[CDX-265] Add CC workflow

[Alexey-Pavlov]

No description provided.

[Copilot]

Pull request overview

This PR adds Claude Code Review integration to the repository by introducing a GitHub Actions workflow and a detailed review command configuration.

• Adds automated PR review workflow triggered on pull request events
• Defines comprehensive code review guidelines and standards for the review process

Reviewed changes

Copilot reviewed 1 out of 1 changed files in this pull request and generated no comments.

File	Description
.github/workflows/claude-review.yml	Introduces a new GitHub Actions workflow that triggers Claude PR reviews on pull request events (opened, ready_for_review, synchronize), using a reusable workflow from a shared repository
.claude/commands/review.md	Defines a comprehensive review command with detailed guidelines covering security audits (OWASP Top 10), code quality standards, testing requirements, and output formatting instructions for conducting thorough code reviews

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[constructor-claude-bedrock]

Code Review Summary

This PR adds a Claude Code automated PR review workflow to the repository. The workflow integrates with Constructor.io's shared reusable workflow infrastructure to automatically review pull requests. Overall, the implementation is clean and follows the existing patterns in the repository.

Detailed Feedback

[File: .github/workflows/claude-review.yml]

Positive observations:

• ✅ The workflow follows the same pattern as the existing dependabot-alerts-to-slack.yml workflow, maintaining consistency in the codebase
• ✅ Uses a reusable workflow from a shared repository (Constructor-io/shared-claude-code-resources-public), promoting code reuse and centralized maintenance
• ✅ Properly inherits secrets using secrets: inherit, which is the recommended approach for reusable workflows
• ✅ The trigger conditions are appropriate for a code review workflow:
  • opened - Reviews new PRs
  • ready_for_review - Reviews when draft PRs are marked ready
  • synchronize - Reviews when new commits are pushed

Suggestions for consideration:

1. [Line 9] Security consideration: The workflow uses secrets: inherit, which passes all repository secrets to the reusable workflow. While this is convenient and likely necessary for the Claude Code integration, ensure that:

   • The reusable workflow repository (Constructor-io/shared-claude-code-resources-public) is properly secured
   • Only necessary secrets are available at the repository level
   • Consider documenting which specific secrets this workflow requires

2. [Line 9] Version pinning: The workflow references @main branch of the shared workflow. Consider:

   • Using a specific commit SHA (e.g., @sha256:abc123...) or a versioned tag (e.g., @v1.0.0) for better reproducibility and security
   • This prevents unexpected behavior if the shared workflow is updated with breaking changes
   • Example: uses: Constructor-io/shared-claude-code-resources-public/.github/workflows/claude-code-review.yml@v1.0.0

3. Documentation: Consider adding a comment at the top of the workflow file explaining:

   • What the Claude Code review does
   • What secrets/permissions are required
   • Link to documentation about Claude Code or the shared workflow

Example with improvements:

# Automated code review using Claude Code
# Requires: CLAUDE_API_KEY secret to be configured
# Documentation: https://internal-docs/claude-code-setup
name: Claude PR Review

on:
  pull_request:
    types: [opened, ready_for_review, synchronize]

jobs:
  review:
    uses: Constructor-io/shared-claude-code-resources-public/.github/workflows/claude-code-review.yml@v1.0.0
    secrets: inherit

Conclusion

This is a straightforward and well-implemented addition that will provide automated code review assistance. The workflow follows established patterns in the repository and uses appropriate triggers. The main recommendations are around security best practices (version pinning) and documentation to help future maintainers understand the workflow's requirements and behavior.

Recommendation: Approve with minor suggestions for enhancement ✅

The workflow is ready to merge as-is, but consider the suggestions above for improved security and maintainability.