Add claude code action - #214
Conversation
|
@RobotSail, thank you for adding these changes! I'll take a look at the failing tests in this PR and a bunch of others, and we can get your changes in once those are fixed. |
|
@RobotSail can you fix the ci? we'd like to have it merged |
|
@RobotSail could we please rebase? |
* Add demo video walkthrough to README Signed-off-by: Luke Inglis <lukeinglis21@yahoo.com> * Add live demo link to README Signed-off-by: Luke Inglis <lukeinglis21@yahoo.com> --------- Signed-off-by: Luke Inglis <lukeinglis21@yahoo.com>
- Standalone workflow triggered by @claude-code or @claude_code - Uses Opus 4.6 (1M context) with max effort and 128k thinking tokens - Write-access gate before GCP auth for public repo security - Eyes emoji ACK on trigger - SHA-pinned third-party actions - Shared skills loaded from claude-skills repo - Official plugins: code-review, commit-commands, feature-dev, huggingface-skills, frontend-design
1d49cc9 to
a204095
Compare
📝 WalkthroughWalkthroughA new GitHub Actions workflow adds a Claude Code job for issue, comment, review, and assignment events when trigger phrases are present, and the README adds a Demo section with links to the walkthrough video, browser demo, and setup instructions. ChangesClaude Code workflow
README demo section
Sequence Diagram(s)sequenceDiagram
participant GitHubEvent
participant ClaudeCodeWorkflow as Claude Code workflow
participant GhCLI as gh CLI
participant CheckoutAction as actions/checkout
participant GCPAuth as google-github-actions/auth
participant ClaudeCodeAction as anthropics/claude-code-action@v1
GitHubEvent->>ClaudeCodeWorkflow: trigger issue, comment, review, or assignment event
ClaudeCodeWorkflow->>GhCLI: verify actor permission and add eyes reaction
ClaudeCodeWorkflow->>CheckoutAction: checkout repository and claude-skills
ClaudeCodeWorkflow->>GCPAuth: authenticate with GCP service account key
ClaudeCodeWorkflow->>ClaudeCodeAction: run Claude Code on Vertex
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude.yml:
- Around line 15-19: The workflow trigger currently allows both `@claude-code` and
`@claude_code`, but the anthropics/claude-code-action input trigger_phrase only
does its own single-phrase check, so the job can start and the action still
ignore the underscore alias. Update the claude job configuration in claude.yml
so the trigger_phrase setting matches the alias you intend to support, or
confirm and use the action’s documented syntax if it supports multiple phrases;
otherwise align the workflow’s if condition with the action’s internal trigger
handling. Refer to the claude-code-action invocation and its trigger_phrase
input when making the change.
- Around line 73-77: The workflow’s GCP auth setup is mixing an unused OIDC
permission with a static service account key. In the job permissions block,
remove id-token: write if you are keeping the current credentials_json-based
approach, or better, update the Authenticate to GCP step to use Workload
Identity Federation instead of GCP_SA_KEY. Use the auth step and the surrounding
job configuration to locate the change, and ensure the final setup matches the
chosen auth method without leaving unused OIDC permissions enabled.
- Around line 56-65: The fork remote setup step is gated by an
`issue.pull_request` check that only works for `issue_comment`, so it skips
`pull_request_review` and `pull_request_review_comment` on cross-repo PRs.
Update the conditional in the `Add fork remote for cross-repo PRs` step to use a
PR-event-safe check that covers all three PR-triggered event types, and keep the
existing `gh api`/`git remote set-url --add origin` logic unchanged. If needed,
centralize PR detection in a shared helper expression so the step runs whenever
the workflow is handling a PR review/comment from a fork.
- Around line 67-71: The workflow is still pulling mutable inputs into the
Claude execution path, so harden the shared skills and plugin marketplace setup
in the workflow job. In the Load shared skills checkout step, add a pinned ref
for the claude-skills repository and disable credential persistence with
persist-credentials false; then update the marketplace setup so
plugin_marketplaces points to a locally checked-out marketplace directory
instead of a remote URL, with that repo fetched earlier at a specific commit
SHA. Also make sure the marketplace.json used by the pinned checkout locks each
plugin source with sha when available so the plugin set stays immutable.
In `@README.md`:
- Around line 221-230: The README has a duplicated Demo heading and content,
triggering a markdownlint duplicate-heading warning. Remove the second `## Demo`
block so only one demo section remains, and keep the existing demo content under
the original `## Demo` heading.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: d1360e4d-4841-4f46-8665-265711cc6e67
📒 Files selected for processing (2)
.github/workflows/claude.ymlREADME.md
| if: | | ||
| (github.event_name == 'issue_comment' && (contains(github.event.comment.body, '@claude-code') || contains(github.event.comment.body, '@claude_code'))) || | ||
| (github.event_name == 'pull_request_review_comment' && (contains(github.event.comment.body, '@claude-code') || contains(github.event.comment.body, '@claude_code'))) || | ||
| (github.event_name == 'pull_request_review' && (contains(github.event.review.body, '@claude-code') || contains(github.event.review.body, '@claude_code'))) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude-code') || contains(github.event.issue.body, '@claude_code'))) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major
🧩 Analysis chain
🌐 Web query:
For anthropics/claude-code-action v1, does the trigger_phraseinput support multiple trigger phrases or aliases, and what is the correct syntax to support both@claude-codeand@claude_code?
💡 Result:
For anthropics/claude-code-action v1, the trigger_phrase input does not natively support multiple trigger phrases or aliases as a list [1][2]. The input accepts a single string value to define the trigger phrase that the action will monitor [3][2]. To support both @claude-code and @claude_code as trigger phrases, you must handle the logic at the workflow level rather than relying on the trigger_phrase input alone [4]. Because the action's execution is often gated by a conditional if statement in your GitHub Actions workflow file, you should update that condition to check for both strings [4]. For example: if: contains(github.event.comment.body, '@claude-code') || contains(github.event.comment.body, '@claude_code') Additionally, if you set the trigger_phrase input in your workflow configuration to one of your desired phrases (e.g., @claude-code), you may also need to ensure that the logic within the action's environment is aligned or that you have accounted for both patterns in your workflow's job-level triggers [4]. It is a known limitation that simply changing the input without updating the workflow's conditional logic may result in the action failing to trigger as expected [4].
Citations:
- 1: https://github.com/anthropics/claude-code-action/blob/refs/heads/main/action.yml
- 2: https://github.com/anthropics/claude-code-action/blob/main/action.yml
- 3: https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
- 4: V1 Action completly broken: optional trigger does not even work anthropics/claude-code-action#511
Update the trigger_phrase input to handle both aliases or verify action behavior for @claude_code.
The job-level if condition correctly permits execution for both @claude-code and @claude_code, but the anthropics/claude-code-action input trigger_phrase accepts only a single string and performs its own internal check.
If the action is configured with trigger_phrase: "@claude-code", it will likely ignore the trigger for @claude_code comments, causing the job to run but the action to exit without responding.
Fix:
- Verify if the specific action version supports multiple triggers via a specific syntax (docs suggest it does not).
- If not, update the
trigger_phraseinput to match the preferred alias, or ensure the workflow logic aligns with the action's internal expectations. - Alternatively, if the action allows, configure it to accept the underscore variant if that is the primary usage, or split the workflow logic.
Since the action's internal filter is the bottleneck, simply having the workflow if condition is insufficient if the action itself ignores the mismatched trigger.
Please check the anthropics/claude-code-action documentation or source for supported syntax for multiple trigger phrases or confirm if a workaround (like using a generic trigger phrase) is intended.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 15 - 19, The workflow trigger
currently allows both `@claude-code` and `@claude_code`, but the
anthropics/claude-code-action input trigger_phrase only does its own
single-phrase check, so the job can start and the action still ignore the
underscore alias. Update the claude job configuration in claude.yml so the
trigger_phrase setting matches the alias you intend to support, or confirm and
use the action’s documented syntax if it supports multiple phrases; otherwise
align the workflow’s if condition with the action’s internal trigger handling.
Refer to the claude-code-action invocation and its trigger_phrase input when
making the change.
| - name: Add fork remote for cross-repo PRs | ||
| if: github.event.issue.pull_request | ||
| env: | ||
| GH_TOKEN: ${{ github.token }} | ||
| run: | | ||
| PR_NUMBER=${{ github.event.issue.number }} | ||
| FORK_REPO=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER --jq '.head.repo.full_name') | ||
| if [ "$FORK_REPO" != "${{ github.repository }}" ]; then | ||
| git remote set-url --add origin "https://github.com/${FORK_REPO}.git" | ||
| fi |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/claude.ymlRepository: Red-Hat-AI-Innovation-Team/its_hub
Length of output: 5370
🌐 Web query:
github actions event structure issue_comment vs pull_request_review event.json.github.event
💡 Result:
In GitHub Actions, the github.event object contains the webhook payload for the event that triggered the workflow, and its structure varies significantly between event types [1]. The issue_comment and pull_request_review events serve different purposes and provide distinct data structures [2][3]. issue_comment The issue_comment event triggers when a comment is created, edited, or deleted on an issue or a pull request [2]. Because it covers both, the payload includes both issue and pull_request objects, though the pull_request object is only present if the comment was made on a pull request [2]. Key payload paths include: - Comment content: github.event.comment.body [4] - Comment ID: github.event.comment.id [4] - Associated Issue/PR number: github.event.issue.number (note that PRs are treated as issues in the issue_comment payload) [4] - Identification: You can distinguish between an issue or a pull request by checking if github.event.issue.pull_request exists [2]. pull_request_review The pull_request_review event triggers when a pull request review is submitted, edited, or dismissed [2]. This event is specifically for the review action (e.g., approving, requesting changes, or providing a summary comment) rather than individual line comments on a diff [2][3]. Key payload paths include: - Review body: github.event.review.body [4] - Review ID: github.event.review.id [4] - Associated Pull Request number: github.event.pull_request.number [4] - Review State: github.event.review.state (e.g., approved, changes_requested) [2] Key Differences - Context: issue_comment is for general comments on an issue or PR; pull_request_review is specifically for the formal review process [2]. - Data Access: Accessing comment body text is done via github.event.comment.body for issue_comment, whereas pull_request_review uses github.event.review.body [4]. - Hierarchy: In the issue_comment payload, the comment is a top-level object under the event; in pull_request_review, the review information is a distinct object (github.event.review) separate from the pull request details (github.event.pull_request) [4]. For technical implementation, it is best practice to refer to the specific GitHub Webhook documentation for each event type, as these payloads follow the standard REST API webhook structures [2][3].
Citations:
- 1: https://docs.github.com/en/actions/reference/workflows-and-actions/contexts
- 2: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
- 3: https://docs.github.com/en/webhooks/webhook-events-and-payloads?actionType=submitted
- 4: https://github.com/github/gh-aw/blob/main/.github/aw/context.md
Step skips fork remote setup for pull_request_review and pull_request_review_comment events on cross-repo PRs.
The condition if: github.event.issue.pull_request only matches issue_comment events on PRs. For pull_request_review and pull_request_review_comment triggers, github.event.issue doesn't contain the pull_request field, so the fork remote step is skipped.
Use an event-based check that works across all three PR event types:
Proposed fix
- name: Add fork remote for cross-repo PRs
- if: github.event.issue.pull_request
+ if: github.event_name == 'issue_comment' && github.event.issue.pull_request || github.event_name == 'pull_request_review_comment' && github.event.issue.pull_request || github.event_name == 'pull_request_review' && github.event.pull_request.number
env:
GH_TOKEN: ${{ github.token }}
run: |
- PR_NUMBER=${{ github.event.issue.number }}
+ if [ "${{ github.event_name }}" = "pull_request_review" ]; then
+ PR_NUMBER=${{ github.event.pull_request.number }}
+ else
+ PR_NUMBER=${{ github.event.issue.number }}
+ fi
FORK_REPO=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER --jq '.head.repo.full_name')Alternatively, consolidate the condition by checking the actor context or extracting PR number from a unified helper step.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 56 - 65, The fork remote setup
step is gated by an `issue.pull_request` check that only works for
`issue_comment`, so it skips `pull_request_review` and
`pull_request_review_comment` on cross-repo PRs. Update the conditional in the
`Add fork remote for cross-repo PRs` step to use a PR-event-safe check that
covers all three PR-triggered event types, and keep the existing `gh api`/`git
remote set-url --add origin` logic unchanged. If needed, centralize PR detection
in a shared helper expression so the step runs whenever the workflow is handling
a PR review/comment from a fork.
| - name: Load shared skills | ||
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | ||
| with: | ||
| repository: Red-Hat-AI-Innovation-Team/claude-skills | ||
| path: .claude |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major
🧩 Analysis chain
🌐 Web query:
For anthropics/claude-code-action v1 plugins, can plugin_marketplaces or individual plugin entries be pinned to an immutable commit SHA or release?
