowedTools` restricted to forgejo-mcp PR review tools only (no Bash, no Read) — see design D12
|
|
|
|
## Capabilities
|
|
|
|
### New Capabilities
|
|
|
|
- `action-code-review`: The Forgejo Actions workflow definition, environment setup (Claude Code installation, MCP server configuration, secret management), base-only checkout (PR contents read via forgejo-mcp API, never executed on runner), and integration between Claude Code's `-p` mode and forgejo-mcp's review tools. Covers trigger configuration, runner requirements, cost controls (`--max-turns` as soft cap, `--allowedTools` restricted to MCP review tools per design D12), `cost_usd` surfacing, dedup via SHA trailer, and output handling.
|
|
|
|
### Modified Capabilities
|
|
|
|
<!-- None. This consumes the code-review skill and existing MCP tools without changing them. -->
|
|
|
|
## Impact
|
|
|
|
- **New files**: `.forgejo/workflows/claude-code-review.yml` (the action workflow), documentation for setup
|
|
- **Dependencies**: Requires the `/code-review` skill from `forgejo-code-review-skill` change. Requires a Forgejo runner with Node.js (for Claude Code installation). Requires `ANTHROPIC_API_KEY` and `FORGEJO_TOKEN` as repository secrets.
|
|
- **Security considerations**: Uses `pull_request_target` for fork PR support — must checkout PR code carefully to avoid code injection. The workflow runs forgejo-mcp with a scoped token (only PR review permissions needed).
|
|
- **Cost implications**: Each PR review run costs ~$0.10-$5.00 depending on diff size, model tier, and subagent dispatch fan-out. `--max-turns` caps main-loop turns (soft cost cap); per-run `cost_usd` is surfaced in the step summary for monitoring. Large PRs scale cost super-linearly with subagent count.
|
|
- **No breaking changes**: Purely additive. The workflow is opt-in per repository.
|
|
- **Dependency on other change**: Depends on `forgejo-code-review-skill` being completed first (the skill prompt is what Claude Code executes)
|