ci: upload HTML review report as artifact (#728)

* ci: upload HTML review report as artifact

Instruct grumpy-review to render HTML instead of markdown and save
report.json + report.html to a known directory. Add upload-artifact
step so the interactive report (with Chart.js charts, severity
filtering, sorting) is downloadable from the Actions run.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: harden report artifact — pre-create dir, drop cp, explicit paths

Address bot review comments:
- Pre-create $REPORT_DIR before Claude runs (CodeRabbit)
- Remove Bash(cp *) from allowed tools; write directly to $REPORT_DIR (Copilot)
- Upload only report.json and report.html, not the whole directory (Copilot)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* ci: simplify prompt — drop redundant directory note

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: lklimek

.github/workflows/claude-code-review.yml

@@ -26,6 +26,7 @@ jobs:
       id-token: write
     env:
       CLAUDE_MODEL: ${{ vars.CLAUDE_MODEL || 'opus' }}
+      REPORT_DIR: ${{ github.workspace }}/review-report
     steps:
       - name: Check for OAuth token
         env:
@@ -45,6 +46,9 @@ jobs:
       - name: Configure git to use HTTPS instead of SSH
         run: git config --global url."https://github.com/".insteadOf "git@github.com:"
 
+      - name: Create review report directory
+        run: mkdir -p "$REPORT_DIR"
+
       - name: Run Claude Code Review
         id: claude-review
         uses: anthropics/claude-code-action@v1
@@ -84,6 +88,8 @@ jobs:
             2. Invoke Skill(skill="claudius:grumpy-review") to perform a fresh code review.
                This spawns parallel specialist agents and produces a consolidated report.
                Do NOT review the code yourself — the skill handles the full pipeline.
+               Generate HTML format instead of markdown (use --format html in the render step).
+               Write the final report.json and report.html to $REPORT_DIR.
             3. Post only MEDIUM severity and higher findings as new inline PR comments.
             4. If no unresolved comments remain after the full flow, approve the PR.
           claude_args: |
@@ -92,6 +98,17 @@ jobs:
             --max-turns 150
             --allowedTools "mcp__plugin_claudius_github,Read,Write,Edit,Glob,Grep,Agent,Skill,Task,TaskCreate,TaskUpdate,TaskList,TaskGet,TaskOutput,SendMessage,Bash(gh pr *),Bash(gh api *),Bash(git diff *),Bash(git log *),Bash(git fetch *),Bash(git branch *),Bash(git rev-parse *),Bash(git show *),Bash(git pull *),Bash(git checkout *),Bash(git status),Bash(git status *),Bash(git remote *),Bash(git merge-base *),Bash(cat *),Bash(python3 *),Bash(echo *),Bash(ls *),Bash(grep *),Bash(mkdir *),Bash(mktemp *),Bash(pwd *)"
 
+      - name: Upload review report
+        if: '!cancelled()'
+        uses: actions/upload-artifact@v4
+        with:
+          name: claude-review-report-pr-${{ github.event.pull_request.number }}
+          path: |
+            ${{ env.REPORT_DIR }}/report.json
+            ${{ env.REPORT_DIR }}/report.html
+          retention-days: 14
+          if-no-files-found: ignore
+
       - name: Remove claudius-review label
         if: success()
         env: