ci: use Opus 5 for PR review and mount upstream ANTLR for comparison - #189
Conversation
Switch the automated review model to `claude-opus-5[1m]` (Opus 5 was released today; Opus 4.8 is now legacy) while keeping the `[1m]` 1M-context suffix. Add an `actions/checkout` step that clones antlr/antlr4 at tag 4.13.2 — the version this runtime targets — into `antlr-upstream/`, and update the review prompt to point the reviewer there. Most PRs touch ported ATN / prediction / codegen logic, and a faithful review needs to compare against the reference implementation rather than upstream `master` (which carries post-4.13.2 changes a reviewer could mis-flag as divergence).
📝 WalkthroughWalkthroughThe Claude review workflow now checks out ANTLR 4.13.2 for comparison, uses Claude Opus 5, and adds prompt guidance for identifying and documenting differences from upstream ANTLR semantics. ChangesClaude review workflow
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Source Code Metrics (this PR vs
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Around line 52-58: Add persist-credentials: false to the actions/checkout step
named “Checkout upstream ANTLR (reference for review comparisons),” while
preserving its existing repository, ref, path, and fetch-depth settings.
- Line 53: Update the actions/checkout step in the workflow to reference the
desired v7 release using its full immutable commit SHA instead of the mutable
actions/checkout@v7 tag, and retain the version identifier in an inline comment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 5bd06cf4-93f7-41bc-84be-65b04a88ab79
📒 Files selected for processing (1)
.github/workflows/claude-code-review.yml
| - name: Checkout upstream ANTLR (reference for review comparisons) | ||
| uses: actions/checkout@v7 | ||
| with: | ||
| repository: antlr/antlr4 | ||
| ref: "4.13.2" | ||
| path: antlr-upstream | ||
| fetch-depth: 1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
Disable credential persistence for the reference checkout.
This checkout is read-only and public, so add persist-credentials: false. The following Claude step can inspect the workspace, making an unnecessary persisted token an avoidable exposure. The checkout action documents this input as the opt-out for persisted credentials. (github.com)
Proposed fix
with:
repository: antlr/antlr4
ref: "4.13.2"
path: antlr-upstream
fetch-depth: 1
+ persist-credentials: false📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Checkout upstream ANTLR (reference for review comparisons) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: antlr/antlr4 | |
| ref: "4.13.2" | |
| path: antlr-upstream | |
| fetch-depth: 1 | |
| - name: Checkout upstream ANTLR (reference for review comparisons) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: antlr/antlr4 | |
| ref: "4.13.2" | |
| path: antlr-upstream | |
| fetch-depth: 1 | |
| persist-credentials: false |
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 52-58: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 52 - 58, Add
persist-credentials: false to the actions/checkout step named “Checkout upstream
ANTLR (reference for review comparisons),” while preserving its existing
repository, ref, path, and fetch-depth settings.
Sources: MCP tools, Linters/SAST tools
| # the reviewer reads source, not git history. The directory name is | ||
| # deliberately non-hidden so ripgrep-backed search (Grep) descends into it. | ||
| - name: Checkout upstream ANTLR (reference for review comparisons) | ||
| uses: actions/checkout@v7 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Files:"
git ls-files | rg '(^|/)(claude-code-review\.yml|policy|security|README|SECURITY|CODEOWNERS|zizmor|unpin|pinned|workflow)' || true
echo
echo "Workflow around checkout:"
if [ -f .github/workflows/claude-code-review.yml ]; then
nl -ba .github/workflows/claude-code-review.yml | sed -n '1,140p'
fi
echo
echo "Search unpinned policy/terms:"
rg -n -i "unpin|pinned|pinned action|full commit sha|immutable|checkout|zizmor|actions/checkout|tag|sha" .github README.md SECURITY.md CODEOWNERS 2>/dev/null | head -200 || trueRepository: ophi-dev/antlr-rust-runtime
Length of output: 847
🌐 Web query:
actions checkout v7 release commit SHA
💡 Result:
The release v7.0.0 of actions/checkout was published on June 18, 2026 [1]. The commit SHA for this specific tag (v7.0.0) is 3d3c42e5aac5ba805825da76410c181273ba90b1 [2]. As of today, July 24, 2026, the latest release in the v7 series is v7.0.1, which was released on July 20, 2026 [3][4]. You can always verify the most current commit SHAs by checking the tags page in the official GitHub repository [3].
