Conversation
WalkthroughAdds two new GitHub Actions workflows to run a Claude-based code assistant: one auto-invoked on pull request open/sync for code review, and another triggered by @claude mentions across issues, comments, and reviews. Both check out the repo and execute anthropics/claude-code-action@beta with configurable, mostly commented, options. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant Dev as Developer
participant GH as GitHub
participant WF as Workflow: claude-code-review.yml
participant Act as Claude Code Action
participant PR as Pull Request
Dev->>GH: Open/Synchronize PR
GH-->>WF: Trigger on pull_request (opened/synchronize)
WF->>WF: Checkout repo (fetch-depth: 1)
WF->>Act: Run anthropics/claude-code-action@beta<br/>with CLAUDE_CODE_OAUTH_TOKEN + direct_prompt
Act-->>PR: Post code review comments/status (as configured)
note over WF,Act: Optional configs (model, sticky comments, skip logic) are available but commented out
sequenceDiagram
autonumber
participant User as User
participant GH as GitHub
participant WF as Workflow: claude.yml
participant Act as Claude Code Action
participant Thread as Issue/PR/Review Thread
User->>GH: Create/Update Issue/Comment/Review mentioning @claude
GH-->>WF: Conditional trigger (content contains @claude)
WF->>WF: Checkout repo (fetch-depth: 1)
WF->>Act: Run anthropics/claude-code-action@beta<br/>with CLAUDE_CODE_OAUTH_TOKEN<br/>+ actions:read permission
Act-->>Thread: Reply with results/analysis
note over WF,Act: Optional inputs (model, trigger_phrase, allowed_tools, env) are commented for future use
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (13)
.github/workflows/claude-code-review.yml (7)
3-12: Consider widening triggers (reopened, ready_for_review) and adding manual dispatch.Captures more real-world PR states and gives maintainers a manual knob.
on: pull_request: - types: [opened, synchronize] + types: [opened, synchronize, reopened, ready_for_review] + workflow_dispatch:
21-27: Tighten permissions;id-token: writelikely unnecessary here.Unless the action explicitly needs OIDC, drop it. Also,
issues: readmay not be needed for a plain PR review.jobs: claude-review: runs-on: ubuntu-latest permissions: contents: read pull-requests: read - issues: read - id-token: write + # issues: read # Uncomment only if the action reads issues explicitly + # id-token: write # Uncomment only if OIDC is required by the actionIf the action requires either permission, please point to that requirement and keep it. Otherwise, removing them follows least-privilege.
28-33: Harden checkout step (avoid leaking default GITHUB_TOKEN to later steps).Setting
persist-credentials: falseprevents accidental reuse of the token by tools the action may invoke.- name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 1 + persist-credentials: false
43-53: Prompt is clear; consider asking for severity labels and actionable diffs.This improves signal-to-noise in automated reviews.
direct_prompt: | Please review this pull request and provide feedback on: - Code quality and best practices - Potential bugs or issues - Performance considerations - Security concerns - Test coverage - Be constructive and helpful in your feedback. + Be constructive and helpful. Group findings by severity (Critical/Major/Minor/Nit). + Where feasible, include minimal diff suggestions and quick reproduction steps.
54-78: Enable sticky comments and add skip/draft guards to reduce churn.Sticky comments prevent duplication; skipping drafts and opt-out titles avoids wasted cycles.
- # use_sticky_comment: true + use_sticky_comment: true @@ - # if: | - # !contains(github.event.pull_request.title, '[skip-review]') && - # !contains(github.event.pull_request.title, '[WIP]') + # Only run on non-draft PRs and when not opted out + if: | + !github.event.pull_request.draft && + !contains(github.event.pull_request.title, '[skip-review]') && + !contains(github.event.pull_request.title, '[WIP]')
13-27: Add job-level concurrency to auto-cancel outdated review runs.Saves compute on rapid pushes.
jobs: claude-review: + concurrency: + group: claude-review-${{ github.event.pull_request.number }} + cancel-in-progress: true
1-79: Fix YAML lint nits (trailing spaces and final blank line).Yamllint flagged trailing spaces on Lines 20, 27, 51, 56, 64, 67, 70, 73 and an extra blank line at the end. Trim whitespace and remove the final blank line to keep CI and editors happy.
.github/workflows/claude.yml (6)
3-12: Expand event types to catch edits where @claude is added later.Covers mention edits on issues and comments.
on: issue_comment: - types: [created] + types: [created, edited] pull_request_review_comment: - types: [created] + types: [created, edited] issues: - types: [opened, assigned] + types: [opened, assigned, edited] pull_request_review: - types: [submitted] + types: [submitted, edited]
21-27: Review permission scope;id-token: writemay not be needed.Unless the action uses OIDC, remove
id-token: write. Keepingactions: readis fine for CI visibility.permissions: contents: read pull-requests: read issues: read - id-token: write + # id-token: write # Uncomment only if required by the action actions: read # Required for Claude to read CI results on PRs
28-33: Harden checkout step by disabling credential persistence.- name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 1 + persist-credentials: false
52-54: Be conservative withallowed_toolswhen you enable it.If/when you uncomment this, prefer a tight allowlist and short job timeouts to limit blast radius.
# allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)" + # timeout-minutes: 15
13-20: Add job-level concurrency to avoid duplicate runs on the same item.jobs: claude: + concurrency: + group: claude-${{ github.event_name }}-${{ github.event.issue.number || github.event.pull_request.number || github.run_id }} + cancel-in-progress: true
1-65: Fix YAML lint nits (trailing spaces and final blank line).Trim trailing spaces on Lines 42, 45, 48, 51, 54, 60 and remove the trailing blank line at the end to appease yamllint and avoid noisy diffs.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml(1 hunks).github/workflows/claude.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/claude.yml
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 48-48: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 54-54: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[warning] 64-64: too many blank lines (1 > 0)
(empty-lines)
.github/workflows/claude-code-review.yml
[error] 20-20: trailing spaces
(trailing-spaces)
[error] 27-27: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 73-73: trailing spaces
(trailing-spaces)
[warning] 78-78: too many blank lines (1 > 0)
(empty-lines)
🔇 Additional comments (1)
.github/workflows/claude.yml (1)
39-42: LGTM on additional_permissions.Appropriately grants read-only access to Actions so Claude can surface CI results.
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@beta | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the action to a commit SHA instead of @beta.
Prevents supply-chain surprises if the beta tag moves.
- uses: anthropics/claude-code-action@beta
+ # Pin to a verified commit SHA to avoid tag drift
+ uses: anthropics/claude-code-action@<COMMIT-SHA>Replace <COMMIT-SHA> with the published commit you trust.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@beta | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| # Pin to a verified commit SHA to avoid tag drift | |
| uses: anthropics/claude-code-action@<COMMIT-SHA> | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
🤖 Prompt for AI Agents
In .github/workflows/claude-code-review.yml around lines 34 to 39, the workflow
uses the action anthropics/claude-code-action@beta which should be pinned to a
specific commit SHA; update the uses line to reference the trusted commit SHA
(replace @beta with @<COMMIT-SHA>) so the workflow uses an immutable, reviewed
version of the action and avoid tag drifting.
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Gate on author association to ensure only trusted users can trigger runs.
Prevents external users from triggering a workflow that has access to repo context and secrets.
claude:
- if: |
- (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
- (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
- (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
- (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+ if: |
+ (
+ github.event_name == 'issue_comment' &&
+ github.event.comment.author_association in ['MEMBER','OWNER','COLLABORATOR'] &&
+ contains(github.event.comment.body, '@claude')
+ ) || (
+ github.event_name == 'pull_request_review_comment' &&
+ github.event.comment.author_association in ['MEMBER','OWNER','COLLABORATOR'] &&
+ contains(github.event.comment.body, '@claude')
+ ) || (
+ github.event_name == 'pull_request_review' &&
+ github.event.review.author_association in ['MEMBER','OWNER','COLLABORATOR'] &&
+ github.event.review.body != null &&
+ contains(github.event.review.body, '@claude')
+ ) || (
+ github.event_name == 'issues' &&
+ github.event.issue.author_association in ['MEMBER','OWNER','COLLABORATOR'] &&
+ (
+ (github.event.issue.body != null && contains(github.event.issue.body, '@claude')) ||
+ contains(github.event.issue.title, '@claude')
+ )
+ )Note: GitHub expressions don’t have a native array membership operator; the above pattern uses multiple equality checks via in [...] for readability—if your linter flags it, expand it to == 'MEMBER' || == 'OWNER' || == 'COLLABORATOR'.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if: | | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| runs-on: ubuntu-latest | |
| if: | | |
| ( | |
| github.event_name == 'issue_comment' && | |
| github.event.comment.author_association in ['MEMBER','OWNER','COLLABORATOR'] && | |
| contains(github.event.comment.body, '@claude') | |
| ) || ( | |
| github.event_name == 'pull_request_review_comment' && | |
| github.event.comment.author_association in ['MEMBER','OWNER','COLLABORATOR'] && | |
| contains(github.event.comment.body, '@claude') | |
| ) || ( | |
| github.event_name == 'pull_request_review' && | |
| github.event.review.author_association in ['MEMBER','OWNER','COLLABORATOR'] && | |
| github.event.review.body != null && | |
| contains(github.event.review.body, '@claude') | |
| ) || ( | |
| github.event_name == 'issues' && | |
| github.event.issue.author_association in ['MEMBER','OWNER','COLLABORATOR'] && | |
| ( | |
| (github.event.issue.body != null && contains(github.event.issue.body, '@claude')) || | |
| contains(github.event.issue.title, '@claude') | |
| ) | |
| ) | |
| runs-on: ubuntu-latest |
🤖 Prompt for AI Agents
.github/workflows/claude.yml around lines 15 to 20: the workflow currently
triggers whenever a comment or issue contains '@claude' but does not restrict
who authored the triggering event; add author association checks so only trusted
users (e.g., OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR) can trigger the job.
Update the if expression for each event branch to also require the appropriate
author association field (github.event.comment.author_association,
github.event.review.author_association, github.event.issue.author_association)
to be one of the allowed values, using explicit equality comparisons joined with
|| (or expand into the linter-friendly form) so untrusted external users cannot
trigger runs with repo context and secrets.
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@beta | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
|
|
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the action to a commit SHA instead of @beta.
Avoids unexpected behavior if beta updates.
- uses: anthropics/claude-code-action@beta
+ uses: anthropics/claude-code-action@<COMMIT-SHA>📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@beta | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@<COMMIT-SHA> | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
🤖 Prompt for AI Agents
.github/workflows/claude.yml lines 33-38: the workflow currently uses
anthropics/claude-code-action@beta which can change unexpectedly; replace the
floating tag with a specific commit SHA (pin to a fixed revision). Find the
action's repository, pick a stable commit SHA (from the tag or recent release)
and update the uses value to anthropics/claude-code-action@<COMMIT_SHA>; commit
the change and optionally add a comment noting the pinned SHA and why.
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit