Add Claude Code GitHub Workflow #36
Conversation
|
Merging to
|
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
Reviewer's GuideAdds two GitHub Actions workflows to integrate Claude Code into the repository: one for ad-hoc @claude mentions on issues/PRs and one for automatic Claude-powered code review on pull requests. Sequence diagram for ad-hoc @claude mentions workflowsequenceDiagram
actor Developer
participant GitHub
participant ClaudeWorkflow as Workflow_Claude_Code
participant ClaudeJob as Job_claude
participant Checkout as Checkout_repository
participant ClaudeAction as Claude_Code_Action
participant Anthropic as Anthropic_API
Developer->>GitHub: Create issue, PR comment, or review with @claude
GitHub-->>GitHub: Emit issue_comment, pull_request_review_comment, pull_request_review, or issues event
GitHub->>ClaudeWorkflow: Trigger claude.yml workflow
ClaudeWorkflow-->>ClaudeWorkflow: Evaluate if condition for @claude mention
ClaudeWorkflow->>ClaudeJob: Start job claude when condition is true
ClaudeJob->>Checkout: Run actions/checkout@v4
Checkout-->>ClaudeJob: Repository checked out
ClaudeJob->>ClaudeAction: Run anthropics/claude-code-action@v1 with claude_code_oauth_token
ClaudeAction->>Anthropic: Call Claude API with comment and PR/issue context
Anthropic-->>ClaudeAction: Generated instructions and changes
ClaudeAction->>GitHub: Create comments, branches, or commits in repo
GitHub-->>Developer: Display Claude response and changes in PR or issue
Sequence diagram for automatic Claude Code Review on pull requestssequenceDiagram
actor Developer
participant GitHub
participant ReviewWorkflow as Workflow_Claude_Code_Review
participant ReviewJob as Job_claude_review
participant Checkout as Checkout_repository
participant ClaudeAction as Claude_Code_Action
participant Anthropic as Anthropic_API
Developer->>GitHub: Open or update pull request
GitHub-->>GitHub: Emit pull_request event (opened, synchronize, ready_for_review, reopened)
GitHub->>ReviewWorkflow: Trigger claude-code-review.yml workflow
ReviewWorkflow-->>ReviewJob: Start job claude-review
ReviewJob->>Checkout: Run actions/checkout@v4
Checkout-->>ReviewJob: Repository checked out
ReviewJob->>ClaudeAction: Run anthropics/claude-code-action@v1
ClaudeAction-->>ClaudeAction: Load plugins and prompt for code review
ClaudeAction->>Anthropic: Request code review for pull request
Anthropic-->>ClaudeAction: Review results and suggestions
ClaudeAction->>GitHub: Post review comments to pull request
GitHub-->>Developer: Show Claude Code Review feedback on PR
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
PR Review: Add Claude Code GitHub WorkflowI've reviewed this PR and found some issues that should be addressed before merging. 🔴 Critical Issue: Duplicate Workflow FilesThis PR adds
Merging this PR will result in duplicate workflows running for the same events, which could cause:
Recommendation: Either delete this PR (the functionality already exists), or update it to replace/remove the existing 📋 Comparison with Existing WorkflowsThe existing Security & Pinning
Using mutable version tags ( Permissions
The new workflows use
Model & Tools ConfigurationThe existing claude_args: --model opus --allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"The new Code Review Trigger Events
The new workflow triggers on more events, though this may or may not be desired. 🔒 Security Concerns
✅ What's Good
📝 Recommendations
This review was generated by Claude Code |
There was a problem hiding this comment.
Pull request overview
This PR adds two new GitHub Actions workflow files (.yml versions) for Claude Code integration. The workflows enable AI-powered code assistance through @claude mentions in issues/PRs and automated code reviews on pull requests. However, there are existing .yaml versions of these workflows already present in the repository with more secure configurations.
Changes:
- Added
.github/workflows/claude.ymlfor handling @claude mentions in issues and PRs - Added
.github/workflows/claude-code-review.ymlfor automated PR code reviews
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 11 comments.
| File | Description |
|---|---|
.github/workflows/claude.yml |
Defines workflow for triggering Claude Code via @claude mentions, but lacks write permissions and security hardening present in existing .yaml version |
.github/workflows/claude-code-review.yml |
Defines automated code review workflow using Claude plugins, but lacks write permissions and uses different approach than existing .yaml version |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -0,0 +1,44 @@ | |||
| name: Claude Code Review | |||
There was a problem hiding this comment.
The workflow name has changed from "claude-code-review" (in the existing .yaml file) to "Claude Code Review" (in this new .yml file). This inconsistency in naming conventions may cause confusion when viewing GitHub Actions runs. Consider using consistent naming across both file formats.
| name: Claude Code Review | |
| name: claude-code-review |
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] |
There was a problem hiding this comment.
The new .yml workflow includes additional PR trigger types (ready_for_review, reopened) compared to the existing .yaml version which only triggers on opened and synchronize. While these additional triggers may be intentional improvements, they will cause the workflow to run more frequently and consume more API quota. Ensure this increased frequency is desired and necessary.
| types: [opened, synchronize, ready_for_review, reopened] | |
| types: [opened, synchronize] |
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The permissions are set to read-only for pull-requests and issues, but Claude Code needs write permissions to create comments and interact with the repository. The existing .yaml version of this workflow correctly includes pull-requests: write and issues: write permissions. Without write permissions, Claude won't be able to respond to mentions or perform requested actions.
| pull-requests: read | |
| issues: read | |
| pull-requests: write | |
| issues: write |
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The permissions are set to read-only for pull-requests and issues, but Claude Code needs write permissions to post review comments. The existing .yaml version of this workflow correctly includes pull-requests: write and issues: write permissions. Without write permissions, the code review workflow won't be able to post its findings.
| pull-requests: read | |
| issues: read | |
| pull-requests: write | |
| issues: write |
| @@ -0,0 +1,50 @@ | |||
| name: Claude Code | |||
There was a problem hiding this comment.
