Add Claude Code GitHub Workflow#56
Open
jbearak wants to merge 2 commits into
Open
Conversation
📝 WalkthroughWalkthroughTwo new GitHub Actions workflows are added to enable automated code review and Claude Code integration. The Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Fix all issues with AI agents
In @.github/workflows/claude-code-review.yml:
- Around line 13-41: The claude-review job currently runs for forked PRs which
lack secrets and will fail; add a fork guard to the job (the job with id/name
"claude-review") so it only runs when the PR originates from the same
repository. Modify the job-level condition (the job that contains the "Run
Claude Code Review" step and uses anthropics/claude-code-action@v1) to include
an if expression that checks the PR head repo equals the base repo (e.g.,
compare github.event.pull_request.head.repo.full_name to github.repository or
similar) so the job is skipped for forked PRs.
- Around line 22-41: Update the GitHub Actions permissions block so the claude
review action can post comments: change the permissions keys "contents",
"pull-requests", and "issues" from read to write in the permissions mapping,
keeping "id-token: write" as-is; ensure this change is applied before the
"steps" block and that the "Run Claude Code Review" step (id: claude-review,
uses: anthropics/claude-code-action@v1) now runs with the elevated permissions.
In @.github/workflows/claude.yml:
- Around line 13-41: The job "claude" if-condition is too permissive; tighten it
by adding author-association and bot-exclusion checks for each event branch so
only trusted human contributors can trigger runs. Update the existing multi-line
if to require e.g. github.event.comment.author_association in
('OWNER','MEMBER','COLLABORATOR') (or similar trusted values) and
github.event.comment.user.type != 'Bot' for comment-based branches, and the
analogous github.event.review.author_association / github.event.review.user.type
checks for pull_request_review and pull_request_review_comment branches, plus
github.event.issue.author_association and github.event.issue.user.type for
issues; keep the existing contains(..., '@claude') checks but combine them with
these new gates in the job "claude" if expression.
Comment on lines
+13
to
+41
| jobs: | ||
| claude-review: | ||
| # Optional: Filter by PR author | ||
| # if: | | ||
| # github.event.pull_request.user.login == 'external-contributor' || | ||
| # github.event.pull_request.user.login == 'new-developer' || | ||
| # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' | ||
|
|
||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
Skip runs on forked PRs to avoid failed checks.
pull_request workflows from forks won’t get secrets, so this job will fail (and can block external contributors if the check is required). Add a fork guard to skip the job for forked PRs.
🔧 Suggested guard
jobs:
claude-review:
+ if: github.event.pull_request.head.repo.full_name == github.repository📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| jobs: | |
| claude-review: | |
| # Optional: Filter by PR author | |
| # if: | | |
| # github.event.pull_request.user.login == 'external-contributor' || | |
| # github.event.pull_request.user.login == 'new-developer' || | |
| # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | |
| plugins: 'code-review@claude-code-plugins' | |
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' | |
| jobs: | |
| claude-review: | |
| if: github.event.pull_request.head.repo.full_name == github.repository | |
| # Optional: Filter by PR author | |
| # if: | | |
| # github.event.pull_request.user.login == 'external-contributor' || | |
| # github.event.pull_request.user.login == 'new-developer' || | |
| # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | |
| plugins: 'code-review@claude-code-plugins' | |
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
🤖 Prompt for AI Agents
In @.github/workflows/claude-code-review.yml around lines 13 - 41, The
claude-review job currently runs for forked PRs which lack secrets and will
fail; add a fork guard to the job (the job with id/name "claude-review") so it
only runs when the PR originates from the same repository. Modify the job-level
condition (the job that contains the "Run Claude Code Review" step and uses
anthropics/claude-code-action@v1) to include an if expression that checks the PR
head repo equals the base repo (e.g., compare
github.event.pull_request.head.repo.full_name to github.repository or similar)
so the job is skipped for forked PRs.
Comment on lines
+22
to
+41
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
anthropics claude-code-action GitHub permissions requirements
💡 Result:
For anthropics/claude-code-action, the GitHub permissions requirements depend on whether you’re configuring a GitHub App (recommended) and/or what your workflow permissions: are.
1) If you create a custom GitHub App (or are validating what it needs)
Set these Repository permissions to Read & Write: Contents, Issues, Pull requests. [1]
2) In your GitHub Actions workflow (permissions: block)
At minimum, grant: contents: write, pull-requests: write, issues: write. [1]
If you use AWS Bedrock or Google Vertex AI via GitHub OIDC, also grant: id-token: write. [1]
Sources:
[1] Anthropic Claude Code docs — “Claude Code GitHub Actions” (permissions + example workflow permissions block).
🌐 Web query:
claude-code-action v1 required GitHub token scopes
💡 Result:
For anthropics/claude-code-action@v1, the GitHub token it uses (whether that’s the workflow’s GITHUB_TOKEN or a GitHub App installation token you pass via github_token) needs permissions equivalent to:
- Contents: read & write (modify files / push commits) (docs.anthropic.com)
- Issues: read & write (read/respond to issues & comments) (docs.anthropic.com)
- Pull requests: read & write (read/respond to PRs, create/update PRs) (docs.anthropic.com)
Additionally, if you’re authenticating to a cloud provider via GitHub OIDC (e.g., Bedrock/Vertex setups), your workflow permissions also need:
id-token: write(github.com)
Citations:
- 1: https://docs.anthropic.com/en/docs/claude-code/github-actions?utm_source=openai
- 2: https://docs.anthropic.com/en/docs/claude-code/github-actions?utm_source=openai
- 3: https://docs.anthropic.com/en/docs/claude-code/github-actions?utm_source=openai
- 4: Generated workflows missing id-token:write permission and trigger on bot's own comments anthropics/claude-code-action#625
Update GitHub token permissions — action requires write access to post review comments.
The anthropics/claude-code-action@v1 action requires write permissions to function. Per Anthropic's documentation, the workflow needs:
contents: write(not just read)pull-requests: write(not just read)issues: write(not just read)
🔧 Required permissions update
permissions:
- contents: read
- pull-requests: read
- issues: read
+ contents: write
+ pull-requests: write
+ issues: write
id-token: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | |
| plugins: 'code-review@claude-code-plugins' | |
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code Review | |
| id: claude-review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | |
| plugins: 'code-review@claude-code-plugins' | |
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
🤖 Prompt for AI Agents
In @.github/workflows/claude-code-review.yml around lines 22 - 41, Update the
GitHub Actions permissions block so the claude review action can post comments:
change the permissions keys "contents", "pull-requests", and "issues" from read
to write in the permissions mapping, keeping "id-token: write" as-is; ensure
this change is applied before the "steps" block and that the "Run Claude Code
Review" step (id: claude-review, uses: anthropics/claude-code-action@v1) now
runs with the elevated permissions.
Comment on lines
+13
to
+41
| jobs: | ||
| claude: | ||
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
|
|
||
| # This is an optional setting that allows Claude to read CI results on PRs | ||
| additional_permissions: | | ||
| actions: read |
There was a problem hiding this comment.
Lock down @claude triggers to trusted users and ignore bots.
As written, anyone who can comment can trigger a run that uses secrets. That’s a significant security and cost risk for public repos, and it also risks bot self-trigger loops. Add an author-association gate (and exclude bot senders).
🔒 Suggested authorization gate
jobs:
claude:
- if: |
- (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
- (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
- (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
- (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+ if: |
+ (
+ (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+ (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+ (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+ (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+ ) && (
+ github.event.sender.type != 'Bot' &&
+ contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
+ github.event.comment.author_association ||
+ github.event.review.author_association ||
+ github.event.issue.author_association
+ )
+ )📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| jobs: | |
| claude: | |
| if: | | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read | |
| jobs: | |
| claude: | |
| if: | | |
| ( | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| ) && ( | |
| github.event.sender.type != 'Bot' && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), | |
| github.event.comment.author_association || | |
| github.event.review.author_association || | |
| github.event.issue.author_association | |
| ) | |
| ) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read |
🤖 Prompt for AI Agents
In @.github/workflows/claude.yml around lines 13 - 41, The job "claude"
if-condition is too permissive; tighten it by adding author-association and
bot-exclusion checks for each event branch so only trusted human contributors
can trigger runs. Update the existing multi-line if to require e.g.
github.event.comment.author_association in ('OWNER','MEMBER','COLLABORATOR') (or
similar trusted values) and github.event.comment.user.type != 'Bot' for
comment-based branches, and the analogous github.event.review.author_association
/ github.event.review.user.type checks for pull_request_review and
pull_request_review_comment branches, plus github.event.issue.author_association
and github.event.issue.user.type for issues; keep the existing contains(...,
'@claude') checks but combine them with these new gates in the job "claude" if
expression.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit