Skip to content

feat: add Claude Code Security Review GitHub Actions workflow - #2932

Merged
junkisai merged 4 commits into
mainfrom
devin/1754533463-claude-security-review
Aug 7, 2025
Merged

feat: add Claude Code Security Review GitHub Actions workflow#2932
junkisai merged 4 commits into
mainfrom
devin/1754533463-claude-security-review

Conversation

@devin-ai-integration

@devin-ai-integration devin-ai-integration Bot commented Aug 7, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Issue

Request from @MH4GF to set up Claude Code Security Review GitHub Actions workflow based on the Quick Start guide from anthropics/claude-code-security-review.

Why is this change needed?

This adds automated AI-powered security review to pull requests using Anthropic's Claude Code Security Review action. The workflow will analyze code changes for potential security vulnerabilities and post findings as PR comments, helping catch security issues early in the development process.

What was changed?

  • New workflow file: Added .github/workflows/claude-security-review.yml that triggers on pull request events
  • Pinned to commit hash: Uses anthropics/claude-code-security-review@c19afa74097b892109a6598b94297280ce7d1beb instead of @main as requested
  • API authentication: Configured to use secrets.ANTHROPIC_API_KEY for Claude API access
  • Project integration: Reuses existing ./.github/actions/pnpm-setup action for consistency
  • Appropriate exclusions: Excludes node_modules,dist,build,.next directories from security scanning
  • Security compliance: Added persist-credentials: false to resolve ghalint policy violation
  • Reasonable timeout: Set to 30 minutes with checkout depth 0 for full history access
  • File rename: Renamed from security.yml to claude-security-review.yml for better naming clarity

Key configuration details

name: Claude Code Security Review
on:
  pull_request:
    types: [opened, synchronize, reopened]
permissions:
  contents: read
  pull-requests: write
  issues: write

The workflow will:

  1. Checkout the repository with full history
  2. Set up pnpm using the existing action
  3. Run Claude security analysis on code changes
  4. Post results as PR comments and upload artifacts

Human Review Checklist

⚠️ Critical items to verify:

  1. Commit hash verification: Verify c19afa74097b892109a6598b94297280ce7d1beb is the latest commit from anthropics/claude-code-security-review and is secure
  2. Secret configuration: Confirm ANTHROPIC_API_KEY is properly configured in repository secrets with appropriate scope
  3. Permissions review: Confirm the workflow permissions (pull-requests: write, issues: write) are appropriate for your security model
  4. Test on sample PR: The workflow is untested - strongly recommend testing on a sample PR to verify it works as expected and doesn't break CI
  5. Performance impact: Monitor CI performance after merge as this adds another step to every PR
  6. False positive handling: Plan for how to handle AI security review false positives or overly aggressive flagging

⚠️ Known risks:

  • This workflow cannot be fully tested until after merge since it triggers on PR events
  • External dependency on Anthropic's action and API reliability
  • Potential for AI to flag legitimate code patterns as security issues

Notes

The workflow follows the same patterns as the existing claude.yml workflow for consistency with the project's CI/CD practices.

@devin-ai-integration @MH4GF
feat: add Claude Code Security Review GitHub Actions workflow
7324913 
- Add security.yml workflow based on anthropics/claude-code-security-review Quick Start guide
- Use latest commit hash c19afa74097b892109a6598b94297280ce7d1beb instead of @main
- Configure with secrets.ANTHROPIC_API_KEY for authentication
- Trigger on pull request events for automated security review
- Include appropriate exclusions for node_modules, dist, build, .next directories

Co-Authored-By: hirotaka.miyagi@route06.co.jp <h.miyagi.cnw@gmail.com>
@devin-ai-integration

devin-ai-integration Bot commented Aug 7, 2025

Copy link
Copy Markdown
Contributor Author

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

  • Address comments on this PR that start with 'DevinAI'.
  • Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

  • Disable automatic comment and CI monitoring

@changeset-bot

changeset-bot Bot commented Aug 7, 2025 •
edited
Loading

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: 5246552

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@vercel

vercel Bot commented Aug 7, 2025 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
liam-app ✅ Ready (Inspect) Visit Preview 💬 Add feedback Aug 7, 2025 3:04am
liam-erd-sample ✅ Ready (Inspect) Visit Preview 💬 Add feedback Aug 7, 2025 3:04am
liam-storybook ✅ Ready (Inspect) Visit Preview 💬 Add feedback Aug 7, 2025 3:04am
1 Skipped Deployment
Name Status Preview Comments Updated (UTC)
liam-docs ⬜️ Ignored (Inspect) Visit Preview Aug 7, 2025 3:04am

@coderabbitai

coderabbitai Bot commented Aug 7, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Support

Need help? Join our Discord community for assistance with any issues or questions.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@supabase

supabase Bot commented Aug 7, 2025 •
edited
Loading

Copy link
Copy Markdown

Updates to Preview Branch (devin/1754533463-claude-security-review) ↗︎

Deployments Status Updated
Database ✅ Thu, 07 Aug 2025 03:01:05 UTC
Services ✅ Thu, 07 Aug 2025 03:01:05 UTC
APIs ✅ Thu, 07 Aug 2025 03:01:05 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks Status Updated
Configurations ✅ Thu, 07 Aug 2025 03:01:06 UTC
Migrations ✅ Thu, 07 Aug 2025 03:01:06 UTC
Seeding ✅ Thu, 07 Aug 2025 03:01:06 UTC
Edge Functions ✅ Thu, 07 Aug 2025 03:01:06 UTC

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

@devin-ai-integration @MH4GF
fix: add persist-credentials: false to checkout step
64e69ad 
- Resolves ghalint policy violation checkout_persist_credentials_should_be_false
- Required by repository security policies

Co-Authored-By: hirotaka.miyagi@route06.co.jp <h.miyagi.cnw@gmail.com>
@devin-ai-integration @MH4GF
refactor: rename workflow file to claude-security-review.yml
5f7964d 
- Rename .github/workflows/security.yml to .github/workflows/claude-security-review.yml
- Requested by @MH4GF for better naming consistency

Co-Authored-By: hirotaka.miyagi@route06.co.jp <h.miyagi.cnw@gmail.com>
@MH4GF

MH4GF commented Aug 7, 2025

Copy link
Copy Markdown
Contributor

It seems that the result is saved as an artifact. This is not so easy to see, but I would like to merge it once and see how it goes.

https://github.com/liam-hq/liam/actions/runs/16793594492/job/47559740952

@MH4GF
MH4GF marked this pull request as ready for review August 7, 2025 02:55
Copilot AI review requested due to automatic review settings August 7, 2025 02:55
@MH4GF
MH4GF requested a review from a team as a code owner August 7, 2025 02:55
@MH4GF
MH4GF requested review from FunamaYukina, NoritakaIkeda, hoshinotsuyoshi and junkisai and removed request for a team August 7, 2025 02:55
Copilot AI reviewed Aug 7, 2025
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds automated AI-powered security review to pull requests using Anthropic's Claude Code Security Review GitHub Actions workflow. The workflow will analyze code changes for potential security vulnerabilities and provide feedback as PR comments.

Key changes:

  • Added new GitHub Actions workflow for automated security review on pull requests
  • Configured to use Claude API with proper authentication and exclusions
  • Integrated with existing project infrastructure using the pnpm-setup action

Comment thread .github/workflows/claude-security-review.yml
Comment thread .github/workflows/claude-security-review.yml Outdated
@MH4GF
Update .github/workflows/claude-security-review.yml
5246552 
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
junkisai
junkisai approved these changes Aug 7, 2025
View reviewed changes

@junkisai junkisai left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@junkisai
junkisai added this pull request to the merge queue Aug 7, 2025
Merged via the queue into main with commit e2a2eec Aug 7, 2025
31 checks passed
@junkisai
junkisai deleted the devin/1754533463-claude-security-review branch August 7, 2025 09:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@hoshinotsuyoshi hoshinotsuyoshi Awaiting requested review from hoshinotsuyoshi hoshinotsuyoshi is a code owner automatically assigned from liam-hq/liam-dev
@FunamaYukina FunamaYukina Awaiting requested review from FunamaYukina FunamaYukina is a code owner automatically assigned from liam-hq/liam-dev
@NoritakaIkeda NoritakaIkeda Awaiting requested review from NoritakaIkeda NoritakaIkeda is a code owner automatically assigned from liam-hq/liam-dev
+2 more reviewers
@junkisai junkisai junkisai approved these changes
@MH4GF MH4GF MH4GF approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@MH4GF MH4GF

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@MH4GF @junkisai