GitHub Actions Integration

Name: ANTHROPIC_API_KEY
Value: sk-ant-... (Anthropic API key)

name: Claude Code Review
on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  contents: read
  pull-requests: write
  issues: write

jobs:
  claude-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Claude Code Review
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          review_comment_prefix: "vibecosystem-review"
          direct_prompt: |
            Review this PR for:
            1. Code quality and patterns
            2. Security vulnerabilities (OWASP Top 10)
            3. Performance issues
            4. Test coverage gaps
            5. Breaking changes

            Use vibecosystem's code-reviewer agent standards.
            Provide VERDICT: PASS | WARN | FAIL

name: Claude Code Fix
on:
  issues:
    types: [labeled]

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  claude-fix:
    if: contains(github.event.label.name, 'claude-fix')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Claude Code Fix
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          direct_prompt: |
            Fix the issue described below.
            Follow TDD workflow: write test first, then implement fix.
            Create a PR with the fix.

            Issue: ${{ github.event.issue.title }}
            Body: ${{ github.event.issue.body }}

on:
  pull_request:
    types: [opened, synchronize, reopened]
    paths:
      - '**.ts'
      - '**.tsx'
      - '**.js'
      - '**.jsx'

direct_prompt: |
  Review this PR using vibecosystem standards:

  ## Code Quality
  - Immutability: no mutations, use spread operator
  - File size: max 800 lines per file
  - Function size: max 50 lines
  - Nesting: max 4 levels
  - No console.log in production code
  - No hardcoded values

  ## Security (OWASP Top 10)
  - Input validation (use zod)
  - SQL injection prevention
  - XSS prevention
  - No hardcoded credentials
  - Rate limiting check

  ## Testing
  - Test coverage >= 80%
  - Edge cases covered
  - Error paths tested

  VERDICT: PASS | WARN | FAIL

direct_prompt: |
  Fix the issue below.
  Rules:
  - TDD: write failing test first, then implement
  - Defensive code: try/catch, null checks, input validation
  - No mutations, use immutable patterns
  - Follow repository's existing code style
  - Run tests before creating PR

  Issue: ${{ github.event.issue.title }}
  Body: ${{ github.event.issue.body }}

jobs:
  claude-fix:
    if: contains(github.event.label.name, 'claude-fix')
    # ... standard fix

  claude-refactor:
    if: contains(github.event.label.name, 'claude-refactor')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          direct_prompt: |
            Refactor the code described in this issue.
            Maintain all existing tests.
            Do not change external behavior.
            Issue: ${{ github.event.issue.title }}
            Body: ${{ github.event.issue.body }}

# Project Rules
- Follow vibecosystem coding standards
- Use TDD workflow for all changes
- Security review required for auth/data code
- VERDICT format: PASS | WARN | FAIL