Claude Code Review

You are a DevOps engineer or code review automation specialist. The user wants to set up Claude Code for automated PR and code reviews using the Anthropic API and a Git webhook system.

What to check first

• Verify you have an Anthropic API key by running echo $ANTHROPIC_API_KEY
• Check your Git platform (GitHub, GitLab, Bitbucket) supports webhooks in your repository settings
• Confirm Node.js 18+ is installed with node --version
• Ensure npm packages octokit, express, and @anthropic-ai/sdk are available

Steps

1. Create a .env file with ANTHROPIC_API_KEY=sk-... and WEBHOOK_SECRET=your-secret-key
2. Set up a Git webhook pointing to your server's /webhook endpoint with application/json content type
3. Initialize Express.js server listening on port 3000 to receive webhook payloads
4. Extract PR metadata from webhook payload: pull_request.number, pull_request.head.sha, and pull_request.diff_url
5. Fetch the diff from the PR using Octokit's rest.pulls.get() method with media.format: 'diff'
6. Send the code diff to Claude's messages.create() API with the claude-3-5-sonnet-20241022 model and a system prompt for code review
7. Parse Claude's review response and post it as a PR comment using rest.issues.createComment()
8. Validate webhook signature using HMAC-SHA256 to ensure requests are from your Git platform

Code

const express = require('express');
const crypto = require('crypto');
const { Anthropic } = require('@anthropic-ai/sdk');
const { Octokit } = require('octokit');
require('dotenv').config();

const app = express();
const anthropic = new Anthropic({
  apiKey: process.env.ANTHROPIC_API_KEY,
});
const octokit = new Octokit({
  auth: process.env.GITHUB_TOKEN,
});

const WEBHOOK_SECRET = process.env.WEBHOOK_SECRET;

// Verify GitHub webhook signature
function verifyWebhookSignature(req) {
  const signature = req.headers['x-hub-signature-256'];
  if (!signature) return false;
  const hash = crypto
    .createHmac('sha256', WEBHOOK_SECRET)
    .update(JSON.stringify(req.body))
    .digest('hex');
  return signature === `sha256=${hash}`;
}

// Fetch PR diff
async function getPRDiff(owner, repo, pullNumber) {
  const diff = await octokit.request(
    'GET /repos/{owner}/{repo}/pulls/{pull_number}',
    {
      owner,
      repo,
      pull_number: pullNumber

Note: this example was truncated in the source. See the GitHub repo for the latest full version.

Common Pitfalls

• Treating this skill as a one-shot solution — most workflows need iteration and verification
• Skipping the verification steps — you don't know it worked until you measure
• Applying this skill without understanding the underlying problem — read the related docs first

When NOT to Use This Skill

• When a simpler manual approach would take less than 10 minutes
• On critical production systems without testing in staging first
• When you don't have permission or authorization to make these changes

How to Verify It Worked

• Run the verification steps documented above
• Compare the output against your expected baseline
• Check logs for any warnings or errors — silent failures are the worst kind

Production Considerations

• Test in staging before deploying to production
• Have a rollback plan — every change should be reversible
• Monitor the affected systems for at least 24 hours after the change