CI/CD Automation

# WHAT: Run Claude Code in headless print mode
# WHY:  -p sends a single prompt and exits — no interactive session opened
# GOTCHA: Set ANTHROPIC_API_KEY before running; exit code is non-zero on error

export ANTHROPIC_API_KEY="sk-ant-..."   # In CI: use ${{ secrets.ANTHROPIC_API_KEY }}

# Basic print mode
claude -p "Review this function for off-by-one errors: $(cat main.py)"

# JSON output (parse with jq)
result=$(claude -p "Summarize this diff" --output-format json)
echo "$result" | jq '.result'

# Read diff from stdin
git diff HEAD~1 | claude -p "Review this diff for security issues. Output as JSON with fields: severity, files_affected, recommendation" --output-format json

# WHAT: Automated PR review using Claude Code — runs on every PR
# WHY:  Catches logic bugs, security issues, and missing error handling
#       before a human reviewer sees the PR
# GOTCHA: Set ANTHROPIC_API_KEY in repo Settings → Secrets → Actions

name: Claude Code PR Review

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  pull-requests: write    # needed to post comments
  contents: read

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0    # full history so git diff works correctly

      # WHAT: Official Claude Code GitHub Action
      # WHY:  Handles Node.js install, API key injection, and error handling
      - name: Run Claude Code review
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          # WHAT: The prompt Claude sees — customize for your team's standards
          prompt: |
            You are a senior engineer reviewing a pull request.
            Review the diff below for:
            1. Logic errors and off-by-one bugs
            2. Security issues (SQL injection, XSS, secret exposure)
            3. Missing error handling
            4. Performance regressions
            5. Tests that should exist but don't

            Be specific — reference exact file:line numbers.
            Format: ### Summary\n\n### Issues Found\n\n### Suggestions

          # WHAT: Post review as a PR comment
          post_as_comment: true

          # GOTCHA: Limit diff size to avoid very large token counts
          max_diff_lines: 800

# WHAT: Run Gemini CLI in fully non-interactive headless mode
# WHY:  --no-interactive prevents the REPL from opening
#       --yolo skips all "are you sure?" confirmation prompts
# GOTCHA: --yolo is required for unattended file writes in CI

export GEMINI_API_KEY="AIza..."   # In CI: use ${{ secrets.GEMINI_API_KEY }}

# Non-interactive prompt
gemini -p "Review this code for bugs" --no-interactive

# JSON output (parse with jq)
result=$(gemini -p "Analyze dependencies" --no-interactive --output-format json)
echo "$result" | jq '.response'

# With --yolo for unattended file operations
gemini -p "Add JSDoc comments to all functions in utils.js" --yolo --no-interactive

# Use flash model in CI to stay within free tier limits
gemini -p "Triage this issue" --model gemini-2.0-flash --no-interactive

# WHAT: Automated PR review using Gemini CLI — free tier works for most teams
# WHY:  60 req/min free tier means small teams pay $0 for CI reviews
# GOTCHA: Free tier is per-account; if you have multiple repos, budget shared

name: Gemini CLI PR Review

on:
  pull_request:
    types: [opened, synchronize]

permissions:
  pull-requests: write
  contents: read

jobs:
  gemini-review:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get PR diff
        id: diff
        run: |
          git diff origin/${{ github.base_ref }}...HEAD > pr_diff.txt
          echo "diff_size=$(wc -l < pr_diff.txt)" >> $GITHUB_OUTPUT

      # WHAT: Official Google GitHub Action for Gemini CLI
      # WHY:  Handles install, auth, and clean output capture
      - name: Run Gemini CLI review
        id: gemini
        uses: google-github-actions/run-gemini-cli@v1
        with:
          gemini_api_key: ${{ secrets.GEMINI_API_KEY }}
          # WHAT: Use Flash model in CI to preserve free-tier quota
          model: gemini-2.0-flash
          flags: "--no-interactive --yolo"
          prompt: |
            Review the following PR diff as a senior engineer.
            Focus on: logic bugs, security, missing tests, performance.
            Be concise — reference exact file:line numbers.
            Diff:
            $(cat pr_diff.txt)

      # WHAT: Post Gemini's review as a PR comment
      - name: Post review comment
        uses: actions/github-script@v7
        with:
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `## Gemini CLI Review\n\n${{ steps.gemini.outputs.response }}`
            })