Add Claude Code GitHub Workflow by Razzleberryss · Pull Request #41 · Razzleberryss/AstroTick

Razzleberryss · 2026-04-28T08:15:26Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Note

Medium Risk
Adds new GitHub Actions that run a third-party action with repo/PR/issue read access and id-token: write, so misconfiguration or secret exposure could impact the repository via automation triggers.

Overview
Adds two new GitHub Actions workflows to integrate Claude Code.

claude.yml runs anthropics/claude-code-action@v1 when an issue/PR comment or review contains @claude (with actions: read enabled). claude-code-review.yml runs the same action automatically on PR open/update events using the code-review plugin and a fixed /code-review:code-review prompt.

^{Reviewed by Cursor Bugbot for commit f9068f5. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate the Anthropic Claude Code GitHub Action for (1) on-demand execution via @claude mentions and (2) automatic PR code review.

Changes:

Introduces a @claude-triggered workflow that runs on issue/PR comment and review events.
Adds an automated “Claude Code Review” workflow that runs on PR open/update events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
`.github/workflows/claude.yml`	New workflow to run Claude Code when `@claude` is detected in certain issue/PR events.
`.github/workflows/claude-code-review.yml`	New workflow to run an automated Claude-based code review on pull request events.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-28T08:18:16Z

+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]


The workflow is configured to trigger not only on PR/issue comments, but also on issues (opened/assigned) and pull_request_review (submitted). This differs from the PR description which says it runs “whenever Claude is mentioned in PR or issue comments.” Either update the PR description or adjust the workflow triggers to match the intended behavior.

Copilot · 2026-04-28T08:18:16Z

+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs


This job grants only read permissions (pull-requests: read, issues: read, contents: read). If the action is expected to create PR/issue comments, open branches, or push commits (as described in the PR description), it will need corresponding write permissions (or the description should be updated to clarify it runs read-only).

Copilot · 2026-04-28T08:18:17Z

+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]


Including issues: types: [opened, assigned] means any issue that contains @claude in the title/body will retrigger the workflow on every subsequent assignment event. If the intent is only to respond to new requests, consider removing assigned (or add additional filtering) to avoid repeated/expensive reruns.

Suggested change

types: [opened, assigned]

types: [opened]

Copilot · 2026-04-28T08:18:17Z

+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This runs on the pull_request event but uses ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}. For PRs from forks, GitHub Actions does not provide repository secrets to pull_request workflows, so this job will fail or be skipped in that scenario. If that’s intended, add an explicit condition to run only for same-repo PRs; if you need it for forks, you’ll need a different triggering strategy (e.g., carefully using pull_request_target) and a security review.

Copilot · 2026-04-28T08:18:17Z

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The job-level if only checks for @claude in the comment/review/issue text, but it does not restrict who can trigger the workflow. This contradicts the PR description (“Only users with write access…”) and allows any commenter/issue opener to trigger runs (and consume the OAuth token). Add an authorization gate (e.g., check author_association/repo membership) in the if condition for each event type before running the action.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) ||

(github.event_name == 'issues' &&

(contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association))

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f9068f5. Configure here.}

cursor · 2026-04-28T08:19:12Z

+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read


Insufficient permissions prevent Claude from posting comments

High Severity

Both workflows set pull-requests: read and issues: read, but the claude-code-action requires pull-requests: write (and issues: write for the comment-triggered workflow) to post review comments and responses. The official examples from the anthropics/claude-code-action repository specify pull-requests: write. With read-only permissions, Claude will be unable to create any comments on PRs or issues, making both workflows non-functional.

Additional Locations (1)

.github/workflows/claude.yml#L21-L24

^{Reviewed by Cursor Bugbot for commit f9068f5. Configure here.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f9068f54dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-28T08:22:38Z

+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'


Add --comment to code-review slash command

The code-review plugin command only posts PR feedback when the command is invoked with --comment; without that flag it stops after writing a terminal summary. This workflow calls /code-review:code-review ... without --comment, so the run can appear successful while producing no visible review comments on the pull request, which defeats the purpose of automatic PR review.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-04-28T08:22:38Z

+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]


Guard PR review workflow against fork-triggered failures

This workflow is triggered by pull_request events for all PRs, but it relies on ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} and OIDC token exchange. For fork-origin pull requests, GitHub does not expose repository secrets (and commonly withholds OIDC), so these runs fail early instead of reviewing code. Add an explicit fork guard or a pull_request_target-based safe pattern if you need external-contributor coverage.

Useful? React with 👍 / 👎.

Razzleberryss added 2 commits April 28, 2026 03:14

"Claude PR Assistant workflow"

3c29013

"Claude Code Review workflow"

f9068f5

Copilot AI review requested due to automatic review settings April 28, 2026 08:15

Copilot started reviewing on behalf of Razzleberryss April 28, 2026 08:15 View session

Copilot AI reviewed Apr 28, 2026

View reviewed changes

cursor Bot reviewed Apr 28, 2026

View reviewed changes

Razzleberryss merged commit e3e2202 into main Apr 28, 2026
16 of 19 checks passed

Razzleberryss deleted the add-claude-github-actions-1777364081977 branch April 28, 2026 08:19

chatgpt-codex-connector Bot reviewed Apr 28, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Claude Code GitHub Workflow#41

Add Claude Code GitHub Workflow#41
Razzleberryss merged 2 commits into
mainfrom
add-claude-github-actions-1777364081977

Razzleberryss commented Apr 28, 2026 •

edited by cursor Bot

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

Copilot AI Apr 28, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Apr 28, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Apr 28, 2026

Uh oh!

chatgpt-codex-connector Bot Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		pull_request:
		types: [opened, synchronize, ready_for_review, reopened]

Conversation

Razzleberryss commented Apr 28, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Apr 28, 2026

Choose a reason for hiding this comment

Insufficient permissions prevent Claude from posting comments

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Razzleberryss commented Apr 28, 2026 •

edited by cursor Bot

Loading