How to Automate PR Code Reviews with Claude Code CLI + GitHub Actions

# Install Claude Code via npm (Node.js 18+ required)
npm install -g @anthropic-ai/claude-code

# Verify installation
claude --version

# Expected: claude-code/1.x.x

# Authenticate with your Anthropic API key
export ANTHROPIC_API_KEY="sk-ant-..."

# Test on your repository
cd /path/to/your-project
claude "Review the file src/main.py for bugs, security issues, and code style problems. Output findings as a bullet list."

You are a senior software engineer conducting a code review. Review the following pull request diff.

## Review Rules
1. **Bugs & Logic Errors (CRITICAL):** Look for off-by-one errors, null pointer risks, race conditions, incorrect API usage. If you find a bug, explain WHY it's wrong and suggest the fix with code.
2. **Security Issues (HIGH):** SQL injection, XSS, hardcoded secrets, missing input validation, unsafe deserialization.
3. **Performance (MEDIUM):** N+1 queries, unnecessary allocations, missing indexes, synchronous calls where async is available.
4. **Code Style (LOW):** Naming conventions, inconsistent patterns, missing type hints. Only flag these if they genuinely hurt readability — do NOT nitpick formatting.

## Output Format
For each finding, use this exact format so our CI can parse it:

## Important
- Skip findings about import order, whitespace, or formatting — our linter handles those.
- If a PR is entirely documentation changes, say "No code changes to review — documentation PR, skipping."
- Limit to the 10 most important findings. Do not list every minor style issue.
- If you're unsure about a finding, mark it SEVERITY: low and add "CONFIDENCE: uncertain."

Here is the PR diff to review:

name: Claude Code PR Review

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  ai-review:
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # Full history for accurate diff

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Claude Code CLI
        run: npm install -g @anthropic-ai/claude-code

      - name: Generate PR diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > /tmp/pr.diff
          echo "diff_lines=$(wc -l < /tmp/pr.diff)" >> $GITHUB_OUTPUT
          echo "diff_size=$(stat -c%s /tmp/pr.diff)" >> $GITHUB_OUTPUT

      - name: Skip if diff too large
        if: steps.diff.outputs.diff_lines > 5000
        run: |
          echo "⚠️ Diff exceeds 5000 lines (${{ steps.diff.outputs.diff_lines }}). Skipping AI review to avoid token overflow."
          echo "LARGE_DIFF=true" >> $GITHUB_ENV

      - name: Run Claude Code Review
        if: env.LARGE_DIFF != 'true'
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |

# Combine prompt template + diff
          cat .github/claude-code-review-prompt.md /tmp/pr.diff > /tmp/full_prompt.md

# Run Claude Code in non-interactive mode
          claude --print --max-turns 1 \
            -p "$(cat /tmp/full_prompt.md)" \
            > /tmp/review_output.txt 2>/tmp/review_error.txt

          echo "Review output lines: $(wc -l < /tmp/review_output.txt)"

      - name: Post Review Comments
        if: env.LARGE_DIFF != 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          python3 .github/scripts/post_review_comments.py \
            /tmp/review_output.txt \
            $PR_NUMBER

# !/usr/bin/env python3
"""Parse Claude Code review output and post comments to GitHub PR."""
import os, re, sys, json, urllib.request

GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]
REPO = os.environ["GITHUB_REPOSITORY"]
PR_NUMBER = sys.argv[2] if len(sys.argv) > 2 else os.environ.get("PR_NUMBER")
REVIEW_FILE = sys.argv[1]

if not PR_NUMBER:
    print("ERROR: PR_NUMBER not set")
    sys.exit(1)

# Parse Claude Code output
with open(REVIEW_FILE) as f:
    text = f.read()

# Regex to match FILE/LINE/SEVERITY/ISSUE/SUGGESTION blocks
pattern = re.compile(
    r"FILE:\s*(.+?)\n"
    r"LINE:\s*(\d+)\n"
    r"SEVERITY:\s*(critical|high|medium|low)\n"
    r"ISSUE:\s*(.+?)\n"
    r"SUGGESTION:\s*(.+?)(?:\n---|\n$|\Z)",
    re.DOTALL
)

findings = []
for m in pattern.finditer(text):
    findings.append({
        "path": m.group(1).strip(),
        "line": int(m.group(2)),
        "severity": m.group(3).strip(),
        "issue": m.group(4).strip(),
        "suggestion": m.group(5).strip(),
    })

print(f"Parsed {len(findings)} findings from review output")

if not findings:

# Post a summary comment saying no issues found
    print("No issues found — posting positive review summary")
    findings = [{
        "path": "GENERAL",
        "line": 1,
        "severity": "low",
        "issue": "✅ Claude Code automated review found no critical issues",
        "suggestion": "Great job! Proceed with human review for logic and architecture decisions.",
    }]

# Post each finding as a PR review comment
api_base = f"https://api.github.com/repos/{REPO}/pulls/{PR_NUMBER}"

severity_emoji = {
    "critical": "🔴", "high": "🟠", "medium": "🟡", "low": "🟢"
}

for f in findings:
    body = f"**{severity_emoji.get(f['severity'], '')} [{f['severity'].upper()}] {f['issue']}**\n\n{f['suggestion']}\n\n---\n*🤖 Automated review by Claude Code*"

    payload = json.dumps({
        "body": body,
        "path": f["path"] if f["path"] != "GENERAL" else None,
        "line": f["line"] if f["path"] != "GENERAL" else None,
        "side": "RIGHT",
    }).encode()

    url = f"{api_base}/comments"
    req = urllib.request.Request(url, data=payload, method="POST")
    req.add_header("Authorization", f"token {GITHUB_TOKEN}")
    req.add_header("Accept", "application/vnd.github+json")
    req.add_header("Content-Type", "application/json")

    try:
        with urllib.request.urlopen(req) as resp:
            result = json.loads(resp.read())
            print(f"  ✅ Posted: {f['path']}:{f['line']} [{f['severity']}] — comment ID {result.get('id')}")
    except urllib.error.HTTPError as e:
        err_body = e.read().decode()
        print(f"  ❌ Failed to post {f['path']}:{f['line']}: {e.code} — {err_body[:200]}")

print(f"\nDone. {len(findings)} comments posted to PR #{PR_NUMBER}")

chmod +x .github/scripts/post_review_comments.py

git add .github/
git commit -m "Add Claude Code automated PR review workflow"
git push

# Create a branch with some intentional issues to test
git checkout -b test-ai-review
echo "def divide(a, b): return a / b  # What if b=0?" > src/buggy.py
git add src/buggy.py
git commit -m "Add division function (intentionally missing zero check)"
git push origin test-ai-review

# Create PR via GitHub CLI
gh pr create --title "Test: AI review of buggy code" --body "Testing Claude Code automated review"