.github: harden codegenie review (key preflight, CLAUDE_API_KEY, config)

.github/workflows/codegenie-review.yml

@@ -36,13 +36,25 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      # Fail fast with a legible error if the LLM key isn't provisioned for
+      # this repo — otherwise codegenie fails deep in its run with a generic
+      # config_error.
+      - name: Verify API key secret
+        env:
+          KEY: ${{ secrets.CLAUDE_API_KEY }}
+        run: |
+          if [ -z "$KEY" ]; then
+            echo "::error::CLAUDE_API_KEY is missing or empty for this repo"
+            exit 1
+          fi
+
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
 
       - uses: 0xPolygon/codegenie@v0.4.2
         with:
           model: "anthropic/claude-opus-4-8:high"
-          llm-api-key: ${{ secrets.ANTHROPIC_API_KEY_GITHUB_ACTIONS }}
+          llm-api-key: ${{ secrets.CLAUDE_API_KEY }}
           trigger-phrase: "codegenie review"
           post-inline-comments: "true"

codegenie.toml

@@ -0,0 +1,83 @@
+# codegenie AI code review config. See https://github.com/0xPolygon/codegenie
+#
+# Provider credentials and model selection live in the workflow
+# (.github/workflows/codegenie-review.yml) for CI and in ~/.codegenie/ locally;
+# only repo-safe review/classification keys belong here.
+
+[git]
+baseBranch = "develop"
+
+[review]
+depth = "normal"
+
+# Generated code — regenerated by tooling, not hand-reviewed.
+
+[[classification.pathRules]]
+pattern = "**/gen_*.go"
+processingMode = "skip"
+reason = "gencodec-generated marshaling (go:generate gencodec), marked do-not-edit"
+
+[[classification.pathRules]]
+pattern = "**/*.pb.go"
+processingMode = "skip"
+reason = "protoc-generated protobuf bindings"
+
+[[classification.pathRules]]
+pattern = "**/*_mock.go"
+processingMode = "skip"
+reason = "mockgen-generated test doubles"
+
+[[classification.pathRules]]
+pattern = "tests/bor/mocks/**"
+processingMode = "skip"
+reason = "generated Heimdall client mocks"
+
+[[classification.pathRules]]
+pattern = "docs/cli/**"
+processingMode = "skip"
+reason = "generated CLI reference (make docs)"
+
+# Consensus-critical zones, mirroring the scopes in .claude/rules. Bugs here
+# can halt the chain, split consensus, or lose funds.
+
+[[classification.pathRules]]
+pattern = "consensus/**"
+reviewPriority = "critical"
+labels = ["consensus"]
+reason = "validator auth, sprint/span block production, Heimdall trust, fork choice"
+
+[[classification.pathRules]]
+pattern = "miner/**"
+reviewPriority = "critical"
+labels = ["consensus"]
+reason = "block production and pending-gate liveness"
+
+[[classification.pathRules]]
+pattern = "core/vm/**"
+reviewPriority = "critical"
+labels = ["evm"]
+reason = "gas accounting, opcodes, precompile safety, EIP and fork gating"
+
+[[classification.pathRules]]
+pattern = "params/**"
+reviewPriority = "critical"
+labels = ["hardfork"]
+reason = "hardfork activation wiring and chain config; runtime/genesis parity"
+
+[[classification.pathRules]]
+pattern = "core/txpool/**"
+reviewPriority = "critical"
+labels = ["txpool"]
+reason = "pool limits, validation ordering, eviction, blob handling"
+
+[[classification.pathRules]]
+pattern = "core/state/**"
+reviewPriority = "critical"
+labels = ["state"]
+reason = "state root determinism and journal correctness"
+
+[[classification.pathRules]]
+pattern = "core/blockstm/**"
+reviewPriority = "critical"
+labels = ["state"]
+reason = "parallel execution safety and determinism"