For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

A first-pass review catches the routine problems before a human spends attention on them. This example runs Claude Code from a GitHub webhook: a pull request opens, a session starts, the agent reads the diff and posts its notes to Slack, and the session is torn down.

The important difference from Refactor a Repository is that nobody is at a terminal. That changes how permissions have to be written.

Write a Spec That Can Run Unattended

There is no one to answer an approval prompt on a triggered run, so triggers reject a spec that could produce one. With --session-mode fresh, creating a trigger fails if the spec’s permissions default is ask, if any rule uses action: ask, or if there is no permissions block at all.

The pattern that works is an allow default with explicit denies for anything the agent must never do. Save the following as pr-review.yaml:

name: pr-reviewer
agent: claude-code
size: mars-2vcpu-4gb
repos:
  - your-org/your-service
env:
  HARNESS_INFERENCE_MODEL: anthropic-claude-5-sonnet
secrets:
  HARNESS_INFERENCE_API_KEY: ${HARNESS_INFERENCE_API_KEY}
  GITHUB_TOKEN: ${GITHUB_TOKEN}
egress:
  - github.com
  - api.github.com
permissions:
  default: allow
  rules:
    - tool: file.write
      action: deny
    - tool: bash
      match: { command: "rm -rf *" }
      action: deny

Model access works the same as in Refactor a Repository: the model access key in HARNESS_INFERENCE_API_KEY is captured when the trigger is created and reused on every firing, so nothing has to supply a credential when a pull request opens.

file.write is denied because this agent’s job is to read and report. It clones the repository, reads the diff, and writes a summary as its final output. Nothing it does should change the checkout.

The choice of adapter matters for that deny. A permission rule naming a tool the adapter does not declare is rejected at session create rather than ignored, and the Codex CLI adapter declares only bash. This spec uses claude-code, which declares file.write, so the rule is enforceable. See Agent Adapters for what each adapter supports.

Create the Trigger

Create a webhook trigger bound to that spec. --provider github tells the platform how to verify the signature on inbound deliveries:

doctl harness-runtime triggers create \
  --kind webhook \
  --name pr-reviewer \
  --session-mode fresh \
  --spec pr-review.yaml \
  --provider github \
  --prompt "Clone your-org/your-service and review this pull request: {{.pull_request.html_url}}. Report correctness risks, missing tests, and anything that looks unintentional. Be brief." \
  --output-mode slack \
  --output-slack-webhook <your-slack-incoming-webhook-url>

--session-mode fresh starts a new session per delivery and tears it down afterward, which is what you want when reviews are independent of each other.

The prompt can reach into the webhook payload. {{.pull_request.html_url}} pulls a single field out of the JSON body, and {{payload}} embeds the whole delivery. A field that is not present becomes an empty string.

The response includes the trigger’s webhook URL and secret. The secret is shown once, so copy both values and paste them into your repository’s webhook settings on GitHub before you move on. If you lose the secret, issue a new one with doctl harness-runtime triggers rotate-secret.

Check That It Ran

Every firing is recorded as an execution:

doctl harness-runtime triggers list-executions <trigger-id>
doctl harness-runtime triggers get-execution <trigger-id> <execution-id>

get-execution shows the inbound payload alongside the agent’s output, which is usually enough to tell a bad prompt from a bad payload. Each execution also records its session ID, so you can replay the whole transcript:

doctl harness-runtime logs <session-id>

Adapt It

Related

• Run Agents With Triggers for the full trigger surface.
• Configure Permissions for how rules are evaluated.
• Approvals for what happens when an agent asks and nobody answers.