From bcbc2fa8ae447e158719e899372cf777cece3b8b Mon Sep 17 00:00:00 2001 From: Alan Locke Date: Tue, 21 Jul 2026 13:36:23 -0500 Subject: [PATCH] Fleet v2: reusable-review shim, AGENTS.md header, read-deny alignment Co-Authored-By: Claude Fable 5 --- .claude/settings.json | 16 +++++- .github/workflows/claude-review.yml | 86 ++++++++++------------------- AGENTS.md | 2 +- 3 files changed, 46 insertions(+), 58 deletions(-) diff --git a/.claude/settings.json b/.claude/settings.json index 2c7a288..7a67c4e 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -25,7 +25,21 @@ "Read(**/id_rsa)", "Edit(./.env)", "Edit(./.env.*)", - "Edit(./config/master.key)" + "Edit(./config/master.key)", + "Read(**/id_ed25519)", + "Edit(**/id_ed25519)", + "Read(**/*.pfx)", + "Edit(**/*.pfx)", + "Read(**/credentials.json)", + "Edit(**/credentials.json)", + "Read(**/secrets.json)", + "Edit(**/secrets.json)", + "Read(**/secrets.yml)", + "Edit(**/secrets.yml)", + "Read(**/secrets.yaml)", + "Edit(**/secrets.yaml)", + "Read(**/credentials.yml.enc)", + "Edit(**/credentials.yml.enc)" ], "ask": [ "Bash(gh pr merge:*)" diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index a6cc958..85a4dab 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -1,75 +1,49 @@ -# Claude auto-review: runs on every non-draft PR when opened or marked ready -# for review; mention @claude in a PR comment to trigger a re-review. -# Requires the org-level ANTHROPIC_API_KEY secret. name: Claude Code +# Thin shim — review logic lives in the org-wide reusable workflow +# (pipeline_deals/.github/workflows/claude-review-reusable.yml). +# This file owns only: triggers, concurrency, and the repo-specific prompt. + on: pull_request: - types: [opened, ready_for_review] + types: [opened, ready_for_review, synchronize] issue_comment: types: [created] pull_request_review_comment: types: [created] +# One run at a time per PR (queued, never cancelled). +concurrency: + group: claude-review-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }} + cancel-in-progress: false + permissions: contents: read pull-requests: write issues: write + statuses: write actions: read id-token: write jobs: claude: - if: | - (github.event_name == 'pull_request' && github.event.pull_request.draft == false) || - (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) - runs-on: ubuntu-latest - timeout-minutes: 15 - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: Acknowledge comment - # Only comment events carry github.event.comment; skip on pull_request - if: github.event_name != 'pull_request' - uses: actions/github-script@v7 - with: - script: | - if (context.eventName === 'pull_request_review_comment') { - await github.rest.reactions.createForPullRequestReviewComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: context.payload.comment.id, - content: 'eyes' - }); - } else { - await github.rest.reactions.createForIssueComment({ - owner: context.repo.owner, - repo: context.repo.repo, - comment_id: context.payload.comment.id, - content: 'eyes' - }); - } - - uses: anthropics/claude-code-action@v1 - with: - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} - prompt: | - Review this PR for a Pipeline CRM Ruby service. Focus on: - - Bugs or logic errors - - Account/tenant isolation — queries must scope by account_id; - flag unscoped find/where that could leak data across accounts - - Performance: N+1 queries, missing indexes, unbounded/unpaginated - queries, external calls (Redis, DB, HTTP) inside loops - - Sidekiq jobs: idempotent and safe to retry; pass record IDs, not - serialized objects - - Convention violations per this repo's CLAUDE.md, if present + uses: PipelineDeals/pipeline_deals/.github/workflows/claude-review-reusable.yml@master + secrets: inherit + # Caps inherit the reusable's defaults (30 turns / $1.50 / Sonnet). + with: + prompt: | + Review this PR for Mantle, Pipeline CRM's internal message bus gem + (published to rubygems.org as `mantle`). It is a packaged library with no + database — Rails apps use it to publish domain events over Redis pub/sub + and consume them via Sidekiq jobs. Focus on: + - Bugs or logic errors + - Public API compatibility — renamed methods, changed signatures, return + shapes, or configuration keys that would break existing gem consumers + - Thread safety — shared mutable state, lazily-initialized globals, + Redis connection reuse across threads + - Gemspec and dependency hygiene — version constraints (e.g. the + sidekiq < 7.0 pin), new runtime dependencies, supply chain risk + - Convention violations per this repo's AGENTS.md - You have full repo access. Read any files you need to verify your findings. - Only flag issues introduced by this PR, not pre-existing patterns. - Be concise. If the code is sound, say so in 2-3 sentences — do not - manufacture findings. Reserve detailed comments for real issues. - track_progress: true - include_fix_links: true - claude_args: "--model claude-sonnet-5 --max-turns 12 --max-budget-usd 0.75" + You have full repo access. Read any files you need to verify your findings. + Only flag issues introduced by this PR, not pre-existing patterns. diff --git a/AGENTS.md b/AGENTS.md index 1125f86..66a259c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,4 +1,4 @@ -# CLAUDE.md — mantle +# AGENTS.md — mantle Context file for AI agents and new developers. Verify against the code before relying on it; flag anything stale in a PR.