如何用 Claude Code + GitHub Actions 自动审查 PR 代码：完整教程

# 通过 npm 安装 Claude Code（需要 Node.js 18+）
npm install -g @anthropic-ai/claude-code

# 验证安装
claude --version

# 预期输出: claude-code/1.x.x

# 设置 API 密钥
export ANTHROPIC_API_KEY="sk-ant-..."

# 对你的项目做一次测试审查
cd /path/to/your-project
claude "审查 src/main.py 文件，找出其中的 bug、安全问题和代码风格问题。以列表形式输出发现的问题。"

你是一名资深软件工程师，正在进行代码审查。请审查以下的 Pull Request diff。

## 审查规则
1. **Bug 和逻辑错误（严重）：** 检查差一错误、空指针风险、竞态条件、API 使用错误。如果发现 bug，解释为什么有问题，并给出修复建议（含代码）。
2. **安全问题（高危）：** SQL 注入、XSS、硬编码密钥、缺少输入校验、不安全反序列化。
3. **性能问题（中危）：** N+1 查询、不必要的内存分配、缺少索引、同步调用应改为异步。
4. **代码风格（低危）：** 命名不规范、不一致的模式、缺少类型标注。只在真正影响可读性时才提——不要纠结格式问题。

## 输出格式
每个问题使用以下精确格式，方便 CI 脚本解析：

## 重要事项
- 跳过 import 顺序、空格、代码格式等问题——linter 已经处理了。
- 如果 PR 完全是文档修改，输出 "No code changes to review — documentation PR, skipping."
- 最多列出 10 个最重要的问题。不要列举每一个小问题。
- 如果不确定某个发现是否真实存在，标记为 SEVERITY: low 并附加 "CONFIDENCE: uncertain"。

以下是需要审查的 PR diff：

name: Claude Code PR Review

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  ai-review:
    runs-on: ubuntu-latest
    if: github.event.pull_request.draft == false
    timeout-minutes: 15

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0  # 完整历史，用于准确计算 diff

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install Claude Code CLI
        run: npm install -g @anthropic-ai/claude-code

      - name: Generate PR diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > /tmp/pr.diff
          echo "diff_lines=$(wc -l < /tmp/pr.diff)" >> $GITHUB_OUTPUT
          echo "diff_size=$(stat -c%s /tmp/pr.diff)" >> $GITHUB_OUTPUT

      - name: Skip if diff too large
        if: steps.diff.outputs.diff_lines > 5000
        run: |
          echo "⚠️ Diff 超过 5000 行 (${{ steps.diff.outputs.diff_lines }})，跳过 AI 审查以避免 Token 溢出。"
          echo "LARGE_DIFF=true" >> $GITHUB_ENV

      - name: Run Claude Code Review
        if: env.LARGE_DIFF != 'true'
        env:
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
        run: |

# 拼接提示词模板和 diff
          cat .github/claude-code-review-prompt.md /tmp/pr.diff > /tmp/full_prompt.md

# 以非交互模式运行 Claude Code
          claude --print --max-turns 1 \
            -p "$(cat /tmp/full_prompt.md)" \
            > /tmp/review_output.txt 2>/tmp/review_error.txt

          echo "审查输出行数: $(wc -l < /tmp/review_output.txt)"

      - name: Post Review Comments
        if: env.LARGE_DIFF != 'true'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_NUMBER: ${{ github.event.pull_request.number }}
        run: |
          python3 .github/scripts/post_review_comments.py \
            /tmp/review_output.txt \
            $PR_NUMBER

# !/usr/bin/env python3
"""解析 Claude Code 审查输出，回贴到 GitHub PR。"""
import os, re, sys, json, urllib.request

GITHUB_TOKEN = os.environ["GITHUB_TOKEN"]
REPO = os.environ["GITHUB_REPOSITORY"]
PR_NUMBER = sys.argv[2] if len(sys.argv) > 2 else os.environ.get("PR_NUMBER")
REVIEW_FILE = sys.argv[1]

if not PR_NUMBER:
    print("ERROR: PR_NUMBER not set")
    sys.exit(1)

# 解析 Claude Code 输出
with open(REVIEW_FILE) as f:
    text = f.read()

# 匹配 FILE/LINE/SEVERITY/ISSUE/SUGGESTION 块
pattern = re.compile(
    r"FILE:\s*(.+?)\n"
    r"LINE:\s*(\d+)\n"
    r"SEVERITY:\s*(critical|high|medium|low)\n"
    r"ISSUE:\s*(.+?)\n"
    r"SUGGESTION:\s*(.+?)(?:\n---|\n$|\Z)",
    re.DOTALL
)

findings = []
for m in pattern.finditer(text):
    findings.append({
        "path": m.group(1).strip(),
        "line": int(m.group(2)),
        "severity": m.group(3).strip(),
        "issue": m.group(4).strip(),
        "suggestion": m.group(5).strip(),
    })

print(f"从审查输出中解析出 {len(findings)} 条发现")

if not findings:

# 没有问题，贴一条正面总结
    print("未发现问题 — 贴出正面审查总结")
    findings = [{
        "path": "GENERAL",
        "line": 1,
        "severity": "low",
        "issue": "✅ Claude Code 自动审查未发现严重问题",
        "suggestion": "做得很好！继续进行人工审查，关注业务逻辑和架构决策。",
    }]

# 逐条贴到 PR
api_base = f"https://api.github.com/repos/{REPO}/pulls/{PR_NUMBER}"

severity_emoji = {
    "critical": "🔴", "high": "🟠", "medium": "🟡", "low": "🟢"
}

for f in findings:
    body = f"**{severity_emoji.get(f['severity'], '')} [{f['severity'].upper()}] {f['issue']}**\n\n{f['suggestion']}\n\n---\n*🤖 Claude Code 自动审查*"

    payload = json.dumps({
        "body": body,
        "path": f["path"] if f["path"] != "GENERAL" else None,
        "line": f["line"] if f["path"] != "GENERAL" else None,
        "side": "RIGHT",
    }).encode()

    url = f"{api_base}/comments"
    req = urllib.request.Request(url, data=payload, method="POST")
    req.add_header("Authorization", f"token {GITHUB_TOKEN}")
    req.add_header("Accept", "application/vnd.github+json")
    req.add_header("Content-Type", "application/json")

    try:
        with urllib.request.urlopen(req) as resp:
            result = json.loads(resp.read())
            print(f"  ✅ 已贴出: {f['path']}:{f['line']} [{f['severity']}] — 评论 ID {result.get('id')}")
    except urllib.error.HTTPError as e:
        err_body = e.read().decode()
        print(f"  ❌ 贴出失败 {f['path']}:{f['line']}: {e.code} — {err_body[:200]}")

print(f"\n完成。共 {len(findings)} 条评论已贴至 PR #{PR_NUMBER}")

chmod +x .github/scripts/post_review_comments.py

git add .github/
git commit -m "添加 Claude Code 自动 PR 审查工作流"
git push

# 创建一个故意有问题的分支来测试
git checkout -b test-ai-review
echo "def divide(a, b): return a / b  # 如果 b=0 呢？" > src/buggy.py
git add src/buggy.py
git commit -m "添加除法函数（故意缺零检查）"
git push origin test-ai-review

# 通过 GitHub CLI 创建 PR
gh pr create --title "测试：AI 审查有 bug 的代码" --body "测试 Claude Code 自动审查"