ci: add claude code workflows - #441
Closed
abmcar wants to merge 2 commits into
Closed
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds GitHub Actions workflows to integrate Anthropic Claude Code into the repo, enabling (1) on-demand runs triggered by @claude mentions on issues/PR discussions/reviews and (2) automatic PR code-review runs.
Changes:
- Introduces a “Claude Code” workflow that runs on issue/PR comment and review events when
@claudeis present. - Introduces a “Claude Code Review” workflow that runs automatically on PR lifecycle events and invokes the code-review plugin.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| .github/workflows/claude.yml | Adds an event-driven workflow to run Claude Code when @claude is mentioned on issues/PR comments/reviews. |
| .github/workflows/claude-code-review.yml | Adds an automatic PR workflow to run the Claude code-review plugin on PR updates. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+16
to
+19
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
The job can be triggered by any user who can comment/open issues as long as they include @claude, but it uses a repository secret (CLAUDE_CODE_OAUTH_TOKEN). This allows untrusted users to consume the secret-backed Claude integration (and potentially exfiltrate repo context through the action) and incur cost. Restrict execution to trusted actors (e.g., github.event.comment.author_association / github.event.review.author_association in MEMBER|OWNER|COLLABORATOR, or an allowlist), and/or require a protected environment approval before running.
Suggested change
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| (github.event_name == 'issue_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| contains(fromJson('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association) | |
| ) || | |
| (github.event_name == 'pull_request_review_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| contains(fromJson('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association) | |
| ) || | |
| (github.event_name == 'pull_request_review' && | |
| contains(github.event.review.body, '@claude') && | |
| contains(fromJson('["MEMBER","OWNER","COLLABORATOR"]'), github.event.review.author_association) | |
| ) || | |
| (github.event_name == 'issues' && | |
| (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && | |
| contains(fromJson('["MEMBER","OWNER","COLLABORATOR"]'), github.event.issue.author_association) | |
| ) |
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 |
There was a problem hiding this comment.
When triggered via issue_comment on a PR, actions/checkout will default to the repository default branch (the issue_comment event doesn’t set github.ref to the PR merge/head). That means Claude won’t see the PR’s code changes for the most common “@claude in PR discussion” use case. Consider resolving the PR number from the issue_comment payload and checking out the PR head/merge ref explicitly before running the action.
Suggested change
| fetch-depth: 1 | |
| fetch-depth: 1 | |
| ref: ${{ github.event_name == 'issue_comment' && github.event.issue.pull_request && format('refs/pull/{0}/merge', github.event.issue.number) || github.ref }} |
Comment on lines
+34
to
+41
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
This workflow references secrets.CLAUDE_CODE_OAUTH_TOKEN, so it will fail on repositories/branches where the secret isn’t configured, and it will not be available for pull requests from forks (GitHub does not pass secrets to forked PR workflows). To avoid noisy CI failures, add a job-level guard (e.g., only run when the secret is set and/or when head.repo.fork == false) or switch to a trusted event model appropriate for secrets.
Comment on lines
+24
to
+25
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The job permissions are read-only (pull-requests: read, issues: read). If the Claude code-review plugin is expected to publish a PR review/comment back to GitHub, the workflow token won’t be able to create/update PR reviews or issue comments. Grant the minimal required write scopes (typically pull-requests: write and/or issues: write) or configure the action to use an explicit token with those scopes.
Suggested change
| pull-requests: read | |
| issues: read | |
| pull-requests: write | |
| issues: write |
⚡ Performance Regression Check Results✅ Performance Check Passed (interpreter)Performance Benchmark Results (threshold: 25%)
Summary: 194 benchmarks, 0 regressions ✅ Performance Check Passed (multipass)Performance Benchmark Results (threshold: 25%)
Summary: 194 benchmarks, 0 regressions |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. Does this PR affect any open issues?(Y/N) and add issue references (e.g. "fix #123", "re #123".):
2. What is the scope of this PR (e.g. component or file name):
3. Provide a description of the PR(e.g. more details, effects, motivations or doc link):
4. Are there any breaking changes?(Y/N) and describe the breaking changes(e.g. more details, motivations or doc link):
5. Are there test cases for these changes?(Y/N) select and add more details, references or doc links:
6. Release note