Citations:
- 1: https://github.com/actions/checkout/releases/tag/v7.0.0
- 2: actions/checkout@900f221...3d3c42e
- 3: https://github.com/actions/checkout/releases
- 4: https://github.com/actions/checkout/releases/tag/v7.0.1
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Workflows:"
for f in .github/workflows/*.yml; do
printf '\n--- %s ---\n' "$f"
awk '{printf "%5d %s\n", NR, $0}' "$f" | sed -n '1,140p'
done
echo
echo "README/SECURITY/CODEOWNERS/policy files:"
for f in README.md SECURITY.md CODEOWNERS .github/dependabot.yml; do
if [ -f "$f" ]; then
printf '\n--- %s ---\n' "$f"
awk '{printf "%5d %s\n", NR, $0}' "$f" | sed -n '1,220p'
else
echo "missing: $f"
fi
done
echo
echo "Policy-related text:"
rg -n -i "unpin|pinned|pinned action|full commit sha|immutable|checkout|zizmor|github actions security|actions/checkout|`@v`" README.md .github 2>/dev/null || trueRepository: ophi-dev/antlr-rust-runtime
Length of output: 50385
🌐 Web query:
GitHub actions checkout v7.0.1 commit SHA actions/checkout v7.0.1
💡 Result:
The GitHub Actions checkout action version v7.0.1 corresponds to the commit SHA 3d3c42e5aac5ba805825da76410c181273ba90b1 [1]. This release was published on July 20, 2026 [2][3]. The commit associated with this release, titled "prep v7.0.1 release (#2531)", finalized the version bump from v7.0.0 to v7.0.1 [4][1].
Citations:
- 1: https://git.velechovsky.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1
- 2: https://github.com/actions/checkout/releases/tag/v7.0.1
- 3: https://github.com/actions/checkout/?tab=readme-ov-file
- 4: prep v7.0.1 release actions/checkout#2531
Pin the checkout action to an immutable commit SHA.
actions/checkout@v7 is an unpinned branch/tag reference. Replace it with the current full-length commit SHA for the desired v7 commit and leave the version in a comment.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 53-53: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml at line 53, Update the
actions/checkout step in the workflow to reference the desired v7 release using
its full immutable commit SHA instead of the mutable actions/checkout@v7 tag,
and retain the version identifier in an inline comment.
Source: Linters/SAST tools
1 participant
What
Two enhancements to the automated Claude Code review workflow (
.github/workflows/claude-code-review.yml):Model → Opus 5.
--model "claude-opus-4-8[1m]"→"claude-opus-5[1m]". Opus 5 shipped today; Opus 4.8 is now legacy. The[1m]suffix (Claude Code's 1M-context selector) is preserved.Mount upstream ANTLR for comparison. A new
actions/checkoutstep clonesantlr/antlr4at tag4.13.2intoantlr-upstream/, and the review prompt now points the reviewer there.Why
This crate is a Rust port of ANTLR's reference runtime + code generator. Most PRs touch ported logic — ATN/prediction, lexer/parser simulation, serialized-ATN decoding, generated-code shape — where a faithful review means checking the Rust behavior against the reference implementation.
4.13.2(the version CLAUDE.md targets everywhere), notmaster— otherwise the reviewer would flag post-4.13.2 upstream changes as false divergence.path: antlr-upstreamkeeps it out of the main checkout;fetch-depth: 1since the reviewer reads source, not history.file:line.Verification
actionlint .github/workflows/claude-code-review.yml→ cleanantlr/antlr4tag4.13.2confirmed to exist; cited subpaths (runtime/Java/src/org/antlr/v4/runtime/,tool/) verified present at that tag.Notes
@claudemention workflow (claude.yml) still uses the action's default model with no pin — let me know if it should get the same bump.Summary by CodeRabbit