ci: add claude code github action #198
Conversation
froggy1014
requested review from
SEMIN-97,
bae-sh,
developerjhp,
heeji289,
hy57in,
jiji-hoon96,
noahluftyang,
synuns and
yeojini
as code owners
|
Walkthrough두 개의 GitHub Actions 워크플로우가 추가되었다. 하나는 PR 오픈/동기화 시 자동 코드 리뷰를 수행하고, 다른 하나는 댓글·리뷰·이슈에서 특정 트리거 문구(@claude) 감지 시 작업을 실행한다. 두 워크플로우 모두 저장소 체크아웃 후 claude-code-action을 호출하며 시크릿 토큰과 선택적 설정을 지원한다. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
actor Dev as Developer
participant GH as GitHub
participant WF as Workflow: claude-code-review.yml
participant Act as claude-code-action
Note over GH,WF: PR opened / synchronize
Dev->>GH: Open or update PR
GH-->>WF: Trigger job (permissions set)
WF->>WF: actions/checkout (fetch-depth: 1)
WF->>Act: Run with CLAUDE_CODE_OAUTH_TOKEN<br/>model + direct_prompt
Act-->>WF: Analysis results (review comments)
WF-->>GH: Post review output
sequenceDiagram
autonumber
actor User as User
participant GH as GitHub
participant WF as Workflow: claude.yml
participant Act as claude-code-action
rect rgba(200,235,255,0.25)
Note over GH,WF: Event: issue_comment / PR review comment / issues / PR review
end
User->>GH: Create comment/review/issue (@claude)
GH-->>WF: Conditional trigger (contains @claude)
WF->>WF: actions/checkout (fetch-depth: 1)
WF->>Act: Run with token + actions:read
Note over Act: Optional tools/env/instructions
Act-->>WF: Response (analysis or reply)
WF-->>GH: Post comment/reply
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Tip 🔌 Remote MCP (Model Context Protocol) integration is now available!Pro plan users can now connect to remote MCP servers from the Integrations page. Connect with popular remote MCPs such as Notion and Linear to add more context to your reviews and chats. ✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
✅ Deploy Preview for side-design-system ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (10)
.github/workflows/claude-code-review.yml (5)
5-5: PR 재오픈 이벤트도 커버하세요.
pull_request.types에reopened를 추가하면 재오픈된 PR도 자동 리뷰됩니다.- types: [opened, synchronize] + types: [opened, synchronize, reopened]
13-21: 중복 실행 방지: 동시성(concurrency) 그룹 추가 제안.푸시가 빠르게 연속 발생하면 이전 실행을 취소하도록 워크플로 수준
concurrency를 권장합니다.name: Claude Code Review on: pull_request: types: [opened, synchronize, reopened] + +concurrency: + group: claude-review-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true
55-55: 코멘트 스팸 방지: sticky comment 활성화를 고려하세요.PR에 추가 커밋이 올라와도 같은 코멘트를 업데이트해 노이즈를 줄일 수 있습니다.
- # use_sticky_comment: true + use_sticky_comment: true
3-12: 포크 PR에서 시크릿 접근 불가 이슈 안내.
pull_request이벤트는 포크에서 생성된 PR에 대해 리포지토리 시크릿(CLAUDE_CODE_OAUTH_TOKEN)을 노출하지 않습니다. 포크 PR 자동 리뷰가 필요하다면 아래 중 하나를 검토하세요.
pull_request_target로 전환 + 엄격한 경로/권한 제한(보안 주의 필수)- 유지보수자 트리거(댓글 명령) 기반 실행으로 한정
- 수동
workflow_dispatch사용필요한 운영 모델(포크 PR 자동/수동)에 따라 구성 변경이 필요하면 알려 주세요. 안전한 템플릿을 제안해 드리겠습니다.
40-42: YAML 스타일: 후행 공백/불필요 공백 줄 제거.정적 분석이 후행 공백과 잉여 빈 줄을 지적했습니다. CI 안정성을 위해 정리해 주세요.
영향 라인: 20, 27, 51, 56, 64, 67, 70, 73, 78 (후행 공백), 마지막 빈 줄(79).
팁:
pre-commit에trailing-whitespace훅 또는yamlfmt/yamllint를 추가해 자동화하세요.Also applies to: 54-78
.github/workflows/claude.yml (5)
15-20: 널 세이프 가드 추가로 조건식 견고화.일부 이벤트에서
body가 null일 수 있습니다.contains()호출 전 존재 여부를 AND로 가드해 NPE성 오류를 회피하세요.claude: - if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + if: | + (github.event_name == 'issue_comment' + && github.event.comment + && github.event.comment.body + && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' + && github.event.comment + && github.event.comment.body + && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' + && github.event.review + && github.event.review.body + && contains(github.event.review.body, '@claude')) || + (github.event_name == 'issues' + && ( + (github.event.issue && github.event.issue.body && contains(github.event.issue.body, '@claude')) || + (github.event.issue && github.event.issue.title && contains(github.event.issue.title, '@claude')) + ))
3-12: 동시성(concurrency) 그룹 추가로 중복 실행 방지.댓글 폭주 시 이전 실행 취소를 위해 워크플로 상단에
concurrency를 권장합니다.on: issue_comment: types: [created] pull_request_review_comment: types: [created] issues: types: [opened, assigned] pull_request_review: types: [submitted] + +concurrency: + group: claude-trigger-${{ github.event_name }}-${{ github.run_id }} + cancel-in-progress: true
16-19: 트리거 오탐 줄이기: 정확도 높은 매칭 사용 고려.
contains(..., '@claude')는 인용문/템플릿에도 반응할 수 있습니다. 의도 시그널만 트리거하려면startsWith또는match사용을 고려하세요.예:
startsWith(github.event.comment.body, '@claude')또는
match(github.event.comment.body, '(^|\\s)@claude(\\b|\\:)')
42-42: YAML 포맷: 후행 공백 및 잉여 빈 줄 제거.정적 분석 경고를 정리해 CI 노이즈를 줄이세요.
