Daichi Narushima
0d13746918
* Separate manual release workflow from CI * Refactor release workflow with granular job separation Split release process into distinct jobs (build, github-release, publish-to-pypi) for better separation of concerns and permission management. Remove workflow_dispatch inputs from release workflow and update CI workflow to use read-only permissions for calling the release workflow. Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * Use OIDC instead of the API token for PyPI * Update .github/workflows/release.yml * Rename .github/workflows/claude-code.yml to .github/workflows/claude.yml * Fix permissions * Refactor .github/workflows/claude.yml --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com>
58 lines
1.9 KiB
YAML
58 lines
1.9 KiB
YAML
---
|
|
name: Claude Code review and mention bot
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
types:
|
|
- opened
|
|
- ready_for_review
|
|
issue_comment:
|
|
types:
|
|
- created
|
|
pull_request_review_comment:
|
|
types:
|
|
- created
|
|
issues:
|
|
types:
|
|
- opened
|
|
- assigned
|
|
pull_request_review:
|
|
types:
|
|
- submitted
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
claude-code-review:
|
|
if: >
|
|
github.event_name == 'pull_request'
|
|
&& (! github.event.pull_request.draft)
|
|
&& (! startsWith(github.head_ref, 'dependabot/'))
|
|
&& (! startsWith(github.head_ref, 'renovate/'))
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
id-token: write
|
|
actions: read
|
|
uses: dceoy/gh-actions-for-devops/.github/workflows/claude-code-review.yml@main # zizmor: ignore[unpinned-uses]
|
|
secrets:
|
|
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env]
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
claude-code-bot:
|
|
if: >
|
|
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude'))
|
|
|| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude'))
|
|
|| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude'))
|
|
|| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
|
|
permissions:
|
|
contents: read
|
|
pull-requests: write
|
|
issues: write
|
|
id-token: write
|
|
actions: read
|
|
uses: dceoy/gh-actions-for-devops/.github/workflows/claude-code-bot.yml@main # zizmor: ignore[unpinned-uses]
|
|
secrets:
|
|
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # zizmor: ignore[secrets-outside-env]
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|