The workflow name has changed from "claude-code" (in the existing .yaml file) to "Claude Code" (in this new .yml file). This inconsistency in naming conventions may cause confusion when viewing GitHub Actions runs. Consider using consistent naming across both file formats.
| name: Claude Code | |
| name: claude-code |
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
Using @v1 as the version tag can be risky as it may point to different commits over time and could introduce breaking changes without warning. The existing .yaml workflow pins to a specific commit hash (a017b830c03e23789b11fb69ed571ea61c12e45c) which is more secure and ensures reproducible builds. Consider pinning to a specific commit SHA instead of using a floating tag.
| uses: anthropics/claude-code-action@v1 | |
| uses: anthropics/claude-code-action@a017b830c03e23789b11fb69ed571ea61c12e45c |
| actions: read # Required for Claude to read CI results on PRs | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
Using @v4 as a floating tag is less secure than pinning to a specific commit hash. The existing .yaml workflow pins checkout to a specific commit (8e8c483db84b4bee98b60c0593521ed34d9990e8) which ensures reproducible builds and prevents potential security issues from unexpected updates. Consider pinning to a specific commit SHA.
| uses: actions/checkout@v4 | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 |
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
Using @v4 as a floating tag is less secure than pinning to a specific commit hash. The existing .yaml workflow pins checkout to a specific commit (8e8c483db84b4bee98b60c0593521ed34d9990e8) which ensures reproducible builds and prevents potential security issues from unexpected updates. Consider pinning to a specific commit SHA.
| uses: actions/checkout@v4 | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 |
| # Optional: Add claude_args to customize behavior and configuration | ||
| # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md | ||
| # or https://code.claude.com/docs/en/cli-reference for available options | ||
| # claude_args: '--allowed-tools Bash(gh pr:*)' |
There was a problem hiding this comment.
The new .yml workflow lacks the allowed-tools configuration present in the existing .yaml version. The .yaml version restricts Claude to specific GitHub CLI commands (gh issue view, gh search, gh pr comment, etc.) which limits potential security risks. Without this restriction, Claude may have broader access than intended. Consider adding the claude_args parameter with allowed-tools restrictions.
| # claude_args: '--allowed-tools Bash(gh pr:*)' | |
| claude_args: '--allowed-tools Bash(gh issue view,gh search,gh pr comment)' |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
The new .yml workflow uses a different approach (plugin_marketplaces and plugins) compared to the existing .yaml version which uses a custom prompt and allowed-tools. The .yaml version provides more explicit guidance about what to review and restricts tools to specific GitHub CLI commands. The plugin-based approach may have different behavior and security implications. Ensure that the code-review plugin provides equivalent or better functionality and security controls.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| @@ -0,0 +1,44 @@ | |||
| name: Claude Code Review | |||
There was a problem hiding this comment.
Bug: This PR adds new workflow files (.yml) without removing the old ones (.yaml), which will cause duplicate workflow runs for the same triggers.
Severity: MEDIUM
Suggested Fix
The old workflow files (.github/workflows/claude.yaml and .github/workflows/claude-code-review.yaml) should be deleted as part of this pull request to ensure only the new .yml versions are executed, preventing redundant runs.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/claude-code-review.yml#L1
Potential issue: The pull request introduces new GitHub Actions workflow files
(`claude.yml`, `claude-code-review.yml`) without removing the old ones (`claude.yaml`,
`claude-code-review.yaml`). Since GitHub Actions treats files with different extensions
as separate workflows, both the old and new versions will be triggered by the same
events (e.g., pull request creation). This will cause duplicate, redundant workflow
runs, wasting CI/CD resources. Furthermore, the new `.yml` workflows have different and
potentially incorrect configurations compared to the existing `.yaml` files, which could
lead to inconsistent behavior or runtime failures.
Did we get this right? 👍 / 👎 to inform future reviews.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write |
There was a problem hiding this comment.
Bug: The new workflow files grant only read permissions for pull-requests and issues, but the action requires write permissions to post comments, which will cause runtime failures.
Severity: HIGH
Suggested Fix
In the new workflow files (.github/workflows/claude.yml and .github/workflows/claude-code-review.yml), update the permissions block to grant write access for pull-requests and issues. For example, change pull-requests: read to pull-requests: write.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/claude-code-review.yml#L22-L26
Potential issue: The new GitHub Actions workflows (`claude.yml` and
`claude-code-review.yml`) are configured with `read` permissions for `pull-requests` and
`issues`. However, the action `anthropics/claude-code-action@v1` requires `write`
permissions to post comments on pull requests and issues, which is a stated goal of the
workflow. When the action attempts to perform a write operation, such as posting a
review comment, the workflow will fail with a permission denied error from GitHub
Actions. The existing `.yaml` workflows correctly specify `write` permissions,
confirming this requirement.
Did we get this right? 👍 / 👎 to inform future reviews.
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by Sourcery
Add GitHub Actions workflows to integrate Claude Code for on-demand assistance via comments and automated code review on pull requests.
New Features: