fix(ci): rewrite Claude Code workflow for working automated PR reviews

[carlos-alm]

Summary

• Fixed: Claude Code review job was running (~$4/run) but never posting comments because allowed_tools is not a valid input on @v1 and the plugin config was broken
• Switched from anthropics/claude-code-action@v1 to @beta which supports direct_prompt for automated PR reviews
• Added phased review prompt (root cause analysis → config scrutiny → test integrity → code quality) with strict rating calibration
• Added bot PR filtering to skip Dependabot/Renovate PRs
• Downgraded permissions from write to read (beta action handles posting via OIDC)

What was broken

1. allowed_tools input doesn't exist on the action — silently ignored, Claude's Bash calls were permission-denied
2. Plugin marketplace config (code-review@claude-code-plugins) wasn't loading
3. prompt on @v1 is meant for mention-triggered flows, not automated reviews

Test plan

• Open a test PR and verify the automated-review job posts a review comment
• Verify interactive-claude still responds to @claude mentions
• Verify bot PRs (dependabot) are skipped

[greptile-apps]

Greptile Summary

This PR fixes the broken Claude Code automated review workflow by switching from @v1 (which silently ignored allowed_tools and had broken plugin config) to @beta with direct_prompt for automated reviews.

Major changes:

• Split workflow into two jobs: automated-review (runs on all PRs) and interactive-claude (runs on @claude mentions)
• Replaced plugin-based review (code-review@claude-code-plugins) with inline phased review prompt
• Added bot filtering to skip Dependabot/Renovate PRs
• Downgraded permissions from write to read (relying on OIDC for posting)
• Upgraded checkout action from @v4 to @v6

Key improvements:

• The phased review prompt provides structured guidance (root cause analysis → config scrutiny → test integrity → code quality)
• Strict rating calibration (default 2-3 stars) to avoid auto-approval
• Bot filtering prevents wasted CI runs on automated dependency PRs

Considerations:

• The bot filtering logic uses github.event.pull_request.user.type != 'Bot' which should work for Dependabot but may need verification
• Permission downgrade assumes @beta action handles posting via OIDC — needs testing to confirm comments appear
• The inline prompt is quite long (~100 lines) but provides clear structure

Confidence Score: 4/5

• This PR is safe to merge with low risk — fixes a real CI issue with well-motivated changes
• Score reflects that this is a thoughtful fix to a broken workflow. The changes are well-documented, the approach is sound (switching from broken plugin config to direct_prompt), and the risk is minimal since this only affects CI automation, not production code. Main uncertainty is whether the permission downgrade will work as expected, but this can be verified in testing.
• Verify in testing that the @beta action posts comments successfully with read-only permissions via OIDC

Important Files Changed

Filename	Overview
.github/workflows/claude.yml	Restructures workflow from broken v1 plugin-based review to beta action with direct_prompt; splits into automated-review and interactive-claude jobs; downgrades permissions from write to read

_{Last reviewed commit: 1ed4121}

[greptile-apps]

_{1 file reviewed, 2 comments}

_{Edit Code Review Agent Settings | Greptile}

[greptile-apps]

Bot filtering logic may not work as expected — github.event.pull_request.user.type should check against the string 'Bot' (case-sensitive). GitHub sets this field to 'Bot' for apps like Dependabot, but verify this matches the actual API response structure.

Also note: this won't filter Renovate if it runs as a user account rather than a bot account. Consider checking github.actor against a list of known bot names if needed.

[greptile-apps]

Downgrading permissions from write to read — verify that the @beta action can post PR review comments via OIDC without needing pull-requests: write. If the action posting fails, you'll need to restore pull-requests: write.