feat: Add Claude AI code review GitHub Actions workflow for automated PR reviews

[devmdave]

Summary

This PR implements an automated code review system using Claude AI (Anthropic) integrated into our GitHub Actions CI/CD pipeline.

Motivation

Manual code reviews can be time-consuming and may miss common issues. This automated review system provides immediate feedback on:

• Security vulnerabilities
• Potential bugs and logic errors
• Code quality improvements
• Best practices violations
• Documentation gaps

The AI-powered reviews complement human reviews by catching issues early and providing consistent feedback across all pull requests.

Changes

New Files

• .github/workflows/claude-code.yml - GitHub Actions workflow configuration
• scripts/claude-review.js - Core review logic using Anthropic Claude API
• scripts/format-claude-output.js - Utility for formatting review output

Modified Files

• package.json - Added @actions/core and @actions/github dependencies

Implementation Details

The workflow:

1. Triggers on pull requests and pushes to the main branch
2. Fetches full git history for comprehensive diff analysis
3. Extracts changed files and generates git diff
4. Sends the diff to Claude AI (model: claude-sonnet-4-20250514) for analysis
5. Posts formatted review results as PR comments
6. Uploads review artifacts for future reference (30-day retention)

The review includes severity levels (🔴 Critical, 🟡 Warning, 🟢 Info) for easy prioritization.

Configuration Required

Before merging, ensure the following secret is configured in the repository:

• ANTHROPIC_API_KEY - API key for Claude AI service

Testing

The workflow has been configured with continue-on-error: true to prevent blocking the CI pipeline if the review service is unavailable.

Benefits

• ✅ Immediate automated feedback on code changes
• ✅ Consistent review quality across all PRs
• ✅ Reduced reviewer burden for common issues
• ✅ Educational for team members through AI suggestions
• ✅ Non-blocking - doesn't prevent merges if service is down

Future Enhancements

Potential improvements for follow-up PRs:

• Configurable review rules and severity thresholds
• Integration with code coverage metrics
• Custom prompts for project-specific standards
• Review result caching to avoid re-analyzing unchanged code

[semgrep-code-snapchat]

Semgrep identified an issue in your code:

wget uses an unencrypted HTTP URL to fetch libtinfo5_6.3-2ubuntu0.1_amd64.deb. A man-in-the-middle can replace the .deb and gain root code execution when it’s installed with sudo apt install.

More details about this

This workflow downloads a Debian package over plain HTTP:

• wget http://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.1_amd64.deb

Because the URL is unencrypted (HTTP), anyone able to intercept traffic (e.g., hostile Wi‑Fi/AP, corporate proxy, or BGP/DNS hijack) can swap that .deb for a malicious one. The next line installs it with sudo apt install -y ./libtinfo5_6.3-2ubuntu0.1_amd64.deb, which would execute attacker-controlled maintainer scripts as root or load a tampered libtinfo5 at runtime.

Concrete attack path

• Step 1: Attacker intercepts the HTTP request to archive.ubuntu.com and serves a trojaned libtinfo5_6.3-2ubuntu0.1_amd64.deb.
• Step 2: Your script saves the attacker’s file under the same name via wget.
• Step 3: sudo apt install -y ./libtinfo5_6.3-2ubuntu0.1_amd64.deb runs the package’s postinst script with root privileges, giving the attacker code execution in the CI runner and access to build secrets/artifacts.
• Step 4: Compromised libtinfo5 can persist in subsequent build steps, silently backdooring binaries or exfiltrating data.

To resolve this comment:

✨ Commit Assistant Fix Suggestion

1. Check if a secure (HTTPS) version of the download URL is available for the package. In this case, replace http://archive.ubuntu.com/ubuntu/... with https://archive.ubuntu.com/ubuntu/... in the wget command.
2. Update the line to:
   wget https://archive.ubuntu.com/ubuntu/pool/universe/n/ncurses/libtinfo5_6.3-2ubuntu0.1_amd64.deb
3. If the server does not support HTTPS and only HTTP is available, verify the package signature after download to ensure integrity and authenticity.
4. If you cannot switch to HTTPS and package verification is not feasible, consider obtaining the package from a different trusted source that offers HTTPS downloads.

Using HTTPS encrypts the download and prevents attackers from modifying the package in transit.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by wget-unencrypted-url.

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[semgrep-code-snapchat]

Semgrep found 9 internal-sensitive-strings findings:

• valdi/src/java/com/snap/valdi/views/ExtendedFadingEdgeRenderer.kt
  • L1 - Triage
• valdi/src/java/com/snap/valdi/nativebridge/ValdiViewManagerOperationsManager.kt
  • L25 - Triage
  • L28 - Triage
• valdi/src/java/com/snap/valdi/modules/DrawingModuleImpl.kt
  • L10 - Triage
  • L11 - Triage
• valdi/src/java/com/snap/valdi/attributes/impl/richtext/ImageAttachmentSpan.kt
  • L1 - Triage
• valdi/src/java/com/snap/valdi/attributes/impl/gestures/HitTestUtils.kt
  • L6 - Triage
• src/valdi_modules/src/valdi/valdi_tsx/src/NativeTemplateElements.d.ts
  • L1176 - Triage
  • L1221 - Triage

This literal might contain a Snapchat internal reference that should not be committed to open-source repositories.

Fix: Please replace / remove the string to avoid committing it to open-source repositories.

[semgrep-code-snapchat]

High severity vulnerability introduced by a package you're using:
Line 4009 lists a dependency (terser) with a known High severity vulnerability. Fixing requires upgrading or replacing the dependency.

ℹ️ Why this matters

terser versions before 4.8.1, >= 5.0.0 before 5.14.2 are vulnerable to Inefficient Regular Expression Complexity.

References: GHSA, CVE

To resolve this comment:
Upgrade this dependency to at least version 4.8.1 at bzl/valdi/npm/pnpm-lock.yaml.

💬 Ignore this finding

To ignore this, reply with:

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

_{You can view more details on this finding in the Semgrep AppSec Platform here.}

[clholgat]

Thanks for this proposed change. We're working on our own approach to automated review.