Claude Code智能代码审查全流程实战

传统流程：  开发者提交PR → 人工审查 → 反馈 → 修改 → 合并
AI增强流程：开发者提交PR → AI自动审查 → 开发者自修复 → 人工深度审查 → 合并

# 在项目目录中，先查看当前变更
git diff

# 使用Claude Code审查当前未暂存的变更
claude "/review the current changes"

# 审查最近一次提交
claude "Review the last commit for potential bugs and security issues"

# 审查特定范围内的变更
claude "Review changes between main and current branch, focus on:
1. Security vulnerabilities
2. Performance regressions
3. Breaking API changes"

## Code Review Summary

### Critical Issues (2)
1. **SQL Injection Risk** in `src/db/queries.js:45`
   - User input directly concatenated into SQL query
   - Recommendation: Use parameterized queries

2. **Unhandled Promise Rejection** in `src/api/handler.js:112`
   - Missing `.catch()` or try/catch around async operation
   - May cause process crash in production

### Warnings (3)
1. **Deprecated API Usage** in `src/utils/format.js:28`
2. **Missing Input Validation** in `src/routes/user.js:67`
3. **Hardcoded Configuration** in `src/config/index.js:15`

### Suggestions (4)
- Consider extracting magic numbers to constants
- Add JSDoc for public methods
- ...

# 在PR分支上运行
claude "The CI is failing on this PR. Check the GitHub Actions logs 
and fix the issues. Run: gh run view --log-failed"

# 直接调用gh-fix-ci skill
/skill:gh-fix-ci

claude "I'm about to submit a PR that refactors the authentication module.
Please do a comprehensive review:

Phase 1: Architecture review
- Is the new module structure sound?
- Are the abstractions at the right level?

Phase 2: Security review  
- Any authentication bypass risks?
- Token handling best practices?

Phase 3: Edge cases
- What happens when [specific scenario]?
- Are error paths properly handled?"

# 将GitHub App的私钥添加到仓库Secrets
# Secret名称: CLAUDE_CODE_APP_KEY
# 值: .pem文件的内容

# 同时需要设置App ID
# Secret名称: CLAUDE_CODE_APP_ID  
# 值: GitHub App的ID数字

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize]
  issue_comment:
    types: [created]
  workflow_dispatch:
    inputs:
      prompt:
        description: 'Custom review prompt'
        required: false
        default: ''

jobs:
  claude-review:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Run Claude Code Review
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          # 或者使用API Key
          # anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Review this pull request with focus on:
            1. Security vulnerabilities (OWASP Top 10)
            2. Performance implications
            3. Error handling completeness
            4. Code style and naming conventions

            Use CLAUDE.md for project-specific conventions.

            ${{ github.event.inputs.prompt }}

on:
  pull_request:
    types: [opened, synchronize]

on:
  issue_comment:
    types: [created]

jobs:
  claude-review:
    if: |
      github.event.issue.pull_request && 
      contains(github.event.comment.body, '@claude review')
    runs-on: ubuntu-latest
    # ... 同上

# .github/workflows/claude-review-tiered.yml
name: Tiered Code Review

on:
  pull_request:
    types: [opened, synchronize]

jobs:
  # 第一层：变更规模判断
  assess-changes:
    runs-on: ubuntu-latest
    outputs:
      tier: ${{ steps.assess.outputs.tier }}
    steps:
      - uses: actions/checkout@v4
      - id: assess
        run: |
          CHANGED_FILES=$(git diff --name-only origin/main...HEAD | wc -l)
          CHANGED_LINES=$(git diff --stat origin/main...HEAD | tail -1 | awk '{print $4+$6}')

          if [ "$CHANGED_LINES" -gt 500 ] || [ "$CHANGED_FILES" -gt 20 ]; then
            echo "tier=comprehensive" >> $GITHUB_OUTPUT
          elif echo "$CHANGED_FILES" | grep -qE "(security|auth|crypto|payment)"; then
            echo "tier=security-focused" >> $GITHUB_OUTPUT
          else
            echo "tier=quick" >> $GITHUB_OUTPUT
          fi

  # 第二层：根据规模执行不同深度的审查
  quick-review:
    needs: assess-changes
    if: needs.assess-changes.outputs.tier == 'quick'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Quick review: Check for obvious bugs, 
            style issues, and missing tests only.

  comprehensive-review:
    needs: assess-changes
    if: needs.assess-changes.outputs.tier == 'comprehensive'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Comprehensive review required for large change.
            Analyze:
            1. Architecture impact
            2. Performance implications  
            3. Security vulnerabilities
            4. Backward compatibility
            5. Documentation completeness
            6. Test coverage adequacy

  security-review:
    needs: assess-changes
    if: needs.assess-changes.outputs.tier == 'security-focused'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            Security-focused review. Check for:
            1. Authentication/authorization bypasses
            2. Injection vulnerabilities
            3. Sensitive data exposure
            4. Cryptographic weaknesses
            5. Input validation gaps

# 项目审查规范

## Code Review标准

### 必须检查项
- 所有public API必须有JSDoc/TSDoc注释
- 数据库查询必须使用parameterized queries
- 异步操作必须有错误处理
- 新增的依赖必须在 `package.json` 中标注原因

### 安全审查清单
- 不允许 `eval()`、`Function()` 构造器
- 不允许 `innerHTML` 直接赋值（使用textContent）
- API端点必须有认证中间件
- 文件上传必须校验类型和大小

### 性能红线
- React组件禁止在render中创建内联函数
- 列表渲染必须提供稳定的key
- 图片必须使用懒加载（首屏除外）
- API响应超过1KB的必须分页

### 命名规范
- 变量：camelCase
- 常量：UPPER_SNAKE_CASE
- 类/接口：PascalCase
- 文件：kebab-case
- 数据库列：snake_case

### 禁止模式
- 不要在Review时自动修改代码格式（交给Prettier）
- 不要建议添加不必要的try-catch包装
- 不要在测试文件中要求100%覆盖率

---
name: team-review
description: 团队级代码审查，遵循项目规范
---

# 团队代码审查流程

## 执行步骤

1. **读取规范文件**
   执行审查前必须阅读以下文件：
   - `CLAUDE.md` - 项目通用规范
   - `docs/coding-standards.md` - 编码标准（如存在）
   - `docs/api-conventions.md` - API设计约定（如存在）

2. **变更分析**
   ```
   git diff main...HEAD --stat
   git diff main...HEAD --name-only
   ```
   先了解变更范围，再决定审查深度。

3. **按文件类型审查**
   - `.tsx/.jsx`: React最佳实践、hooks规则、可访问性
   - `.ts`: 类型安全、接口设计、错误处理
   - `.sql`: 查询性能、注入风险、索引使用
   - `.yml/.yaml`: 配置安全、敏感信息泄露
   - `test/`: 测试有效性、边界覆盖、mock合理性

4. **输出格式**
   每个发现按以下格式输出：
   ```
   ### [严重程度] 问题标题
   **文件**: `path/to/file:line_number`
   **问题**: 具体描述
   **建议**: 修复建议或代码示例
   **依据**: 引用的规范条目
   ```

   严重程度分为：🔴 Critical | 🟡 Warning | 🔵 Suggestion

## React审查清单
- useEffect依赖数组完整性
- useMemo/useCallback使用必要性（避免过度优化）
- Server Component与Client Component边界正确性
- 数据获取使用SWR/React Query而非useEffect
- Image组件使用next/image优化
- 无障碍属性（aria-label, role等）

## Python审查清单
- 类型注解覆盖率（public函数必须标注）
- Django ORM查询效率（select_related/prefetch_related）
- N+1查询检测
- 敏感操作使用atomic事务
- 用户输入验证（serializer/validator层面）
- Celery任务的幂等性

## Go审查清单
- goroutine泄漏检测
- context.Context传递完整性
- error wrapping使用fmt.Errorf("...: %w", err)
- interface定义在消费侧而非实现侧
- 并发安全（mutex/rwmutex/channel选择）
- defer在循环中的使用注意

my-project/
├── .claude/
│   ├── settings.json          # Claude Code权限配置
│   └── skills/
│       └── team-review.md     # 团队审查Skill
├── .github/
│   └── workflows/
│       ├── claude-review.yml  # AI审查工作流
│       └── ci.yml             # 常规CI流水线
├── CLAUDE.md                  # 项目规范
└── ...

{
  "permissions": {
    "allow": [
      "Read",
      "Grep",
      "Glob",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "Bash(gh pr:*)",
      "Bash(npm test:*)",
      "Bash(npm run lint:*)"
    ],
    "deny": [
      "Bash(rm -rf:*)",
      "Bash(git push:*)",
      "Bash(git reset:*)"
    ]
  },
  "review": {
    "auto_review": true,
    "focus_areas": ["security", "performance", "correctness"],
    "severity_threshold": "warning"
  }
}

# My Project - Claude Code配置

## 项目概况
- 技术栈: Node.js 20 + TypeScript + Express + PostgreSQL
- 测试框架: Vitest
- 代码规范: ESLint + Prettier

## Review规范

### 优先级排序（高到低）
1. 安全漏洞（SQL注入、XSS、认证绕过）
2. 数据一致性（事务完整性、并发安全）
3. 性能问题（N+1查询、内存泄漏、无限循环风险）
4. 错误处理（未捕获异常、静默失败）
5. 代码可维护性（命名、抽象层级、耦合度）
6. 测试质量（覆盖率、边界情况）

### 特别关注
- 数据库migration必须向后兼容
- API端点变更必须在openapi.yaml中同步更新
- 新增环境变量必须在.env.example中添加说明

### 不需要在Review中提及的
- 代码格式问题（由Prettier处理）
- import排序（由ESLint自动修复）
- console.log调试语句（开发阶段允许）

# .github/workflows/claude-review.yml
name: AI Code Review

on:
  pull_request:
    types: [opened, synchronize]
  issue_comment:
    types: [created]

concurrency:
  group: claude-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  ai-review:
    # 评论触发模式：仅在包含@claude时运行
    if: |
      github.event_name == 'pull_request' ||
      (github.event_name == 'issue_comment' && 
       github.event.issue.pull_request &&
       contains(github.event.comment.body, '@claude'))

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      checks: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get changed files info
        id: changes
        run: |
          echo "files=$(git diff --name-only origin/main...HEAD | tr '\n' ' ')" >> $GITHUB_OUTPUT
          echo "additions=$(git diff --stat origin/main...HEAD | tail -1 | grep -oP '\d+(?= insertion)')" >> $GITHUB_OUTPUT
          echo "deletions=$(git diff --stat origin/main...HEAD | tail -1 | grep -oP '\d+(?= deletion)')" >> $GITHUB_OUTPUT

      - name: Determine review scope
        id: scope
        run: |
          FILES="${{ steps.changes.outputs.files }}"

          # 检查是否涉及安全敏感文件
          if echo "$FILES" | grep -qE "(auth|security|crypto|password|token|middleware/auth)"; then
            echo "scope=security" >> $GITHUB_OUTPUT
          # 检查是否涉及数据库变更
          elif echo "$FILES" | grep -qE "(migration|schema|model|repository)"; then
            echo "scope=database" >> $GITHUB_OUTPUT
          # 检查是否大范围变更
          elif [ "${{ steps.changes.outputs.additions }}" -gt 300 ]; then
            echo "scope=comprehensive" >> $GITHUB_OUTPUT
          else
            echo "scope=standard" >> $GITHUB_OUTPUT
          fi

      - name: Run Claude Code Review
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            You are reviewing PR #${{ github.event.pull_request.number }}.

            Review scope: ${{ steps.scope.outputs.scope }}
            Changed files: ${{ steps.changes.outputs.files }}

            Follow the review standards in CLAUDE.md.

            ${{ steps.scope.outputs.scope == 'security' && '⚠️ SECURITY-SENSITIVE CHANGE DETECTED.
            Perform thorough security audit focusing on:
            - Authentication/authorization bypass
            - Injection vulnerabilities  
            - Sensitive data exposure
            - Cryptographic weaknesses' || '' }}

            ${{ steps.scope.outputs.scope == 'database' && '🗄️ DATABASE CHANGE DETECTED.
            Verify:
            - Migration backward compatibility
            - Index usage for new queries
            - Transaction safety
            - Data integrity constraints' || '' }}

            Output format:
            - Use GitHub PR review comments syntax
            - Link each finding to specific file and line
            - Include code suggestions where applicable
            - Summarize overall assessment at the end

