Add Claude Code GitHub Workflow#48
Conversation
|
✅ Code Quality
|
![datadog-datadog-prod-us1[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@beta |
There was a problem hiding this comment.
🔴 High: Code Vulnerability
Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)
Pin GitHub Actions by commit hash to ensure supply chain security.
Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
| @@ -0,0 +1,64 @@ | |||
| name: Claude Code | |||
There was a problem hiding this comment.
🔴 High: Code Vulnerability
No explicit permissions set for at the workflow level (...read more)
Default permissions for the GITHUB_TOKEN are expected to be restricted (contents:read, metadata:read, and packages:read).
Your repository may require a different setup, so consider defining permissions for each job following the least privilege principle to restrict the impact of a possible compromise.
You can find the list of all possible permissions in Workflow syntax for GitHub Actions - GitHub Docs. They can be defined at the job or the workflow level.
|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@beta |
There was a problem hiding this comment.
🔴 High: Code Vulnerability
Workflow depends on a GitHub actions pinned by tag instead of a hash. (...read more)
Pin GitHub Actions by commit hash to ensure supply chain security.
Using a branch (@main) or tag (@v1) allows for implicit updates, which can introduce unexpected or malicious changes. Instead, always pin actions to a full length commit SHA. You can find the commit SHA for the latest tag from the action’s repository and ensure frequent updates via auto-updaters such as dependabot. Include a comment with the corresponding full-length SemVer tag for clarity:
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
| types: [created] | ||
| pull_request_review_comment: | ||
| types: [created] | ||
| issues: |
There was a problem hiding this comment.
🔴 High: Code Vulnerability
Dangerous GitHub actions trigger (...read more)
Workflows triggered by the pull_request_target trigger can read secrets and edit code in the repository that the PR is targeting. This is a dangerous trigger that must be used with caution. For security reasons, GitHub runs these workflows using the code from the base branch, rather than the code from the PR.
If you use this trigger you must not checkout the code of the PR, otherwise anyone can simply write malicious code and get it to run in a context that has access to your secrets, in addition to write access to the repository.
This type of attack is sometimes referred to as “pwn request”.
Note that if you use the "workflow_call" trigger, your workflow is callable by other workflows, so possibly by a workflow using the pull_request_target trigger.
Learn More
| name: Claude Code | ||
|
|
||
| on: | ||
| issue_comment: |
There was a problem hiding this comment.
🔴 High: Code Vulnerability
Dangerous GitHub actions trigger (...read more)
Workflows triggered by the pull_request_target trigger can read secrets and edit code in the repository that the PR is targeting. This is a dangerous trigger that must be used with caution. For security reasons, GitHub runs these workflows using the code from the base branch, rather than the code from the PR.
If you use this trigger you must not checkout the code of the PR, otherwise anyone can simply write malicious code and get it to run in a context that has access to your secrets, in addition to write access to the repository.
This type of attack is sometimes referred to as “pwn request”.
Note that if you use the "workflow_call" trigger, your workflow is callable by other workflows, so possibly by a workflow using the pull_request_target trigger.
Learn More
| @@ -0,0 +1,78 @@ | |||
| name: Claude Code Review | |||
There was a problem hiding this comment.
🔴 High: Code Vulnerability
No explicit permissions set for at the workflow level (...read more)
Default permissions for the GITHUB_TOKEN are expected to be restricted (contents:read, metadata:read, and packages:read).
Your repository may require a different setup, so consider defining permissions for each job following the least privilege principle to restrict the impact of a possible compromise.
You can find the list of all possible permissions in Workflow syntax for GitHub Actions - GitHub Docs. They can be defined at the job or the workflow level.
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!