ci: add shared CI workflows and hooks by avifenesh · Pull Request #557 · agent-sh/agnix

avifenesh · 2026-02-21T22:08:30Z

Adds CI workflow (reusable from agent-sh/.github), Claude Code PR review, @claude mentions, and pre-push git hooks. Run sh scripts/setup-hooks.sh to install hooks locally. Requires org-level CLAUDE_CODE_OAUTH_TOKEN secret.

- CI workflow calling reusable workflow from agent-sh/.github - Claude Code automated PR review (owner/member/collaborator only, max 3 runs) - Claude Code @mentions support - Pre-push hook running tests before push

Copilot

Pull request overview

This PR introduces shared CI infrastructure for agent-sh repositories, including reusable CI workflows, Claude Code integration for automated PR reviews and @mentions, and git pre-push hooks. The changes centralize CI logic by delegating to a shared workflow in agent-sh/.github, and add AI-assisted code review capabilities with usage limits.

Changes:

Adds git hook installation script supporting Rust and Node.js projects with corresponding pre-push hooks
Refactors CI workflow to use a reusable workflow from agent-sh/.github organization repository
Introduces Claude Code workflows for automated PR reviews (limited to 3 runs per PR) and @mention responses

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
scripts/setup-hooks.sh	New script that detects project type and installs appropriate pre-push hooks for Rust or Node.js projects
scripts/pre-push-rust	New pre-push hook for Rust projects that runs clippy with warnings-as-errors and tests
.github/workflows/claude.yml	Updated Claude Code workflow for `@mention` triggers with new permissions, checkout version, action SHA, and restricted to OWNER/MEMBER/COLLABORATOR roles
.github/workflows/claude-code-review.yml	Updated automated PR review workflow with run-count limiting (max 3 per PR), new permissions, and updated action versions
.github/workflows/ci.yml	Replaced extensive CI job definitions with single call to reusable workflow at agent-sh/.github

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-02-21T22:13:32Z

.github/workflows/claude-code-review.yml

    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
+      contents: write
+      pull-requests: write
+      issues: write
+      actions: read


The workflow grants contents: write permission, which allows modifying repository contents. If the Claude Code action only needs to read code and post review comments, this may be excessive. According to security best practices (workflow memory), workflows should declare minimum required permissions. Verify whether contents: write is actually needed, or if contents: read would be sufficient. The use_commit_signing: true parameter suggests commits may be made, which would justify write access.

Copilot · 2026-02-21T22:13:32Z

.github/workflows/ci.yml

-          if [ "$SIZE" -gt 10485760 ]; then
-            echo "::warning::Binary size exceeds 10MB threshold"
-          fi
+  ci:


The massive CI workflow has been replaced with a single reusable workflow call. However, the .github/workflows/README.md file at lines 84-94 still documents the old ci.yml workflow structure with details like "Lint, test, coverage, build". This documentation should be updated to reflect that ci.yml now calls a reusable workflow from agent-sh/.github, or document what checks the reusable workflow performs.

Suggested change

ci:

ci:

name: Reusable Rust CI (lint, test, coverage, build)

Copilot · 2026-02-21T22:13:32Z

.github/workflows/claude-code-review.yml

-permissions: {}

 jobs:
  claude-review:


The condition checks if the author_association is in the list ["OWNER","MEMBER","COLLABORATOR"], but this doesn't account for repository administrators who may have different association values. GitHub's author_association can include values like "OWNER", "MEMBER", "COLLABORATOR", "CONTRIBUTOR", "FIRST_TIME_CONTRIBUTOR", "FIRST_TIMER", and "NONE". Consider whether other roles should be allowed, or document why only these three roles are permitted to trigger automated PR reviews.

Suggested change

claude-review:

claude-review:

# Only run for trusted repository roles. Possible author_association values include

# OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER, and NONE.

# We intentionally restrict this workflow to OWNER, MEMBER, and COLLABORATOR to ensure

# that automated reviews only run for users with trusted access to the repository.

# Note: repository administrators appear as OWNER or MEMBER, so they are covered here.

Copilot · 2026-02-21T22:13:33Z

.github/workflows/ci.yml

@@ -6,211 +6,7 @@ on:
  pull_request:
    branches: [main]



The workflow lacks an explicit top-level permissions declaration. According to the security hardening guidelines in .github/workflows/README.md lines 9-15, every workflow should declare minimum required permissions at the workflow level. When calling a reusable workflow, consider adding permissions: {} or appropriate read permissions at the top level.

