Org-wide shared workflows and configurations for taptap.
AI-powered pull request review using Claude Code Action and GitHub Copilot. It reviews every non-draft PR for code quality, correctness, and security, posting inline comments on specific lines.
Create .github/workflows/code-review.yml in your repo:
name: Code Review on: pull_request: types: [opened, synchronize, ready_for_review] permissions: contents: read pull-requests: write id-token: write jobs: review: uses: taptap/.github/.github/workflows/code-review.yml@main secrets: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
Pass one of these. Both are declared optional so a repo can use whichever name it already has; the job fails fast if neither is set.
| Secret | Required | Description |
|---|---|---|
ANTHROPIC_API_KEY |
one of the two | Sent as x-api-key |
ANTHROPIC_AUTH_TOKEN |
one of the two | Sent as a bearer token, for gateways that want it |
Set this as an org-level secret so all repos inherit it, or per-repo if needed.
ANTHROPIC_API_KEY wins when both are present. This is a fallback on which
name exists, not a retry when a credential is rejected — Actions cannot re-run
a failed step with the other key without re-running the whole review.
Only needed when calling this as a reusable workflow (workflow_call).
| Input | Required | Default | Description |
|---|---|---|---|
pr_number |
Yes | — | PR to review (github.event.pull_request is empty here) |
is_draft |
No | false |
Skip the review while the PR is a draft |
head_repo_full_name |
No | — | Head repo, for the same-repo (anti-fork) check |
request_copilot_review |
No | true |
Set false to skip adding @copilot as a reviewer |
model |
No | claude-opus-5[1m] |
Full model ID. Must be a model your gateway allows |
The default is a pinned model ID rather than an alias (opus): aliases are
resolved inside the bundled Claude Code build, so bumping that build would
silently change which model reviews your code.
Whatever you pass must exist on the endpoint behind ANTHROPIC_BASE_URL. A
model the gateway rejects surfaces as 403 ... Model is blocked wrapped in
Claude Code's Failed to authenticate text — which reads like a bad key but is
not one.
| Variable | Required | Description |
|---|---|---|
ANTHROPIC_BASE_URL |
No | Custom API base URL (e.g. for proxy or gateway) |
Set this as an org-level variable (not a secret) if you need to route requests through a proxy.
- Triggers on PR opened, synchronized (new push), or marked ready for review.
- Skips draft PRs and PRs from forks (security).
- Concurrency — only one review runs per PR at a time; new pushes cancel in-progress reviews.
- Timeout — 15 minutes per run.
Add a REVIEW.md file to your repo root with project-specific review guidelines. The reviewer will follow them automatically.