chore: revert per-push review trigger; drop synchronize from summary (#7)

Restores pre-9bc9666 on-demand-only behavior for the PR review caller
example. 9bc9666 added auto-runs on every PR push (opened, synchronize,
reopened, ready_for_review) bundled into a structured_output fix; that
trigger expansion caused token-burn storms downstream — one observed PR
had 14 review runs in 24h from repeated pushes, and each review fans
out to 30-67 Anthropic API calls.

Review now runs only on:
  - /review comment (optionally /review opus or /review haiku)
  - needs-review label

Summary loses the synchronize trigger (still runs on opened/reopened/
ready_for_review) and gains paths-ignore for docs.

Security hardening from 9bc9666 (env-var refactor of get-pr / get-model
steps to avoid shell injection in ${{ }} interpolation) is preserved.

README updated to match new trigger semantics for both workflows.

Downstream callers in LiskHQ/lisk-{backend,web,mobile,infra} need the
same change applied to their .github/workflows/claude-pr-*.yml files;
this PR fixes the example so future copies don't reintroduce the issue.

Author: shuse2

README.md

@@ -13,13 +13,13 @@ Reusable GitHub Actions workflows for Claude Code reviews. Each repo defines its
 
 ### 1. PR Review
 - **File**: `claude-pr-review.yml`
-- **Trigger**: Auto-runs on every PR push (open, synchronize, reopen, ready_for_review). Manual re-runs via `/review` comment or `needs-review` label; skips draft PRs and bot actors.
+- **Trigger**: On-demand only — `/review` comment (optionally `/review opus` or `/review haiku`) or `needs-review` label. Skips bot actors. No auto-run on push (avoids token burn from PRs with many pushes).
 - **Does**: Structured code review with inline comments, severity levels, focuses on bugs/security/performance
 - **Example**: See `examples/workflows/claude-pr-review-caller.yml`
 
 ### 2. PR Summary
 - **File**: `claude-pr-summary.yml`
-- **Trigger**: Auto-runs when PR opens or updates
+- **Trigger**: Runs on PR `opened`, `reopened`, or `ready_for_review`. Skips doc-only PRs (`**/*.md`, `docs/**`).
 - **Does**: Generates concise summary, updates PR description
 - **Example**: See `examples/workflows/claude-pr-summary-caller.yml`
 

examples/workflows/claude-pr-review-caller.yml

@@ -1,33 +1,35 @@
 # Example: Call the reusable PR review workflow
 # Copy this file to your repo's .github/workflows/ directory
 #
-# Triggers:
-#   Every push to a PR (opened, synchronize, reopened, ready_for_review)
-#   /review          - manual re-run (also lets you pick a model)
-#   /review opus     - manual re-run with opus
-#   /review haiku    - manual re-run with haiku
-#   needs-review     - label trigger (also re-runs)
+# Triggers (on-demand only — does NOT auto-run on every push):
+#   /review          - comment to run review (default sonnet)
+#   /review opus     - comment to run with opus
+#   /review haiku    - comment to run with haiku
+#   needs-review     - apply label to run review
+#
+# Rationale: auto-running on every push (synchronize) burns Anthropic
+# tokens proportional to PR push count. On-demand triggers keep cost
+# bounded to actual review requests.
 
 name: Claude PR Review
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review, labeled]
+    types: [labeled]
   issue_comment:
     types: [created]
 
-# Prevent multiple runs for the same PR. cancel-in-progress means a fresh push
-# cancels the in-flight review and starts a new one — avoids reviewing stale SHAs.
+# Prevent overlapping runs for the same PR (e.g. label + comment in quick
+# succession). cancel-in-progress drops the older run.
 concurrency:
   group: claude-review-${{ github.event.pull_request.number || github.event.issue.number }}
   cancel-in-progress: true
 
 jobs:
   check-trigger:
     # Run when any of:
-    #   1. PR push/open/ready (non-draft, non-bot)
-    #   2. PR labeled with `needs-review`
-    #   3. PR comment contains `/review`
+    #   1. PR labeled with `needs-review`
+    #   2. PR comment contains `/review`
     # Always skip bot-authored PRs and bot comments.
     if: |
       github.actor != 'dependabot[bot]' &&
@@ -36,12 +38,8 @@ jobs:
       github.actor != 'github-actions[bot]' &&
       (
         (github.event_name == 'pull_request' &&
-         github.event.pull_request.draft == false &&
-         (github.event.action == 'opened' ||
-          github.event.action == 'synchronize' ||
-          github.event.action == 'reopened' ||
-          github.event.action == 'ready_for_review' ||
-          (github.event.action == 'labeled' && github.event.label.name == 'needs-review'))) ||
+         github.event.action == 'labeled' &&
+         github.event.label.name == 'needs-review') ||
         (github.event_name == 'issue_comment' &&
          github.event.issue.pull_request &&
          contains(github.event.comment.body, '/review'))

examples/workflows/claude-pr-summary-caller.yml

@@ -5,7 +5,10 @@ name: Claude PR Summary
 
 on:
   pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
+    types: [opened, reopened, ready_for_review]
+    paths-ignore:
+      - '**/*.md'
+      - 'docs/**'
 
 # Prevent multiple runs for the same PR
 concurrency: