What the developer wrote
Authored by Matt Corallo
Add claude code reviewing
We can tweak the prompt as we get experience, for now its just the
one copied
https://github.com/anthropics/claude-code-action/blob/main/docs/solutions.md
What changed, and why it matters
This commit adds a new GitHub Actions workflow that uses an Anthropic Claude AI assistant to automatically review pull requests. It is a CI/automation change, not a code change to the Lightning library itself. There is no direct security vulnerability in the diff, though any automated tool granted pull-request write permissions introduces a future supply-chain and permissions-management consideration.
No immediate security patch is required. As a hygiene measure, the project should pin the third-party action to a verified SHA, scope permissions to the minimum required, monitor for prompt-injection or tool-escape issues in the Claude action, and review any comments the bot posts before acting on them. This commit itself can be treated as a normal CI tooling addition.
Security signals we found
New GitHub Actions workflow with pull-request write permissions
Use of third-party action anthropics/claude-code-action@v1
id-token: write permission enables OIDC token issuance
Automated AI reviewer has ability to post PR comments
Evidence from the diff
The commit creates .github/workflows/claude-review.yml. It triggers on pull_request opened/synchronize events, runs on ubuntu-latest, and grants contents: read, pull-requests: write, and id-token: write permissions. It checks out the PR with fetch-depth: 1 and invokes anthropics/claude-code-action@v1, passing an Anthropic API key from repository secrets and a prompt instructing Claude to review code quality, bugs, security, and performance, using specific GitHub CLI and MCP tool calls. The workflow is purely additive and does not modify application code, cryptography, networking, or consensus logic.
Changed components
.github/workflows/claude-review.ymlInspect captured patch +38 / −0
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
new file mode 100644
index 0000000..c6c326d
--- /dev/null
+++ b/.github/workflows/claude-review.yml
@@ -0,0 +1,38 @@
+name: Claude Auto Review
+on:
+ pull_request:
+ types: [opened, synchronize]
+
+jobs:
+ review:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: write
+ id-token: write
+ steps:
+ - uses: actions/checkout@v6
+ with:
+ fetch-depth: 1
+
+ - uses: anthropics/claude-code-action@v1
+ with:
+ anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+ prompt: |
+ REPO: ${{ github.repository }}
+ PR NUMBER: ${{ github.event.pull_request.number }}
+
+ Please review this pull request with a focus on:
+ - Code quality and best practices
+ - Potential bugs or issues
+ - Security implications
+ - Performance considerations
+
+ Note: The PR branch is already checked out in the current working directory.
+
+ Use `gh pr comment` for top-level feedback.
+ Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
+ Only post GitHub comments - don't submit review text as messages.
+
+ claude_args: |
+ --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.