Suggested change

permissions: {}

Copilot · 2026-02-21T22:13:33Z

.github/workflows/claude.yml

+      contents: write
+      pull-requests: write
+      issues: write
+      actions: read


The workflow grants contents: write permission, which allows modifying repository contents. If the Claude Code action only needs to read code and post comments, this may be excessive. According to security best practices (workflow memory), workflows should declare minimum required permissions. Verify whether contents: write is actually needed, or if contents: read would be sufficient. The use_commit_signing: true parameter suggests commits may be made, which would justify write access.

Suggested change

actions: read

Copilot · 2026-02-21T22:13:34Z

.github/workflows/claude-code-review.yml

+            "repos/${REPO}/actions/workflows/${WORKFLOW_FILE}/runs?head_sha=${HEAD_SHA}&status=completed" \
+            --jq '[.workflow_runs[] | select(.event == "pull_request")] | length' || echo "")


The run count logic only counts completed runs with status=completed, but doesn't account for currently running workflows. If the PR is synchronized while a review is already running, this could allow more than 3 reviews to execute. Consider adding logic to check for in_progress runs as well, or use a different mechanism like GitHub's concurrency groups to prevent overlapping runs.

Suggested change

"repos/${REPO}/actions/workflows/${WORKFLOW_FILE}/runs?head_sha=${HEAD_SHA}&status=completed" \

--jq '[.workflow_runs[] | select(.event == "pull_request")] | length' || echo "")

"repos/${REPO}/actions/workflows/${WORKFLOW_FILE}/runs?head_sha=${HEAD_SHA}" \

--jq '[.workflow_runs[] | select(.event == "pull_request" and (.status == "completed" or .status == "in_progress"))] | length' || echo "")

Copilot · 2026-02-21T22:13:35Z

.github/workflows/ci.yml

-            echo "::warning::Binary size exceeds 10MB threshold"
-          fi
+  ci:
+    uses: agent-sh/.github/.github/workflows/ci-rust.yml@main


The workflow references a reusable workflow at agent-sh/.github/.github/workflows/ci-rust.yml@main. Using @main as the ref means the workflow will always use the latest version from the main branch, which could introduce breaking changes without notice. According to security best practices for SHA-pinned actions in this repository, consider pinning to a specific commit SHA or stable tag instead of using a branch reference.

Suggested change

uses: agent-sh/.github/.github/workflows/ci-rust.yml@main

uses: agent-sh/.github/.github/workflows/ci-rust.yml@v1

Copilot · 2026-02-21T22:13:35Z

.github/workflows/claude.yml

      - name: Run Claude Code
-        id: claude
-        uses: anthropics/claude-code-action@edd85d61533cbba7b57ed0ca4af1750b1fdfd3c4 # v1
+        uses: anthropics/claude-code-action@f64219702d7454cf29fe32a74104be6ed43dc637 # v1


The SHA pin for anthropics/claude-code-action (f64219702d7454cf29fe32a74104be6ed43dc637) differs from the documented SHA in .github/workflows/README.md line 64 (6867bb3ab0b2c0a10629b6823e457347e74ad6d2). According to the workflow security practices memory, all third-party actions must be pinned to documented SHAs. Either update the README.md SHA Pin Reference with the new SHA and document which version this corresponds to, or use the documented SHA.

Suggested change

uses: anthropics/claude-code-action@f64219702d7454cf29fe32a74104be6ed43dc637 # v1

uses: anthropics/claude-code-action@6867bb3ab0b2c0a10629b6823e457347e74ad6d2 # v1

Copilot · 2026-02-21T22:13:35Z

.github/workflows/claude-code-review.yml

    steps:
      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4


The SHA pin for actions/checkout has been downgraded from v6.0.2 (SHA: de0fac2e4500dabe0009e67214ff5f5447ce83dd) to v4 (SHA: 34e114876b0b11c390a56381ad16ebd13914f8d5), which deviates from the existing convention in this repository. According to .github/workflows/README.md line 35, the project uses v6.0.2 for actions/checkout. This inconsistency should be resolved - either update all workflows to v4 or use v6.0.2 here for consistency.

Suggested change

uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

Copilot · 2026-02-21T22:13:35Z

.github/workflows/claude-code-review.yml

+          RUN_COUNT=${RUN_COUNT:-0}
+          if ! echo "$RUN_COUNT" | grep -qE '^[0-9]+$'; then


The validation uses grep -qE '^[0-9]+$' which requires at least one digit, but line 44 has already set RUN_COUNT=${RUN_COUNT:-0} which ensures it's at least "0". However, the validation could fail if the API returns non-numeric output that wasn't caught by the error handling. Consider adding validation before the default assignment or handling the case where grep fails to avoid obscure errors.

Suggested change

RUN_COUNT=${RUN_COUNT:-0}

if ! echo "$RUN_COUNT" | grep -qE '^[0-9]+$'; then

if [ -z "$RUN_COUNT" ]; then

RUN_COUNT=0

elif ! echo "$RUN_COUNT" | grep -qE '^[0-9]+$'; then

avifenesh · 2026-02-21T22:51:28Z

Addressing Copilot review comments

contents: write permission: Required because use_commit_signing: true enables the Claude Code action to push signed commits. contents: read would prevent this.

Checkout SHA downgrade (v6 -> v4): The org-wide templates standardize on actions/checkout v4 (SHA 34e114876b). agnix previously used v6. Both are supported. The templates come from agent-sh/.github and should be consistent across all repos.

Missing top-level permissions: Permissions are declared at job level in these workflows, which is valid and more granular than top-level. This follows the same pattern as the agentsys CI workflows.

SHA mismatch with README.md: These workflows use the org-standard SHAs from agent-sh/.github. The agnix README.md documents older, repo-specific SHAs. The README should be updated separately to reflect the new org-wide workflow setup.

pre-push-node not in this PR: Correct - this is a Rust repo. The setup-hooks.sh script auto-detects the project type via Cargo.toml and installs pre-push-rust instead. The Node hook is never referenced.

@main pinning for reusable workflow: Intentional. Central updates to agent-sh/.github propagate to all repos immediately. This is the desired behavior for org-wide CI governance.

--all-features in clippy: Added intentionally to catch issues in feature-gated code that the previous CI missed.

Run count logic: The count queries completed runs, which is the same pattern used in agentsys. Race conditions with concurrent runs are acceptable since the 3-run limit is a soft guard, not a security boundary.

ci: add shared CI workflows, Claude Code review, and git hooks

e06674f

- CI workflow calling reusable workflow from agent-sh/.github - Claude Code automated PR review (owner/member/collaborator only, max 3 runs) - Claude Code @mentions support - Pre-push hook running tests before push

Copilot AI review requested due to automatic review settings February 21, 2026 22:08

Copilot started reviewing on behalf of avifenesh February 21, 2026 22:08 View session

Copilot AI reviewed Feb 21, 2026

View reviewed changes

avifenesh merged commit 6d055a5 into main Feb 21, 2026
16 of 20 checks passed

avifenesh deleted the add-ci-workflows branch February 21, 2026 23:12

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: add shared CI workflows and hooks#557

ci: add shared CI workflows and hooks#557
avifenesh merged 1 commit intomainfrom
add-ci-workflows

avifenesh commented Feb 21, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

Copilot AI Feb 21, 2026

Uh oh!

avifenesh commented Feb 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-  claude-review:
+  claude-review:
+    # Only run for trusted repository roles. Possible author_association values include
+    # OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR, FIRST_TIME_CONTRIBUTOR, FIRST_TIMER, and NONE.
+    # We intentionally restrict this workflow to OWNER, MEMBER, and COLLABORATOR to ensure
+    # that automated reviews only run for users with trusted access to the repository.
+    # Note: repository administrators appear as OWNER or MEMBER, so they are covered here.

		"repos/${REPO}/actions/workflows/${WORKFLOW_FILE}/runs?head_sha=${HEAD_SHA}&status=completed" \
		--jq '[.workflow_runs[] \| select(.event == "pull_request")] \| length' \|\| echo "")

	uses: agent-sh/.github/.github/workflows/ci-rust.yml@main
	uses: agent-sh/.github/.github/workflows/ci-rust.yml@v1

	uses: anthropics/claude-code-action@f64219702d7454cf29fe32a74104be6ed43dc637 # v1
	uses: anthropics/claude-code-action@6867bb3ab0b2c0a10629b6823e457347e74ad6d2 # v1

	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

		RUN_COUNT=${RUN_COUNT:-0}
		if ! echo "$RUN_COUNT" \| grep -qE '^[0-9]+$'; then

-          RUN_COUNT=${RUN_COUNT:-0}
-          if ! echo "$RUN_COUNT" | grep -qE '^[0-9]+$'; then
+          if [ -z "$RUN_COUNT" ]; then
+            RUN_COUNT=0
+          elif ! echo "$RUN_COUNT" | grep -qE '^[0-9]+$'; then

Conversation

avifenesh commented Feb 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 21, 2026

Choose a reason for hiding this comment

Uh oh!

avifenesh commented Feb 21, 2026

Addressing Copilot review comments

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants