Add Claude Code GitHub Workflow

[petroslamb]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[sourcery-ai]

Hi @petroslamb! 👋

Your private repo does not have access to Sourcery.

Please upgrade to continue using Sourcery ✨

[claude]

Claude finished @petroslamb's task —— View job

---

PR Review: Claude Code GitHub Workflows

Todo List:

• Read and analyze workflow files
• Review code quality and best practices
• Check for security concerns
• Assess performance considerations
• Provide comprehensive feedback

Code Review Feedback

I've reviewed both GitHub Actions workflow files, and they look well-structured overall. Here's my detailed feedback:

✅ Strengths

1. Security Best Practices (.github/workflows/claude-code-review.yml:22-26, .github/workflows/claude.yml:21-26):

   • Proper minimal permissions with contents: read, pull-requests: read, issues: read
   • Uses id-token: write for secure authentication
   • Secrets are properly referenced via ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

2. Code Quality (Both files):

   • Clean, readable YAML structure
   • Good use of comments explaining optional configurations
   • Proper action versioning (actions/checkout@v4, anthropics/claude-code-action@beta)

3. Configuration Flexibility (Both files):

   • Extensive optional configurations provided as comments
   • Good examples of customization patterns

⚠️ Areas for Improvement

1. Checkout Depth (.github/workflows/claude-code-review.yml:32, .github/workflows/claude.yml:31):

   fetch-depth: 1

   Issue: Shallow checkout might limit Claude's ability to analyze code context and history.
   Recommendation: Consider using fetch-depth: 0 or at least fetch-depth: 2 for better context, especially for code reviews.

2. Missing Branch Strategy (.github/workflows/claude.yml):
   Issue: No explicit branch restrictions - workflow will run on all branches.
   Recommendation: Consider adding branch filters for production use:

   on:
     issue_comment:
       types: [created]
     # Add branch filter if needed
     pull_request_review_comment:
       types: [created]

3. Potential Resource Usage (Both files):
   Issue: No timeout or resource limits specified.
   Recommendation: Add job timeout to prevent runaway executions:

   jobs:
     claude:
       timeout-minutes: 30  # Adjust as needed

🔒 Security Assessment

EXCELLENT - The workflows follow security best practices:

• Minimal required permissions
• Proper secret handling
• No hardcoded sensitive values
• Uses official actions from trusted sources

🚀 Performance Considerations

1. Trigger Efficiency (.github/workflows/claude.yml:15-19):

   • Good use of conditional logic to prevent unnecessary runs
   • Efficient trigger pattern matching

2. Potential Optimization:

   • Consider using ubuntu-latest-small runner if available for cost optimization
   • The fetch-depth: 1 helps with checkout performance but may limit functionality

📋 Test Coverage

Note: These are workflow files, so traditional test coverage doesn't apply. However:

• The conditional logic in .github/workflows/claude.yml:15-19 covers all expected trigger scenarios
• Good coverage of optional configuration patterns in comments

💡 Additional Recommendations

1. Documentation: Consider adding a brief comment at the top of each file explaining its purpose
2. Error Handling: Consider adding failure notifications or retry logic for critical workflows
3. Monitoring: You might want to add workflow status badges to your README

🎯 Project-Specific Considerations

Based on your CNO project (blockchain platform with FastAPI backend):

1. Custom Tools: You might want to uncomment and configure allowed_tools to include project-specific commands:

   allowed_tools: "Bash(python -m pytest),Bash(black app/),Bash(flake8 app/),Bash(mypy app/)"

2. Custom Instructions: Consider adding blockchain-specific guidance:

   custom_instructions: |
     Follow Sui Move best practices for smart contracts
     Ensure all API changes maintain backwards compatibility
     Verify security implications for blockchain interactions

Overall Assessment: APPROVED ✅

This is a solid implementation that follows GitHub Actions and security best practices. The workflows are well-configured and ready for production use with minor improvements suggested above.