Skip to content

Add Claude Code GitHub Workflow #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aborruso merged 2 commits into from
Jan 24, 2026
Merged

Add Claude Code GitHub Workflow #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
69e467a
"Claude PR Assistant workflow"
aborruso Jan 24, 2026
a74b4f4
"Claude Code Review workflow"
aborruso Jan 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 44 additions & 0 deletions .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,44 @@
name: Claude Code Review

on:
pull_request:
types: [opened, synchronize, ready_for_review, reopened]
Comment on lines +4 to +5

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow runs on draft PRs, which may not be the desired behavior. The trigger includes 'opened', 'synchronize', and 'reopened' events without filtering out draft PRs, but also includes 'ready_for_review', suggesting draft PRs should be excluded.

Consider adding a condition to skip draft PRs:
if: github.event.pull_request.draft == false

This will prevent Claude from reviewing draft PRs that aren't ready for review, saving resources and avoiding premature feedback.

Copilot uses AI. Check for mistakes.
# Optional: Only run on specific file changes
# paths:
# - "src/**/*.ts"
# - "src/**/*.tsx"
# - "src/**/*.js"
# - "src/**/*.jsx"

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow lacks concurrency control, which could lead to multiple Claude Code Review instances running simultaneously on the same PR. This can cause race conditions, duplicate review comments, or wasted compute resources.

Consider adding a concurrency group to ensure only one code review workflow runs per PR at a time, for example:
concurrency:
group: claude-review-${{ github.event.pull_request.number }}
cancel-in-progress: true

This prevents multiple simultaneous code reviews on the same PR and saves resources by cancelling outdated reviews when new commits are pushed.

Suggested change
concurrency:
group: claude-review-${{ github.event.pull_request.number }}
cancel-in-progress: true

Copilot uses AI. Check for mistakes.
jobs:
claude-review:

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job name 'claude-review' is inconsistent with the workflow naming pattern. The other workflow uses job name 'claude' for a workflow named 'Claude Code'. For consistency, consider:

  • Using 'claude-code-review' (matches the workflow file name)
  • Or using 'review' (shorter, matches the pattern if 'claude' is used in the other workflow)

Consistent naming improves maintainability and makes logs easier to read.

Suggested change
claude-review:
claude-code-review:

Copilot uses AI. Check for mistakes.
# Optional: Filter by PR author
# if: |
# github.event.pull_request.user.login == 'external-contributor' ||
# github.event.pull_request.user.login == 'new-developer' ||
# github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow lacks timeout protection, which could lead to excessive resource consumption if the code review process gets stuck. GitHub Actions has a default maximum timeout of 6 hours for jobs, but it's better to set an explicit, reasonable timeout based on expected execution time.

Consider adding a timeout at the job level, for example:
timeout-minutes: 30

This ensures the workflow doesn't run indefinitely if something goes wrong during the code review.

Suggested change
timeout-minutes: 30

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is missing write permissions that Claude Code Review may need to post its review comments. The code review tool needs to create PR comments to share its findings. However, the current permissions only grant 'read' access to contents, pull-requests, and issues.

To enable Claude to post review comments, consider adding:

  • pull-requests: write (for creating PR review comments)

Without write permission to pull requests, Claude will not be able to post its code review feedback.

Suggested change
pull-requests: read
pull-requests: write

Copilot uses AI. Check for mistakes.
issues: read
id-token: write

steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 1

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The shallow checkout with 'fetch-depth: 1' may be insufficient for Claude Code Review to properly analyze the PR. Code review typically requires seeing:

  • The base branch to compare against
  • Multiple commits in the PR
  • Context from recent history

Consider using 'fetch-depth: 0' to fetch full history, or at minimum use GitHub's PR checkout pattern:
ref: ${{ github.event.pull_request.head.sha }}

With a deeper fetch depth. Verify with the claude-code-action documentation what depth is recommended for code reviews.

Suggested change
fetch-depth: 1
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}

Copilot uses AI. Check for mistakes.

- name: Run Claude Code Review
id: claude-review
uses: anthropics/claude-code-action@v1

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow references the claude-code-action with a potentially unpinned version '@v1'. Using a major version tag means the workflow will automatically use the latest v1.x.x version, which could introduce breaking changes or unexpected behavior without notice.

For better security and reproducibility, consider:

  1. Pinning to a specific release (e.g., 'anthropics/claude-code-action@v1.0.0')
  2. Or using a commit SHA for maximum stability (e.g., 'anthropics/claude-code-action@abc123...')

This is especially important for workflows that can modify repository content and consume paid API credits. Verify the action's versioning strategy and choose an appropriate pinning approach.

Suggested change
uses: anthropics/claude-code-action@v1
uses: anthropics/claude-code-action@v1.0.0

Copilot uses AI. Check for mistakes.
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options

50 changes: 50 additions & 0 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Claude Code

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened, assigned]
pull_request_review:
types: [submitted]

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow lacks concurrency control, which could lead to multiple Claude instances running simultaneously on the same PR. This can cause race conditions, duplicate comments, or conflicting actions.

Consider adding a concurrency group to ensure only one Claude workflow runs per PR at a time, for example:
concurrency:
group: claude-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: true

This prevents multiple simultaneous executions on the same PR/issue.

Suggested change
concurrency:
group: claude-${{ github.event.pull_request.number || github.event.issue.number }}
cancel-in-progress: true

Copilot uses AI. Check for mistakes.
jobs:
claude:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
Comment on lines +16 to +19

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There's a security concern: the PR description states "Only users with write access to the repository can trigger the workflow," but this is not enforced in the workflow configuration. The workflow triggers on 'issue_comment' and 'pull_request_review_comment' events without checking if the comment author has write access to the repository.

This means any user (including external contributors without write access) can trigger the workflow by mentioning @claude in a comment, potentially leading to:

  • Unauthorized use of the Anthropic API (consuming credits)
  • Spam or abuse of the Claude service
  • Denial of service by repeatedly triggering the workflow

Consider adding a permission check in the job condition:
if: |
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'COLLABORATOR'

Note: This check would need to be adapted for each event type (issue_comment, pull_request_review_comment, etc.) since they have different data structures.

Suggested change
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
(
github.event_name == 'issue_comment' &&
contains(github.event.comment.body, '@claude') &&
(
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'COLLABORATOR'
)
) ||
(
github.event_name == 'pull_request_review_comment' &&
contains(github.event.comment.body, '@claude') &&
(
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'COLLABORATOR'
)
) ||
(
github.event_name == 'pull_request_review' &&
contains(github.event.review.body, '@claude') &&
(
github.event.review.author_association == 'OWNER' ||
github.event.review.author_association == 'MEMBER' ||
github.event.review.author_association == 'COLLABORATOR'
)
) ||
(
github.event_name == 'issues' &&
(
contains(github.event.issue.body, '@claude') ||
contains(github.event.issue.title, '@claude')
) &&
(
github.event.issue.author_association == 'OWNER' ||
github.event.issue.author_association == 'MEMBER' ||
github.event.issue.author_association == 'COLLABORATOR'
)
)

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow lacks timeout protection, which could lead to excessive resource consumption if Claude gets stuck. GitHub Actions has a default maximum timeout of 6 hours for jobs, but it's better to set an explicit, reasonable timeout based on expected execution time.

Consider adding a timeout at the job level, for example:
timeout-minutes: 30

This ensures the workflow doesn't run indefinitely if something goes wrong.

Suggested change
runs-on: ubuntu-latest
runs-on: ubuntu-latest
timeout-minutes: 30

Copilot uses AI. Check for mistakes.
permissions:
contents: read
pull-requests: read
issues: read
Comment on lines +22 to +24

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is missing write permissions that Claude Code may need to function properly. According to the PR description, Claude's default tools include "reading/writing files and interacting with our repo by creating comments, branches, and commits." However, the current permissions only grant 'read' access to contents, pull-requests, and issues.

To enable Claude to create comments, branches, and commits, consider adding:

  • contents: write (for creating branches and commits)
  • pull-requests: write (for creating PR comments)
  • issues: write (for creating issue comments)

Without these write permissions, Claude will not be able to perform its intended actions beyond reading the repository.

Suggested change
contents: read
pull-requests: read
issues: read
contents: write
pull-requests: write
issues: write

Copilot uses AI. Check for mistakes.
id-token: write
actions: read # Required for Claude to read CI results on PRs
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 1

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The shallow checkout with 'fetch-depth: 1' may be insufficient for Claude to properly understand the PR context. When Claude analyzes code changes, it may need access to more commit history to:

  • Understand the evolution of the code
  • Compare changes across multiple commits
  • See the full context of modifications

Consider either:

  1. Using 'fetch-depth: 0' to fetch full history (better context, slower checkout)
  2. Using a deeper fetch like 'fetch-depth: 10' (balanced approach)
  3. Or explicitly setting 'fetch-depth: 2' for PRs if only the immediate change needs review

The optimal value depends on how Claude Code uses the git history. Verify with the claude-code-action documentation what depth is recommended.

Suggested change
fetch-depth: 1
fetch-depth: 0

Copilot uses AI. Check for mistakes.

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@v1

Copilot AI Jan 24, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow references the claude-code-action with a potentially unpinned version '@v1'. Using a major version tag means the workflow will automatically use the latest v1.x.x version, which could introduce breaking changes or unexpected behavior without notice.

For better security and reproducibility, consider:

  1. Pinning to a specific release (e.g., 'anthropics/claude-code-action@v1.0.0')
  2. Or using a commit SHA for maximum stability (e.g., 'anthropics/claude-code-action@abc123...')

This is especially important for workflows that can modify repository content and consume paid API credits. Verify the action's versioning strategy and choose an appropriate pinning approach.

Suggested change
uses: anthropics/claude-code-action@v1
uses: anthropics/claude-code-action@v1.0.0

Copilot uses AI. Check for mistakes.
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

# This is an optional setting that allows Claude to read CI results on PRs
additional_permissions: |
actions: read

# Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
# prompt: 'Update the pull request description to include a summary of changes.'

# Optional: Add claude_args to customize behavior and configuration
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options
# claude_args: '--allowed-tools Bash(gh pr:*)'

Loading