Library: the AI shelf is stocked without holding the request open, and the AI Atlas is finished #150
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| issues: | |
| types: [opened, assigned] | |
| pull_request_review: | |
| types: [submitted] | |
| # Serialise per issue/PR so a burst of mentions queues instead of running in | |
| # parallel. Deliberately NOT cancel-in-progress: a superseded @claude task is | |
| # still doing work someone asked for, unlike a stale PR review. | |
| concurrency: | |
| group: claude-mention-${{ github.event.issue.number || github.event.pull_request.number }} | |
| cancel-in-progress: false | |
| jobs: | |
| claude: | |
| # This repo is PUBLIC and has issues enabled. Unlike `pull_request` runs from | |
| # a fork, `issues` and `issue_comment` events execute in this repo's context | |
| # and therefore DO see repository secrets. Matching on the text "@claude" | |
| # alone let any GitHub user run this job with CLAUDE_CODE_OAUTH_TOKEN in the | |
| # environment — and since the action executes the instructions in the | |
| # comment that tagged it, no injection trick was even required. | |
| # | |
| # So gate on author_association as well. OWNER/MEMBER/COLLABORATOR are | |
| # people with org membership or explicit repo access. CONTRIBUTOR is NOT | |
| # enough: it only means a commit of theirs was merged once. | |
| # The association is checked per event against the person who actually | |
| # triggered it. Do NOT flatten this into one shared OR: on issue_comment the | |
| # payload carries BOTH comment.author_association (the commenter) and | |
| # issue.author_association (whoever opened the thread), so a shared OR would | |
| # let an untrusted account comment "@claude ..." on an issue opened by a | |
| # trusted one and pass the gate. | |
| if: | | |
| (github.event_name == 'issue_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || | |
| (github.event_name == 'pull_request_review_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || | |
| (github.event_name == 'pull_request_review' && | |
| contains(github.event.review.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) || | |
| (github.event_name == 'issues' && | |
| (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)) | |
| runs-on: ubuntu-latest | |
| # Without this a wedged run bills against the Max subscription for the full | |
| # 6h default. | |
| timeout-minutes: 15 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 1 | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read | |
| # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it. | |
| # prompt: 'Update the pull request description to include a summary of changes.' | |
| # Optional: Add claude_args to customize behavior and configuration | |
| # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md | |
| # or https://code.claude.com/docs/en/cli-reference for available options | |
| # claude_args: '--allowed-tools Bash(gh pr *)' | |