Claude PR Review

The Hexsis method for automated Claude pull-request review. The pull request is untrusted input steering an agent that holds a model token and a GitHub token, so the setup is review-only: Claude reads, judges, and posts one formal review, and can do nothing else. Every control in the templates closes a path that has failed in practice. Keep them all unless the user decides otherwise with the trade-off in front of them.

What the setup does:

• Automatic review of ready, same-repository pull requests. A workflow step writes the diff as line-oriented files. Read-only diff-reviewer sub-agents read every source chunk in parallel, a rules-reviewer checks the change against the repository's rules, and a fresh finding-validator confirms each candidate finding. Claude then submits exactly one formal review on the head commit.
• @claude mentions on pull requests from users with write access, answered inline, on public and private repositories. Mentions cannot submit a verdict.
• Tracking comments. Each automatic review posts a github-actions comment that says Claude is reviewing, and a later job edits it to say the review finished, failed, was cancelled, or was skipped, with a link to the review job. A mention gets the action's own claude[bot] tracking comment. If a mention fails or is cancelled while that comment still says "working", a github-actions note links the failed job.
• An informational job summary of turns, denied tool calls, sub-agents, the diff lines and files read, and the review the run left. It never fails the job or dismisses a review: coverage is reported, not enforced, and the verdict is advisory.

Files