Add Claude Code GitHub Workflow #515
Conversation
Code Review - PR #515: Add Claude Code GitHub WorkflowThank you for this contribution! I've reviewed the PR and have the following feedback: ✅ Positives
📋 Code Quality & Best Practicesclaude-code-review.yml:
claude.yml:
🐛 Potential Issues
🔒 Security Concerns
⚡ Performance Considerations
🧪 Test CoverageMissing test validation:
📝 Suggestions for Improvement
🎯 VerdictThis is a solid implementation that follows GitHub Actions best practices. The main improvements would be around explicit security boundaries and workflow timeouts. The code is production-ready with minor enhancements recommended above. Recommendation: ✅ Approve with optional improvements Review generated by Claude Code |
There was a problem hiding this comment.
Pull request overview
This PR adds two GitHub Actions workflows to enable Claude Code AI integration in the repository. The first workflow (claude.yml) allows users to mention @claude in PR or issue comments to trigger Claude actions. The second workflow (claude-code-review.yml) automatically runs Claude code reviews on all opened or synchronized pull requests.
Key Changes:
- Added interactive Claude Code workflow triggered by @claude mentions in comments
- Added automatic Claude Code Review workflow that runs on every PR
- Both workflows use the
anthropics/claude-code-action@v1action with OAuth token authentication
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.
| File | Description |
|---|---|
| .github/workflows/claude.yml | Main workflow for interactive Claude mentions in comments, includes triggers for issue comments, PR review comments, and issue events |
| .github/workflows/claude-code-review.yml | Automatic code review workflow that runs on PR open/sync events, configured with specific gh CLI tool permissions and review prompts |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| id: claude | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
The PR description mentions that "Our Anthropic API key is securely stored" but the workflow uses 'claude_code_oauth_token' not an API key. This is a minor terminology inconsistency - the description should refer to "OAuth token" rather than "API key" to match the actual secret name being used.
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} # Our Anthropic OAuth token is securely stored |
| claude-review: | ||
| # Optional: Filter by PR author | ||
| # if: | | ||
| # github.event.pull_request.user.login == 'external-contributor' || | ||
| # github.event.pull_request.user.login == 'new-developer' || | ||
| # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' |
There was a problem hiding this comment.
The workflow will run automatically on every PR opened or updated, which could consume API quota quickly and add costs. Consider uncommenting and configuring the filters on lines 16-19 to limit when automatic reviews run (e.g., only for first-time contributors or specific authors), or add path filters on lines 6-11 to only review specific file types.
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| prompt: | | ||
| REPO: ${{ github.repository }} | ||
| PR NUMBER: ${{ github.event.pull_request.number }} | ||
| Please review this pull request and provide feedback on: | ||
| - Code quality and best practices | ||
| - Potential bugs or issues | ||
| - Performance considerations | ||
| - Security concerns | ||
| - Test coverage | ||
| Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. | ||
| Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR. | ||
| # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md | ||
| # or https://code.claude.com/docs/en/cli-reference for available options | ||
| claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"' |
There was a problem hiding this comment.
The workflow requires GITHUB_TOKEN to be passed to the gh CLI for commands like 'gh pr comment' to work. The claude_args specify Bash tools using gh commands, but there's no environment variable or configuration passing GITHUB_TOKEN to the Claude action. Add 'GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}' to the environment configuration for the action step.
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
The workflow has read-only permissions for contents but the PR description states that Claude can create branches and commits. To enable Claude to make changes to the repository (create branches, commits), the 'contents' permission should be set to 'write' instead of 'read'.
| contents: read | |
| contents: write |
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read |
There was a problem hiding this comment.
The workflow should include 'pull-requests: write' permission to allow Claude to comment on the PR with its review. Currently it only has 'read' permission which would prevent Claude from posting review comments.
| pull-requests: read | |
| pull-requests: write |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
The workflow lacks a permission check to restrict execution to users with write access. The PR description states "Only users with write access to the repository can trigger the workflow" but there's no condition in the workflow to enforce this. Consider adding a condition to check github.event.comment.author_association or github.actor permissions to prevent unauthorized users from triggering Claude actions.
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| ( | |
| github.event_name == 'issue_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| (github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR') | |
| ) || | |
| ( | |
| github.event_name == 'pull_request_review_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| (github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR') | |
| ) || | |
| ( | |
| github.event_name == 'pull_request_review' && | |
| contains(github.event.review.body, '@claude') && | |
| (github.event.review.user.author_association == 'OWNER' || | |
| github.event.review.user.author_association == 'MEMBER' || | |
| github.event.review.user.author_association == 'COLLABORATOR') | |
| ) || | |
| ( | |
| github.event_name == 'issues' && | |
| (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && | |
| (github.event.issue.user.author_association == 'OWNER' || | |
| github.event.issue.user.author_association == 'MEMBER' || | |
| github.event.issue.user.author_association == 'COLLABORATOR') | |
| ) |
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 |
There was a problem hiding this comment.
The fetch-depth is set to 1 which only fetches the latest commit. For a code review workflow that needs to analyze PR diffs and changes, consider setting fetch-depth to 0 or at least 2 to ensure Claude has access to the base branch and PR changes for meaningful comparison.
| fetch-depth: 1 | |
| fetch-depth: 0 |
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read |
There was a problem hiding this comment.
The workflow should include 'pull-requests: write' permission to allow Claude to comment on pull requests. Currently it only has 'read' permission which would prevent Claude from creating comments or interacting with PRs as intended.
| pull-requests: read | |
| pull-requests: write |
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The workflow needs 'issues: write' permission to allow Claude to comment on issues. Currently it only has 'read' permission which would prevent Claude from creating comments on issues as intended.
| issues: read | |
| issues: write |
| - Security concerns | ||
| - Test coverage | ||
| Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. |
There was a problem hiding this comment.
The prompt references "the repository's CLAUDE.md" for guidance on style and conventions, but this file does not exist in the repository. Either create this file or update the prompt to reference existing documentation like readme.md.
| Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. | |
| Use the repository's readme.md for guidance on style and conventions. Be constructive and helpful in your feedback. |
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!