Enable automatic Claude PR reviews in dotcms/core

[sfreudenthaler]

Context

We currently trigger Claude via @claude mentions using issue_comment_claude-code-review.yaml. We want automatic reviews on PR open/sync — no mention required.

dotcms/infrastructure-as-code already has this working via the reusable dotCMS/ai-workflows/.github/workflows/claude-orchestrator.yml@v1.0.0. Pattern is proven. The infra repo's review prompt is verbose and checklist-heavy — we don't want that.

Work

Update (or create alongside) the existing workflow to add:

pull_request:
  types: [opened, synchronize]

Add a claude-automatic-review job with trigger_mode: automatic. Gate it to skip if the PR title or body already contains @claude (avoid double-triggering alongside interactive mode).

Prompt Direction

The review persona should be a strong senior/staff engineer. Direct, specific, no preamble. The prompt should be roughly:

Review this PR. Flag anything that looks wrong, risky, or worth a second look — bad assumptions, missing edge cases, design problems, security issues. Skip praise. If it's clean, say so in one line.

No bullet-point checklists. No "great job on X". If there's nothing to flag, a short "LGTM" is fine.

Reference

• Existing workflow: .github/workflows/issue_comment_claude-code-review.yaml
• Working example: dotcms/infrastructure-as-code → .github/workflows/remote-ai-checks.yml (claude-automatic-review job)
• Reusable workflow: dotCMS/ai-workflows/.github/workflows/claude-orchestrator.yml@v1.0.0

[sfreudenthaler]

@claude have a go at this. Create a new branch and use conventional commit strategy.

[claude]

Claude finished @sfreudenthaler's task —— View job

---

Implementing Automatic Claude PR Reviews ❌

Critical Limitation Identified

I cannot modify files in the .github/workflows directory due to GitHub App permissions restrictions. This is a security measure to prevent workflow modifications that could potentially compromise repository security.

Todo List:

• Read existing workflow file structure
• Examine reference implementation pattern
• Identify GitHub App permission limitation
• Create/update workflow with automatic PR review job (Cannot execute - permissions)
• Add gating logic to prevent double-triggering (Cannot execute - permissions)
• Implement senior engineer review prompt (Cannot execute - permissions)

What I Found

I successfully analyzed the existing workflow structure:

• Current file: .github/workflows/issue_comment_claude-code-review.yaml
• Uses dotCMS/ai-workflows/.github/workflows/claude-orchestrator.yml@v1.0.0
• Has proper security checks and concurrency control
• Currently only supports trigger_mode: interactive (mention-based)

Recommended Implementation

Since I cannot directly modify the workflow, here's the complete workflow configuration that needs to be manually added:

Option 1: Update existing file - Add this job to the current workflow:

# Add to existing .github/workflows/issue_comment_claude-code-review.yaml after line 79
  # Automatic Claude PR reviews (no mention required)  
  claude-automatic-review:
    needs: security-check
    if: >
      needs.security-check.outputs.authorized == 'true' &&
      github.event_name == 'pull_request' &&
      !contains(github.event.pull_request.title, '@claude') &&
      !contains(github.event.pull_request.body, '@claude')
    uses: dotCMS/ai-workflows/.github/workflows/claude-orchestrator.yml@v1.0.0
    with:
      trigger_mode: automatic
      allowed_tools: |
        Bash(git status)
        Bash(git diff)
      timeout_minutes: 15
      runner: ubuntu-latest
      custom_prompt: |
        Review this PR. Flag anything that looks wrong, risky, or worth a second look — bad assumptions, missing edge cases, design problems, security issues. Skip praise. If it's clean, say so in one line.
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Option 2: Create separate workflow - New file .github/workflows/pr_automatic_claude-review.yaml:

name: Claude Automatic PR Review

concurrency:
  group: claude-auto-${{ github.event.pull_request.number }}
  cancel-in-progress: false

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  security-check:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      authorized: ${{ steps.membership-check.outputs.is_member }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Check organization membership
        id: membership-check
        uses: ./.github/actions/security/org-membership-check
        with:
          username: ${{ github.event.pull_request.user.login }}

  claude-automatic-review:
    needs: security-check
    if: >
      needs.security-check.outputs.authorized == 'true' &&
      !contains(github.event.pull_request.title, '@claude') &&
      !contains(github.event.pull_request.body, '@claude')
    uses: dotCMS/ai-workflows/.github/workflows/claude-orchestrator.yml@v1.0.0
    with:
      trigger_mode: automatic
      allowed_tools: |
        Bash(git status)
        Bash(git diff)
      timeout_minutes: 15
      runner: ubuntu-latest
      custom_prompt: |
        Review this PR. Flag anything that looks wrong, risky, or worth a second look — bad assumptions, missing edge cases, design problems, security issues. Skip praise. If it's clean, say so in one line.
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}

Next Steps

A human with appropriate permissions needs to:

1. Choose one of the above approaches
2. Manually create/update the workflow file
3. Test with a sample PR to ensure gating logic works correctly
4. Verify the senior engineer review prompt produces the desired tone

Alternative Solution

You can find more information and potential workarounds in the Claude Code FAQ, including how to grant additional permissions if needed.

---

[sfreudenthaler]

@cursoragent have a go at this. Create a new branch and use conventional commit strategy.

[cursor]

Taking a look!

  

[github-actions]

PRs linked to this issue

• feat(ci): orchestrate automatic and interactive Claude reviews by @sfreudenthaler