# 让Claude Code根据审查结果自动修复简单问题
claude "I got the following review comments from the AI reviewer:

1. [Warning] Missing error handling in src/api/users.ts:45
2. [Critical] SQL injection risk in src/db/queries.ts:23
3. [Suggestion] Consider using optional chaining in src/utils/format.ts:12

Please fix issues #1 and #2, and let me know if #3 is worth doing."

name: Review Metrics

on:
  pull_request:
    types: [closed]

jobs:
  collect-metrics:
    if: github.event.pull_request.merged == true
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Calculate PR metrics
        run: |
          PR_NUMBER=${{ github.event.pull_request.number }}
          # 获取PR的审查评论数
          REVIEW_COMMENTS=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER/comments --jq 'length')
          # 获取PR的变更行数
          ADDITIONS=${{ github.event.pull_request.additions }}
          DELETIONS=${{ github.event.pull_request.deletions }}
          CHANGED_FILES=${{ github.event.pull_request.changed_files }}

          echo "PR #$PR_NUMBER Metrics:"
          echo "- Review comments: $REVIEW_COMMENTS"
          echo "- Lines changed: +$ADDITIONIONS -$DELETIONS"
          echo "- Files changed: $CHANGED_FILES"
          echo "- Comment density: $(echo "scale=2; $REVIEW_COMMENTS / ($ADDITIONS + $DELETIONS)" | bc) comments/line"

claude "Analyze the code review patterns in this repository over the last month:
1. What types of issues are most frequently caught?
2. Are there recurring patterns we should prevent earlier?
3. Should we update CLAUDE.md to catch these proactively?

Use: git log --oneline --since='1 month ago'
And check closed PRs for review comments."

~/.claude/CLAUDE.md              # 全局：个人偏好（语言、风格）
~/project/CLAUDE.md              # 项目：团队规范、审查标准  
~/project/packages/api/CLAUDE.md # 子项目：模块特定规则
~/project/.claude/CLAUDE.md      # Claude目录：工具行为配置

# packages/api/CLAUDE.md

## API模块特殊审查规则

- 所有新端点必须兼容RESTful命名
- Response格式必须遵循 { code, data, message } 结构
- 分页参数统一使用 page/pageSize
- 错误码必须在 docs/error-codes.md 中注册
- 幂等性：POST创建接口必须支持重复提交保护

## 审查评论格式规范

### 必须包含
1. 问题分类：[Bug] / [Security] / [Performance] / [Style] / [Suggestion]
2. 严重程度：🔴 Critical / 🟡 Warning / 🔵 Info
3. 影响范围：具体影响的用户场景或功能模块
4. 修复建议：包含代码示例的具体建议

### 禁止行为
- 不要只说"这里有问题"而不说明原因
- 不要建议重写整个文件
- 不要在非安全问题上使用Critical标签
- 不要忽略测试代码的审查

## AI审查安全红线

### 绝对不允许
- AI审查不得访问生产环境数据
- 审查结果不得包含完整密钥、Token等敏感信息
- AI不得自动合并PR（必须人工确认）
- 安全漏洞细节不得公开在PR评论中（使用私有通道）

### 必须执行
- 审查API调用使用加密传输
- 审查日志定期清理（保留90天）
- 第三方集成定期审计权限

# 检查工作流是否正确注册
gh workflow list

# 查看工作流运行历史
gh run list --workflow=claude-review.yml

# 手动触发测试
gh workflow run claude-review.yml

# 在CLAUDE.md中增加更具体的规则
# 模糊规则：Check for security issues
# 精确规则：检查所有SQL查询是否使用parameterized queries，包括：
# - Knex: .where('column', value) 而非 .whereRaw(`column = ${value}`)
# - Sequelize: 使用 replacements 或 bind 参数
# - TypeORM: 使用 .setParameter() 而非字符串拼接

# 排除不需要审查的文件
- name: Filter review files
  run: |
    FILES=$(git diff --name-only origin/main...HEAD | 
      grep -v -E '(package-lock\.json|\.min\.js|\.min\.css|generated/|dist/|\.snap$)')
    echo "review_files=$FILES" >> $GITHUB_OUTPUT