What

Replace the inlined claude-review.yml workflow with a call to the shared reusable workflow at stellar/actions/.github/workflows/claude-review.yml@main. Keep the existing pull_request trigger (the safer default; fork PRs can't access secrets on this event so they cannot be reviewed) and narrow the trigger types to [ready_for_review, synchronize] so Claude only reviews PRs that are marked ready and re-reviews on new commits.

Why

The same claude-review workflow is maintained across four stellar repos. Moving to stellar/actions lets all repos share one implementation, so the security model and prompt updates live in one place. The reusable workflow also adopts the harder pull_request_target flow with an author-association gate, enabling reviews of fork PRs from org members while still keeping secrets out of attacker-controlled code paths.

Example

Before — fully inlined workflow with pull_request trigger.

After:

name: Claude Review

on:
  pull_request:
    types: [ready_for_review, synchronize]

concurrency:
  group: claude-review-${{ github.event.pull_request.number }}
  cancel-in-progress: true

permissions: {}

jobs:
  review:
    uses: stellar/actions/.github/workflows/claude-review.yml@main
    secrets:
      anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

Note

Requires the corresponding PR in stellar/actions to be merged first so that stellar/actions/.github/workflows/claude-review.yml@main resolves:

• Add claude-review reusable workflow actions#103