팁:
yamllint+pre-commit(trailing-whitespace, end-of-file-fixer)로 자동화.Also applies to: 45-45, 48-48, 51-51, 54-54, 60-60, 64-64
37-41: 권한 추가 전달 로직 확인.
additional_permissions: actions: read는 액션 입력으로 전달되어 CI 상태 읽기를 허용합니다. 상단permissions.actions: read와 중복되지만 목적이 다를 수 있으니(액션 내부 호출) 유지해도 무방합니다. 다만 불필요 시 한쪽만 남겨 단순화 가능합니다.원하시면 최소 권한 구성을 문서화한 예시도 추가해 드리겠습니다.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml(1 hunks).github/workflows/claude.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/claude.yml
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 48-48: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 54-54: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[warning] 64-64: too many blank lines (1 > 0)
(empty-lines)
.github/workflows/claude-code-review.yml
[error] 20-20: trailing spaces
(trailing-spaces)
[error] 27-27: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 73-73: trailing spaces
(trailing-spaces)
[warning] 78-78: too many blank lines (1 > 0)
(empty-lines)
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
|
|
There was a problem hiding this comment.
액션이 코멘트를 남길 권한이 부족합니다 (+ 과도한 id-token 권한).
현재 pull-requests: read, issues: read로는 리뷰 코멘트/리뷰 제출이 불가합니다. 또한 id-token: write는 OIDC 토큰 발급 권한으로, 필요하지 않다면 제거가 권장됩니다(공급망/권한 최소화). 아래처럼 조정해 주세요.
permissions:
contents: read
- pull-requests: read
- issues: read
- id-token: write
+ pull-requests: write
+ issues: write
+ # id-token: write # 필요 시에만 활성화📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| # id-token: write # 필요 시에만 활성화 |
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 27-27: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
.github/workflows/claude-code-review.yml lines 22-27: the workflow currently has
only read permissions for pull-requests and issues (so it cannot post review
comments) and also requests id-token: write unnecessarily; change pull-requests
and issues to write so the action can post reviews/comments, remove id-token:
write if OIDC is not required, and keep contents: read (or adjust only the
minimal additional permissions needed).
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@beta |
There was a problem hiding this comment.
🛠️ Refactor suggestion
サプライチェーン 리스크: 액션 버전을 커밋 SHA 또는 고정 태그로 핀하세요.
anthropics/claude-code-action@beta는 가변 태그입니다. 보안/재현성을 위해 커밋 SHA(권장) 또는 안정 태그로 고정하세요.
- uses: anthropics/claude-code-action@beta
+ uses: anthropics/claude-code-action@<pinned-commit-sha>
+# 또는 공개된 안정 태그(예: v1)가 있다면
+# uses: anthropics/claude-code-action@v1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: anthropics/claude-code-action@beta | |
| uses: anthropics/claude-code-action@<pinned-commit-sha> | |
| # 또는 공개된 안정 태그(예: v1)가 있다면 | |
| # uses: anthropics/claude-code-action@v1 |
🤖 Prompt for AI Agents
.github/workflows/claude-code-review.yml line 36: the action is using a mutable
tag "anthropics/claude-code-action@beta", which is a supply-chain risk; update
the workflow to pin the action to a specific commit SHA or a stable, immutable
tag (commit SHA preferred) by replacing "@beta" with the chosen commit SHA (or
fixed release tag), and commit that exact value so the workflow references an
immutable version for reproducibility and security.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs | ||
| steps: |
There was a problem hiding this comment.
액션이 응답 코멘트를 남길 권한이 부족합니다.
현재 pull-requests: read, issues: read로는 코멘트/리뷰 작성이 불가합니다. actions: read는 유지, PR/이슈는 write로 상향이 필요합니다. id-token: write는 불필요 시 제거 권장.
permissions:
contents: read
- pull-requests: read
- issues: read
+ pull-requests: write
+ issues: write
id-token: write
actions: read # Required for Claude to read CI results on PRs📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: |
🤖 Prompt for AI Agents
.github/workflows/claude.yml around lines 21 to 27: the workflow currently
grants only read on pull-requests and issues, which prevents the action from
posting comments; change pull-requests and issues from read to write so the
action can create PR/comments, keep actions: read, and if id-token: write is not
required remove it (or justify/retain if needed) to minimize permissions.
|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@beta |
There was a problem hiding this comment.
🛠️ Refactor suggestion
액션 버전 고정으로 공급망 리스크 저감.
@beta 대신 커밋 SHA 또는 안정 태그로 핀ning을 권장합니다.
- uses: anthropics/claude-code-action@beta
+ uses: anthropics/claude-code-action@<pinned-commit-sha>
+# 또는
+# uses: anthropics/claude-code-action@v1📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: anthropics/claude-code-action@beta | |
| uses: anthropics/claude-code-action@<pinned-commit-sha> | |
| # 또는 | |
| # uses: anthropics/claude-code-action@v1 |
🤖 Prompt for AI Agents
.github/workflows/claude.yml lines 35-35: the workflow uses the floating
reference "anthropics/claude-code-action@beta", which increases supply-chain
risk; replace it by pinning to a specific commit SHA or an immutable stable tag
(e.g., a released semver tag or the action's latest commit SHA) to ensure
reproducible runs; update the uses line to reference that SHA or stable tag and
add a brief comment noting why it was pinned.
Pull request was closed
Changes
Summary by CodeRabbit
신규 기능
기타 작업