Add Claude Code GitHub Workflow by bashandbone · Pull Request #1 · knitli/toolshed

Adam Poulemanos (bashandbone) · 2026-04-08T04:30:13Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning Claude (@claude) in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
Claude (@claude) mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning Claude (@claude) in a comment on any PR to get started!

Copilot

Pull request overview

This PR introduces GitHub Actions workflows to integrate the Anthropic Claude Code agent into the repository, enabling AI-assisted actions via mentions and (optionally) automated PR review.

Changes:

Adds a mention-triggered Claude Code workflow for issues, PR review comments, and PR reviews.
Adds an automated Claude-based code review workflow that runs on pull request lifecycle events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
`.github/workflows/claude.yml`	New workflow to run Claude Code when `@claude` is detected in supported event payloads.
`.github/workflows/claude-code-review.yml`	New workflow to run an automatic Claude code review plugin on PR events.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-08T04:33:45Z

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The workflow can be triggered by any commenter who mentions @claude (including on PRs from forks). This contradicts the PR description’s claim that only users with write access can trigger it, and it risks untrusted users consuming API quota or attempting prompt-injection. Add an explicit gate in the job if: (e.g., require author_association to be OWNER/MEMBER/COLLABORATOR, or check repository permissions) before running the action.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) ||

(github.event_name == 'issues' &&

(contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&

contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association))

Copilot · 2026-04-08T04:33:45Z

+      pull-requests: read
+      issues: read


Job-level permissions are read-only (contents, pull-requests, issues). If you expect Claude to post PR/issue comments, create branches, or push commits as described in the PR body, this will prevent using the workflow GITHUB_TOKEN for those operations. Either grant the minimal required write permissions (e.g., issues: write, pull-requests: write, and/or contents: write) or adjust the PR description/expected capabilities accordingly.

Suggested change

pull-requests: read

issues: read

pull-requests: write

issues: write

Copilot · 2026-04-08T04:33:46Z

+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1


The workflow uses a third-party action (anthropics/claude-code-action@v1) pinned to a moving tag. To reduce supply-chain risk, pin to a specific commit SHA (optionally keeping the tag in a comment for readability).

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@<FULL_40_CHAR_COMMIT_SHA> # v1

Copilot · 2026-04-08T04:33:46Z

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


PR description states the integration is triggered by mentioning @claude in an issue/PR comment, but this workflow runs automatically on every PR open/synchronize/ready_for_review/reopen. Either update the PR description to reflect the always-on automatic review behavior, or add an if: condition (or adjust triggers) so it only runs when intended.

Copilot · 2026-04-08T04:33:46Z

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This workflow relies on secrets.CLAUDE_CODE_OAUTH_TOKEN but is triggered via the pull_request event. For PRs from forks, repository secrets are not provided, which will cause the job to fail/no-op and add noise to CI. Consider gating to same-repo PRs (e.g., head.repo.full_name == github.repository) or switching to a safe alternative pattern if you need to support forked PRs.

Copilot · 2026-04-08T04:33:46Z

+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1


The workflow uses a third-party action (anthropics/claude-code-action@v1) pinned to a moving tag. To reduce supply-chain risk, pin to a specific commit SHA (optionally keeping the tag in a comment for readability).

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@<FULL_LENGTH_COMMIT_SHA> # pin reviewed v1 release commit

Copilot · 2026-04-08T04:33:47Z

+      pull-requests: read
+      issues: read


Job permissions are read-only (pull-requests: read, issues: read). If the code-review plugin is expected to post review comments or PR comments back to GitHub, it will likely require pull-requests: write (and possibly issues: write). Confirm the action’s requirements and grant the minimal necessary permissions so the workflow can publish results.

Suggested change

pull-requests: read

issues: read

pull-requests: write

issues: write

Adam Poulemanos (bashandbone) added 2 commits April 8, 2026 00:29

"Claude PR Assistant workflow"

57cd6d0

"Claude Code Review workflow"

2315819

Copilot AI review requested due to automatic review settings April 8, 2026 04:30

Copilot started reviewing on behalf of Adam Poulemanos (bashandbone) April 8, 2026 04:31 View session

Adam Poulemanos (bashandbone) merged commit a839768 into main Apr 8, 2026
6 of 7 checks passed

Adam Poulemanos (bashandbone) deleted the add-claude-github-actions-1775622589761 branch April 8, 2026 04:31

Copilot AI reviewed Apr 8, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Claude Code GitHub Workflow#1

Add Claude Code GitHub Workflow#1
Adam Poulemanos (bashandbone) merged 2 commits into
mainfrom
add-claude-github-actions-1775622589761

Adam Poulemanos (bashandbone) commented Apr 8, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Copilot AI Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: anthropics/claude-code-action@v1
	uses: anthropics/claude-code-action@<FULL_40_CHAR_COMMIT_SHA> # v1

Uh oh!

Conversation

Adam Poulemanos (bashandbone) commented Apr 8, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants