From 95458518fd9d5ce0d8c5b5f630486356ccd2a7f0 Mon Sep 17 00:00:00 2001
From: BjornMonnens <bjorn.monnens@venly.io>
Date: Thu, 18 Jun 2026 16:04:41 +0200
Subject: [PATCH] ci: use centralized Claude AI code review

Delegate PR review and the @claude mention bot to the centrally-maintained
reusable workflows in Venly/venly-github-workflows (project_type: generic).
Review logic now lives in one place and is updated centrally.
---
 .github/workflows/claude-code-review.yml | 22 +++++++++++++++
 .github/workflows/claude.yml             | 35 ++++++++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 .github/workflows/claude-code-review.yml
 create mode 100644 .github/workflows/claude.yml

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
new file mode 100644
index 0000000..4fd9c81
--- /dev/null
+++ b/.github/workflows/claude-code-review.yml
@@ -0,0 +1,22 @@
+name: Claude Code Review
+
+# Thin caller — delegates to the centrally-maintained engine in
+# Venly/venly-github-workflows. Do not add review logic here; change it centrally.
+
+on:
+  pull_request:
+    types: [opened, review_requested, synchronize]
+
+permissions:
+  contents: read
+  pull-requests: write
+  issues: read
+  id-token: write
+
+jobs:
+  review:
+    uses: Venly/venly-github-workflows/.github/workflows/claude-code-review.yml@v1
+    secrets: inherit
+    with:
+      project_type: generic
+      block_on_critical: true
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
new file mode 100644
index 0000000..18e18f7
--- /dev/null
+++ b/.github/workflows/claude.yml
@@ -0,0 +1,35 @@
+name: Claude Code
+
+# Thin caller — delegates to the centrally-maintained @claude mention bot in
+# Venly/venly-github-workflows. Do not add logic here; change it centrally.
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+# The reusable workflow's token is capped by these caller permissions. id-token
+# is none by default, so it must be granted here for the action to authenticate.
+permissions:
+  contents: read
+  pull-requests: read
+  issues: read
+  id-token: write
+  actions: read # lets Claude read CI results on PRs
+
+jobs:
+  claude:
+    # Only invoke the engine on an actual @claude mention — avoids spawning a
+    # skipped workflow run on every comment/issue event.
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    uses: Venly/venly-github-workflows/.github/workflows/claude.yml@v1
+    secrets: inherit