💡 Result:
For the anthropics/claude-code-action v1 GitHub Action, there is currently no native support for pinning the plugin_marketplaces input directly to an immutable commit SHA via a URL fragment or a structured configuration block [1]. The plugin_marketplaces input expects a newline-separated list of Git repository URLs [2], and it typically clones the HEAD of the default branch [1]. However, you can achieve version pinning for marketplaces through the following workarounds: 1. Local Path Checkouts: Because claude-code-action supports local filesystem paths for plugin_marketplaces [3], you can check out your desired marketplace repository at a specific commit SHA using the official actions/checkout@v4 action in a prior workflow step [3]. You can then pass the local path of that checked-out directory to the plugin_marketplaces input [3]. 2. Individual Plugin Pinning: While the marketplace itself may be dynamic, individual plugins within that marketplace can be pinned to an immutable commit SHA [4][5]. Within the marketplace.json file, plugin sources that use the github type support both ref (branch/tag) and sha fields [6][4]. When both are specified, the sha acts as the effective, immutable pin [6][4]. This ensures that even if the marketplace definition changes, the specific plugin versions installed by Claude Code remain locked to the defined commit [4][7]. Official documentation confirms that for plugins, providing a full commit SHA in the sha field is the supported method for ensuring reproducible installations [6][4]. Organizations often manage this by updating these SHAs in their marketplace.json alongside version bumps to maintain controlled release cycles [7].
Citations:
- 1: Support version pinning for plugin_marketplaces anthropics/claude-code-action#1229
- 2: https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
- 3: feat: support local plugin marketplace paths anthropics/claude-code-action#761
- 4: [DOCS] Plugin marketplace docs omit deleted-
refbehavior whenshais pinned anthropics/claude-code#58873 - 5: [FEATURE] Allow pinning Git refs in plugin marketplaces (ref for branch/tag/commit) anthropics/claude-code#10571
- 6: https://code.claude.com/docs/en/plugin-marketplaces.md
- 7: Pin plugin installs to git commit SHA via marketplace.json anthropics/claude-code#33653
🏁 Script executed:
sed -n '84,91p' .github/workflows/claude.ymlRepository: Red-Hat-AI-Innovation-Team/its_hub
Length of output: 551
Pin mutable inputs for shared skills and plugin marketplaces before executing Claude code.
The workflow pins Actions by SHA but loads unversioned inputs (skills repo ref and plugin marketplace URL) into a high-privilege run. Fix:
- Add a pinned
refand setpersist-credentials: falsefor the shared skills checkout. - For the plugin marketplace, switch from the remote URL to a local path by checking out the marketplace repo at a specific commit SHA in a prior step, then pass that local path to
plugin_marketplaces.
Apply these hardening steps
- repository: Red-Hat-AI-Innovation-Team/claude-skills
+ repository: Red-Hat-AI-Innovation-Team/claude-skills
+ ref: <pinned-commit-sha-or-reviewed-tag>
+ persist-credentials: false
path: .claudeReplace the marketplace URL with a local path (example):
- name: Checkout pinned plugin marketplace
- uses: actions/checkout@v4
+ uses: actions/checkout@v4
with:
- repository: anthropics/claude-plugins-official
- path: plugin-marketplace
+ repository: anthropics/claude-plugins-official
+ ref: <pinned-commit-sha-or-reviewed-tag>
+ path: plugin-marketplace
+ persist-credentials: false
- name: Run Claude action
uses: anthropics/claude-code-action@v1
with:
- plugin_marketplaces: |
- https://github.com/anthropics/claude-plugins-official.git
+ plugin_marketplaces: |
+ ./plugin-marketplaceAdditionally, ensure marketplace.json in the pinned checkout uses the sha field for each plugin source (when present) to lock plugin versions immutably.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 67-71: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 67 - 71, The workflow is still
pulling mutable inputs into the Claude execution path, so harden the shared
skills and plugin marketplace setup in the workflow job. In the Load shared
skills checkout step, add a pinned ref for the claude-skills repository and
disable credential persistence with persist-credentials false; then update the
marketplace setup so plugin_marketplaces points to a locally checked-out
marketplace directory instead of a remote URL, with that repo fetched earlier at
a specific commit SHA. Also make sure the marketplace.json used by the pinned
checkout locks each plugin source with sha when available so the plugin set
stays immutable.
Source: Linters/SAST tools
| - name: Authenticate to GCP | ||
| uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2 | ||
| with: | ||
| credentials_json: ${{ secrets.GCP_SA_KEY }} | ||
|
|
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/claude.ymlRepository: Red-Hat-AI-Innovation-Team/its_hub
Length of output: 5370
🏁 Script executed:
ls -la .github/workflows/Repository: Red-Hat-AI-Innovation-Team/its_hub
Length of output: 716
🏁 Script executed:
grep -n "workload_identity_provider\|GCP_WORKLOAD_IDENTITY_PROVIDER" .github/workflows/*.yamlRepository: Red-Hat-AI-Innovation-Team/its_hub
Length of output: 172
Prefer Workload Identity Federation and remove unused OIDC permissions.
The job grants id-token: write (line 25) but authenticates with a static credentials_json secret (lines 75-76). The OIDC permission is currently unused and exposes a long-lived static key unnecessarily.
- Immediate fix: Remove
id-token: writefrom the permissions block if you intend to keep using the static key short-term. - Recommended: Migrate to Workload Identity Federation (WIF). This requires setting up a Workload Identity Provider in your GCP Console and binding it to a Service Account. Once configured, you can remove the
GCP_SA_KEYsecret andcredentials_jsoninput.
Current authentication relies on long-lived credentials; WIF would provide short-lived, automatically rotated tokens.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 73 - 77, The workflow’s GCP auth
setup is mixing an unused OIDC permission with a static service account key. In
the job permissions block, remove id-token: write if you are keeping the current
credentials_json-based approach, or better, update the Authenticate to GCP step
to use Workload Identity Federation instead of GCP_SA_KEY. Use the auth step and
the surrounding job configuration to locate the change, and ensure the final
setup matches the chosen auth method without leaving unused OIDC permissions
enabled.
| ## Demo | ||
|
|
||
| See the library in action with a walkthrough of inference-time scaling algorithms: | ||
|
|
||
| [](https://www.youtube.com/watch?v=qaXyvmR-YBU) | ||
|
|
||
| Try it in your browser: [https://red.ht/its-hub-demo](https://red.ht/its-hub-demo) | ||
|
|
||
| To run the demo yourself, see the [demo setup instructions](https://github.com/lukeinglis/its_hub_demo/blob/main/demo_ui/README.md). | ||
|
|
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Remove duplicate ## Demo section.
This inserted section duplicates the identical ## Demo section at lines 211-219, causing a markdownlint warning (MD024/no-duplicate-heading) and redundant content. Remove lines 221-230.
🛠️ Proposed fix
-## Demo
-
-See the library in action with a walkthrough of inference-time scaling algorithms:
-
-[](https://www.youtube.com/watch?v=qaXyvmR-YBU)
-
-Try it in your browser: [https://red.ht/its-hub-demo](https://red.ht/its-hub-demo)
-
-To run the demo yourself, see the [demo setup instructions](https://github.com/lukeinglis/its_hub_demo/blob/main/demo_ui/README.md).
-
For detailed documentation, visit: [https://ai-innovation.team/its_hub](https://ai-innovation.team/its_hub)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ## Demo | |
| See the library in action with a walkthrough of inference-time scaling algorithms: | |
| [](https://www.youtube.com/watch?v=qaXyvmR-YBU) | |
| Try it in your browser: [https://red.ht/its-hub-demo](https://red.ht/its-hub-demo) | |
| To run the demo yourself, see the [demo setup instructions](https://github.com/lukeinglis/its_hub_demo/blob/main/demo_ui/README.md). |
🧰 Tools
🪛 markdownlint-cli2 (0.22.1)
[warning] 221-221: Multiple headings with the same content
(MD024, no-duplicate-heading)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@README.md` around lines 221 - 230, The README has a duplicated Demo heading
and content, triggering a markdownlint duplicate-heading warning. Remove the
second `## Demo` block so only one demo section remains, and keep the existing
demo content under the original `## Demo` heading.
Source: Linters/SAST tools
5 participants
Summary by CodeRabbit