bash# Headless mode — runs once, exits, returns output
claude -p "Review the diff in this PR for security vulnerabilities and post findings"

yamlname: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write

jobs:
  claude-review:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history needed for diff analysis

      - name: Claude Code Review
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this pull request and post inline comments for:
            1. Logic errors and edge cases
            2. Security vulnerabilities (SQL injection, XSS, auth bypasses)
            3. Performance issues (N+1 queries, blocking calls, memory leaks)
            4. Missing error handling
            Focus on the changed files only. Be specific — cite line numbers.

yamlname: Auto-Fix Failing Tests

on:
  workflow_run:
    workflows: ["Run Tests"]
    types: [completed]

jobs:
  auto-fix:
    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.workflow_run.head_branch }}

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run tests and capture output
        id: test-run
        run: npm test 2>&1 | tee test-output.txt || true

      - name: Claude Auto-Fix
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            The following tests are failing:
            
            $(cat test-output.txt)
            
            Diagnose the root cause by reading the relevant source files, 
            then fix the code (not the tests). Commit your changes with 
            a descriptive message explaining what broke and why.

markdown# Project: YourApp API

## Code Review Standards

When reviewing pull requests, apply these standards:

### Security (P0 — always flag)
- SQL queries must use parameterized statements, never string interpolation
- User input must be sanitized before rendering in HTML contexts  
- API endpoints must verify authentication before returning data
- Secrets must never appear in code, logs, or error messages

### Performance (P1 — flag if clearly problematic)
- Database queries inside loops are a blocking issue
- Synchronous operations in async contexts should use proper await patterns
- Heavy computations should be offloaded to background workers

### Style (P2 — suggest, don't block)
- Follow the patterns in src/utils/ for new utility functions
- Prefer early returns over deeply nested conditionals
- TypeScript types should be explicit, avoid `any`

## Repository Structure

- `src/api/` — Express route handlers (thin controllers only)
- `src/services/` — Business logic (all DB calls live here)
- `src/models/` — Prisma schema and model types
- `tests/` — Jest test files mirror src/ structure

## What NOT to Flag

- Minor style differences that don't affect readability
- Test file formatting (we're relaxed there)
- Comments in languages other than English (international team)

## Auto-Fix Permission

When running in CI auto-fix mode, you MAY:
- Edit source files to fix broken tests
- Add missing error handling
- Fix type errors

You MUST NOT:
- Modify test files
- Change database schema files without explicit instruction
- Delete files

yamlname: Specialized Code Review

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  contents: read
  pull-requests: write

jobs:
  security-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            You are a security engineer. Review only the security aspects of 
            this PR: authentication, authorization, input validation, injection 
            vulnerabilities, secrets exposure. Post findings as PR review 
            comments with severity: CRITICAL, HIGH, MEDIUM, LOW.

  performance-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            You are a performance engineer. Review this PR for: database 
            query efficiency, caching opportunities, algorithmic complexity, 
            and blocking I/O patterns. Focus on changes that touch the data 
            access layer.

  api-contract-review:
    runs-on: ubuntu-latest
    # Only runs when API files change
    if: contains(github.event.pull_request.changed_files, 'src/api/')
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this PR for API contract changes. Flag any breaking 
            changes to: request/response shapes, removed endpoints, 
            changed authentication requirements, or modified status codes.
            Cross-reference with the OpenAPI spec in docs/api-spec.yaml.

yamlon:
  pull_request:
    types: [opened, synchronize]
    paths-ignore:
      - '**.md'
      - 'docs/**'
      - '.github/**'
      - '*.txt'

yaml- name: Claude Review
  run: |
    claude -p "$(cat review-prompt.txt)" \
      --max-turns 3 \
      --output-format json
  env:
    ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

yaml- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    enable_prompt_caching: true  # Caches CLAUDE.md and system context
    prompt: "Review this PR for security issues."

yaml- name: Get PR diff
  run: |
    git diff origin/${{ github.base_ref }}...HEAD > pr-diff.txt

- name: Claude Review
  uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    prompt: |
      Review the following diff only. Do not read other files unless 
      a specific line in the diff requires understanding context.
      
      $(cat pr-diff.txt)

markdown## Comment Policy (CI Mode)
Post at most 8 inline comments per review. Prioritize P0 security 
issues, then P1 bugs, then P2 style. If you find more than 8 issues, 
post a summary comment listing the remainder rather than individual 
inline comments.

yaml- name: Claude Auto-Fix
  uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    prompt: "Fix the failing tests. Make the minimal change needed."

- name: Verify Fix
  run: npm test
  # If this fails, the workflow fails — no broken commit pushed