name: Claude Code

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, assigned]
  pull_request_review:
    types: [submitted]

jobs:
  claude:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write
    steps:
      - name: Check user permissions
        id: check_membership
        uses: actions/github-script@v7
        with:
          script: |
            let actor;
            if (context.eventName === 'issue_comment') {
              actor = context.payload.comment.user.login;
            } else if (context.eventName === 'pull_request_review_comment') {
              actor = context.payload.comment.user.login;
            } else if (context.eventName === 'pull_request_review') {
              actor = context.payload.review.user.login;
            } else if (context.eventName === 'issues') {
              actor = context.payload.issue.user.login;
            }
            
            console.log(`Checking permissions for user: ${actor}`);
            
            // List of explicitly allowed users (organization members)
            const allowedUsers = [
              'phernandez',
              'groksrc',
              'nellins',
              'bm-claudeai'
            ];
            
            if (allowedUsers.includes(actor)) {
              console.log(`User ${actor} is in the allowed list`);
              core.setOutput('is_member', true);
              return;
            }
            
            // Fallback: Check if user has repository permissions
            try {
              const collaboration = await github.rest.repos.getCollaboratorPermissionLevel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: actor
              });
              
              const permission = collaboration.data.permission;
              console.log(`User ${actor} has permission level: ${permission}`);
              
              // Allow if user has push access or higher (write, maintain, admin)
              const allowed = ['write', 'maintain', 'admin'].includes(permission);
              
              core.setOutput('is_member', allowed);
              
              if (!allowed) {
                core.notice(`User ${actor} does not have sufficient repository permissions (has: ${permission})`);
              }
            } catch (error) {
              console.log(`Error checking permissions: ${error.message}`);
              
              // Final fallback: Check if user is a public member of the organization
              try {
                const membership = await github.rest.orgs.getMembershipForUser({
                  org: 'basicmachines-co',
                  username: actor
                });
                
                const allowed = membership.data.state === 'active';
                core.setOutput('is_member', allowed);
                
                if (!allowed) {
                  core.notice(`User ${actor} is not a public member of basicmachines-co organization`);
                }
              } catch (membershipError) {
                console.log(`Error checking organization membership: ${membershipError.message}`);
                core.setOutput('is_member', false);
                core.notice(`User ${actor} does not have access to this repository`);
              }
            }

      - name: Checkout repository
        if: steps.check_membership.outputs.is_member == 'true'
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Claude Code
        if: steps.check_membership.outputs.is_member == 'true'
        id: claude
        uses: anthropics/claude-code-action@beta
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          allowed_tools: Bash(uv run pytest),Bash(uv run ruff check . --fix),Bash(uv run ruff format .),Bash(uv run pyright),Bash(just test),Bash(just lint),Bash(just format),Bash(just type-check),Bash(just check),Read,Write,Edit,MultiEdit,Glob,Grep,LS, mcp__web_search