From 6e2f25a083df2a851999b1be2a4237f428d450e1 Mon Sep 17 00:00:00 2001 From: Clint Branham Date: Mon, 13 Apr 2026 09:04:15 -0500 Subject: [PATCH 1/3] fix: rewrite Claude Code Review workflow to match official examples MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Previous approach (/code-review:code-review --comment) was based on incorrect documentation research. Reviewing the actual official examples at anthropics/claude-code-action/examples/pr-review-*.yml reveals the correct pattern: 1. Use a custom prompt with explicit review instructions (not a plugin slash command) 2. Use claude_args with --allowedTools to enable the MCP inline comment tool and gh pr CLI commands — this is what lets Claude actually post to the PR 3. Enable track_progress: true for visual progress tracking Without --allowedTools, Claude has no way to post anything because the tools for PR commenting aren't allowed by default. Also removed the plugins and plugin_marketplaces inputs since they're not needed — the review runs via prompt instructions and the allowed tools alone. The custom prompt is tailored to PSProxmoxVE with focus areas specific to the module: DECISIONS.md compliance, cmdlet conventions, API correctness against the PVE OpenAPI spec, test coverage, and security. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude-code-review.yml | 31 +++++++++++++++++++++--- 1 file changed, 28 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index cf9fc07..5da1f17 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -26,6 +26,31 @@ jobs: with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} allowed_bots: 'dependabot[bot]' - plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' - plugins: 'code-review@claude-code-plugins' - prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' + track_progress: true + prompt: | + REPO: ${{ github.repository }} + PR NUMBER: ${{ github.event.pull_request.number }} + + Review this pull request for the PSProxmoxVE PowerShell module. + + Focus areas: + 1. **DECISIONS.md compliance** — Check against the 13 architectural + decisions (D001-D013). Any violation is a regression. + 2. **Code quality** — Cmdlet conventions (sealed, OutputType, + ConfirmImpact.High for destructive, VmId ValidateRange), + SecureString for passwords, Uri.EscapeDataString on path params, + no bare catch blocks, Newtonsoft-only JSON. + 3. **API correctness** — Parameter names and enum values must match + the PVE OpenAPI spec (see tests/PSProxmoxVE.Core.Tests/Fixtures/ + pve-api-enums.pve*.json for valid values per PVE version). + 4. **Tests** — New cmdlets should have xUnit service tests and + Pester parameter-validation tests. + 5. **Security** — No hardcoded credentials, no secrets in logs, + TLS verification on by default. + + Provide inline comments for specific issues and a summary comment + for general observations. Skip nitpicks unless they indicate a + real problem. + + claude_args: | + --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)" From 23ffc3531f8af0687e2cf76208366d936a506be7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 13 Apr 2026 14:12:00 +0000 Subject: [PATCH 2/3] chore(deps): Bump softprops/action-gh-release from 2 to 3 Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v2...v3) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/publish.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 571cb04..32a144b 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -108,6 +108,6 @@ jobs: Publish-Module -Path ./publish/PSProxmoxVE -NuGetApiKey $env:NUGET_API_KEY -Verbose - name: Create GitHub Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: generate_release_notes: true From 97ff7701daeb699498875891020ec0023f22d384 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 13 Apr 2026 14:14:39 +0000 Subject: [PATCH 3/3] Bump SharpCompress from 0.47.3 to 0.47.4 --- updated-dependencies: - dependency-name: SharpCompress dependency-version: 0.47.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- src/PSProxmoxVE.Core/PSProxmoxVE.Core.csproj | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/PSProxmoxVE.Core/PSProxmoxVE.Core.csproj b/src/PSProxmoxVE.Core/PSProxmoxVE.Core.csproj index 896f6a4..75a0410 100644 --- a/src/PSProxmoxVE.Core/PSProxmoxVE.Core.csproj +++ b/src/PSProxmoxVE.Core/PSProxmoxVE.Core.csproj @@ -18,7 +18,7 @@ - +