Add Claude Code GitHub Workflow#1
Conversation
|
Caution Review failedThe pull request is closed. Summary by CodeRabbitRelease Notes
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughTwo new GitHub Actions workflows are introduced to integrate Claude AI capabilities. The first triggers on pull requests for automated code reviews, while the second triggers on issue and PR events when explicitly invoked via "@claude" mentions. Both workflows configure necessary permissions and GitHub CLI tools to enable Claude to interact with the repository and provide feedback. Changes
Sequence Diagram(s)sequenceDiagram
actor GitHub as GitHub Platform
participant Actions as GitHub Actions Runner
participant Checkout as Repository Checkout
participant Claude as Claude Code Review Action
participant API as Claude API
participant Output as PR Comment
Note over GitHub,Output: Claude Code Review Workflow (PR Events)
GitHub->>Actions: Pull request event (opened/synchronize)
Actions->>Checkout: Checkout repository
Checkout-->>Actions: Repository ready
Actions->>Claude: Invoke Claude Code Review<br/>(with OAuth token & prompt)
Claude->>API: Request code review<br/>(quality, bugs, performance, security)
API-->>Claude: Review feedback
Claude->>Output: Post review comment<br/>(via gh pr comment)
Output-->>GitHub: Comment visible on PR
Note over GitHub,Output: Claude Code Workflow (On-Demand)
GitHub->>Actions: Issue/PR event with `@claude` mention
activate Actions
rect rgb(200, 220, 240)
Actions->>Actions: Check comment/title for `@claude`
end
Actions->>Checkout: Checkout repository
Checkout-->>Actions: Repository ready
Actions->>Claude: Invoke Claude Code Action<br/>(with OAuth token)
Claude->>API: Process code
API-->>Claude: Processing result
Claude->>Output: Return feedback
deactivate Actions
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes 📜 Recent review detailsConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro 📒 Files selected for processing (2)
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d293398d39
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The claude-code-review job limits the GITHUB_TOKEN to read-only (contents, pull-requests, issues all set to read), but the workflow then asks the action to leave a PR review via gh pr comment. GitHub requires pull-requests: write (and usually issues: write) to create PR comments, so the action will fail when attempting to publish feedback and the workflow produces no review output. Grant write permission so the bot can post its results.
Useful? React with 👍 / 👎.
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs |
There was a problem hiding this comment.
In the general claude workflow the job’s permissions are restricted to read-only scopes, but the anthropics action needs to write issue/PR comments to respond to @claude mentions. Without issues: write and pull-requests: write, any attempt to post a reply will be denied with a 403, leaving the workflow unable to deliver the requested assistance. Broaden the permissions so responses can be posted.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
This PR adds GitHub Actions workflows to integrate Claude Code, an AI coding agent, into the repository. The integration enables automated code reviews on pull requests and allows team members to invoke Claude by mentioning @claude in PR or issue comments.
- Adds workflow triggered by @claude mentions in comments for on-demand assistance
- Adds automatic code review workflow that runs when PRs are opened or updated
- Configures permissions and authentication using GitHub Actions secrets
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
.github/workflows/claude.yml |
Main workflow that triggers when @claude is mentioned in PR/issue comments or when issues are opened/assigned |
.github/workflows/claude-code-review.yml |
Automated code review workflow that runs on PR open and synchronize events |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
The workflow uses 'claude_code_oauth_token' but the PR description mentions "Anthropic API key" being stored as a secret. The parameter name should match the actual secret being used. If the secret is named 'CLAUDE_CODE_OAUTH_TOKEN', verify this is the correct authentication method. If using an Anthropic API key instead, the parameter should likely be 'anthropic_api_key' and the secret name should match.
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} |
| # This is an optional setting that allows Claude to read CI results on PRs | ||
| additional_permissions: | | ||
| actions: read | ||
|
|
There was a problem hiding this comment.
The 'additional_permissions' configuration for 'actions: read' is redundant since it's already specified in the permissions block at lines 21-26. This duplication may cause confusion about which permissions are actually granted.
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read |
| # Optional: Add claude_args to customize behavior and configuration | ||
| # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md | ||
| # or https://code.claude.com/docs/en/cli-reference for available options | ||
| # claude_args: '--allowed-tools Bash(gh pr:*)' |
There was a problem hiding this comment.
The allowed tools configuration uses wildcard patterns like 'gh pr:' in the example comment on line 49, but the actual implementation on line 56 uses more specific patterns like 'gh pr comment:'. This inconsistency in examples may cause confusion. Consider aligning the example with the specific pattern approach used in the code review workflow, or clarifying why different approaches are used.
| # claude_args: '--allowed-tools Bash(gh pr:*)' | |
| # claude_args: '--allowed-tools Bash(gh pr comment:*)' |
| contents: read | ||
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The permissions configuration is missing write access to pull-requests and issues, which is likely needed for Claude to post comments and create commits/branches as described in the PR description. Without write permissions, Claude won't be able to interact with the repository as intended.
| contents: read | |
| pull-requests: read | |
| issues: read | |
| contents: write | |
| pull-requests: write | |
| issues: write |
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The permissions configuration is missing write access to pull-requests and issues. According to the workflow's purpose (code review with feedback), Claude needs write permissions to post review comments on the PR. Additionally, the contents: write permission may be needed if Claude is expected to create branches or commits.
| pull-requests: read | |
| issues: read | |
| pull-requests: write | |
| issues: write |
| id: claude | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
The workflow uses 'claude_code_oauth_token' but the PR description mentions "Anthropic API key" being stored as a secret. The parameter name should match the actual secret being used. If the secret is named 'CLAUDE_CODE_OAUTH_TOKEN', verify this is the correct authentication method. If using an Anthropic API key instead, the parameter should likely be 'anthropic_api_key' and the secret name should match.
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} |
Code Review - Claude Code GitHub Workflow IntegrationThank you for setting up the Claude Code integration! This is a well-structured addition to enable AI-assisted development. Here's my detailed review: ✅ Strengths
🔒 Security ConcernsCRITICAL: Workflow Runs on All PRs (including from forks)File: on:
pull_request:
types: [opened, synchronize]Issue: This workflow triggers on all PRs, including those from untrusted external contributors. While GitHub Actions secrets aren't exposed to fork PRs by default, this creates several risks:
Recommended Fix: Add a filter to only run on PRs from trusted collaborators: jobs:
claude-review:
# Only run for organization members or specific collaborators
if: |
github.event.pull_request.head.repo.full_name == github.repository ||
github.event.pull_request.author_association == 'MEMBER' ||
github.event.pull_request.author_association == 'COLLABORATOR' ||
github.event.pull_request.author_association == 'OWNER'
runs-on: ubuntu-latest
# ... rest of workflowAlternatively, require manual approval for external PRs: on:
pull_request_target: # Runs in the context of the base repo
types: [labeled]
jobs:
claude-review:
if: contains(github.event.pull_request.labels.*.name, 'safe-to-review')
# ... rest of workflowMissing Rate LimitingConsideration: The workflow has no rate limiting or concurrency controls. Multiple PRs or rapid updates could exhaust API quota. Recommended Addition: concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
cancel-in-progress: true # Cancel outdated reviews when PR is updated
|
* "Claude PR Assistant workflow" * "Claude Code Review workflow"
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!