[frequency403]

Summary

Adds an automated Claude review for pull requests, adapted from the setup in frequency403/OpenSourceInitiative.LicenseApi.

Changes Made

• New feature (non-breaking change)

• Documentation update

• New .github/workflows/claude-review.yml:

  • Runs on pull_request (opened/synchronize/reopened/ready_for_review) for same-repository, non-draft, non-Dependabot PRs. Fork PRs get no secrets; pull_request_target is not used.
  • anthropics/claude-code-action reviews the PR diff with read-only tools (Read,Glob,Grep) plus inline comments. The prompt checks correctness, the security invariants from AGENTS.md (TOFU, key file modes, passphrases, backup/restore, config-provided keys, SFTP), cross-platform tests, both resx files, CPM/DI rules, and CI hardening (SHA pins, secrets, release asset names).
  • Claude never approves itself. It returns {approve, findings, summary}; a separate bash step approves as github-actions[bot] only when approve == true and findings == 0, otherwise the job fails.

• Differences from the LicenseApi version, to follow this repo's CI rules:

  • actions/checkout and anthropics/claude-code-action are pinned to commit SHAs (claude-code-action v1.0.262, released 2026-10-24) instead of @v7 / @v1.
  • Workflow-level permissions: contents: read, write grants only on the job.
  • The PR number is passed via env instead of inline ${{ }} in run:.
  • Checkout with persist-credentials: false.
  • Review checklist tailored to this repo (net10.0 only, AGENTS.md security invariants, resx, release asset contract).

• AGENTS.md: documents the workflow, its permissions and the CLAUDE_CODE_OAUTH_TOKEN secret.

Prerequisites (repository settings, before this works)

• Claude GitHub App installed on this repository: https://github.com/apps/claude
• Secret CLAUDE_CODE_OAUTH_TOKEN (generate locally with claude setup-token)
• Settings → Actions → General → Workflow permissions: "Allow GitHub Actions to create and approve pull requests" (currently disabled here)

Until these are in place, the Claude Review job on this PR is expected to fail.

Testing Performed

• Workflow YAML parses; both uses: are SHA-pinned
• End-to-end run: pending the prerequisites above

---

Notes for Reviewers:

• The bot approval satisfies the master ruleset's one required review, including for release/* PRs into master.
• Breaking change: no

🤖 Generated with Claude Code

[github-actions]

Automated review by Claude: no blocking findings.

I reviewed the new claude-review.yml workflow and the AGENTS.md update. The workflow uses pull_request rather than pull_request_target, skips fork and Dependabot PRs, and has Claude's tools limited to read-only plus inline comments. Both third-party actions are pinned to commit SHAs. Approval comes from a separate step using GITHUB_TOKEN. That step fails closed when the structured result is empty or reports any findings. I did not verify that the pinned SHAs match their version comments. I found no blocking issues. The PR doesn't touch app code, so the security invariants, resx strings and tests are unaffected.