[kyleswiger]

Supersedes #10 (which was based on a stale local main). Adds allowed_bots: 'dependabot[bot]' to claude-code-review. Still requires the Dependabot-scope secret:

gh secret set CLAUDE_CODE_OAUTH_TOKEN --app dependabot -R kyleswiger/aws-deployment-tooling

🤖 Generated with Claude Code

[kyleswiger]

🤖 Gemini Automated Code Review

Reviewed automatically by Gemini PR Reviewer

📌 Executive Summary

This pull request configures the claude-code-action workflow to allow automated code reviews on Pull Requests initiated by Dependabot. By adding allowed_bots: 'dependabot[bot]' and documenting the necessary Dependabot-specific secret configuration, this change ensures dependency updates receive the same automated scrutiny as human-authored PRs without failing silently due to bot-filtering policies. The risk assessment is Very Low, and the implementation follows best practices.

---

🔍 Key Findings & Assessment

🔴 Critical / Blockers

None. The changes are syntactically correct and align with the configuration options of the anthropics/claude-code-action.

🟡 Improvements & Suggestions

• Secret Scope Verification: Dependabot runs in a restricted context. While the PR description correctly identifies the need to set the CLAUDE_CODE_OAUTH_TOKEN secret for the dependabot application scope, ensure this command has been executed in the repository settings. Without it, the workflow will fail on Dependabot PRs due to a missing token.
• Least Privilege Principle: Limiting the allowed_bots strictly to 'dependabot[bot]' (instead of wildcarding or adding unnecessary bots) is an excellent security practice to prevent unauthorized automated workflows from consuming your Claude API quota.

🟢 Positives

• Clear Documentation: The inline comment explaining why the allowed_bots parameter is required is highly helpful for future maintainers.
• Proactive Security/Ops Guidance: Including the exact GitHub CLI command to set up the Dependabot-scoped secret in the PR description is an outstanding practice that simplifies deployment.

---

📝 Detailed File-by-File Review

.github/workflows/claude-code-review.yml

The addition of the allowed_bots parameter is clean and correctly placed within the action's with block.

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 2d13cbe..b0a49ab 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -26,6 +26,8 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Dependabot PRs are bot-initiated; the action refuses them unless listed.
+          allowed_bots: 'dependabot[bot]'
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           # --comment is required. Without it the plugin prints the review to the

---

🤖 AI Assistant Copy-Paste Directive

Since the code changes are already optimal, the following checklist is for verifying the deployment and environment setup to ensure the workflow executes successfully upon merge.

<PR_REVIEW_ACTIONS>
- [ ] Verification: Run the GitHub CLI command to set the Dependabot secret if not already done:
      `gh secret set CLAUDE_CODE_OAUTH_TOKEN --app dependabot -R kyleswiger/aws-deployment-tooling`
- [ ] Verification: Confirm that the workflow file `.github/workflows/claude-code-review.yml` triggers on `pull_request` events (which covers Dependabot branches).
</PR_REVIEW_ACTIONS>