name: Claude Security Review

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]

permissions:
  contents: read
  pull-requests: read

concurrency:
  group: claude-security-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  security-review:
    if: >
      github.event.pull_request.draft == false &&
      (
        github.event.pull_request.head.repo.full_name == github.repository ||
        github.event.pull_request.author_association == 'OWNER' ||
        github.event.pull_request.author_association == 'MEMBER' ||
        github.event.pull_request.author_association == 'COLLABORATOR'
      )
    runs-on: ubuntu-latest
    timeout-minutes: 30

    steps:
      - name: Checkout PR code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 2

      - name: Claude security review
        uses: anthropics/claude-code-security-review@main
        with:
          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
          claude-model: claude-opus-4-7
          comment-pr: false
          upload-results: true
          custom-security-scan-instructions: resources/claude-security-scan-instructions.txt
          false-positive-filtering-instructions: resources/claude-false-positive-filtering.txt
          exclude-directories: |
            build,dist,out,coverage,node_modules,vendor,.git
          claudecode-timeout: 20