Add Claude Code GitHub Workflow

[flowerornament]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[claude]

Pull Request Review

Thank you for adding the Claude Code GitHub workflows! This is a well-structured integration that follows the recommended patterns from the claude-code-action repository.

✅ Strengths

1. Dual Workflow Pattern: Smart separation between:

   • Auto-review workflow (claude-code-review.yml) for incoming PRs
   • Interactive workflow (claude.yml) for @claude mentions

2. Security Best Practices:

   • Properly uses GitHub secrets for the OAuth token
   • Restricts permissions to minimum required (read-only for most resources)
   • Workflow trigger is properly scoped (write-access users only can trigger via comments)
   • Includes commented examples for further restrictions (by author, file paths)

3. Context-Aware Review Prompt: The auto-review workflow includes a comprehensive prompt that references the repository's CLAUDE.md for conventions - this ensures consistent code reviews aligned with project standards

4. Proper GitHub API Tool Allowlist: Correctly restricts Claude's bash tools to safe, read-only gh commands plus gh pr comment for feedback

🔍 Observations & Suggestions

1. Workflow Activation Timing

The PR description correctly notes that @claude mentions won't work until after merge. This is because GitHub workflows from feature branches don't run by default for security reasons. Consider adding a note in the PR body about testing the setup post-merge.

2. Auto-Review Trigger Scope

The claude-code-review.yml triggers on ALL PRs with:

on:
  pull_request:
    types: [opened, synchronize]

Recommendation: Consider uncommenting the author filter to limit auto-reviews to specific users (e.g., external contributors, first-timers) to avoid unnecessary CI costs on every PR. For a project like this, you might want:

if: |
  github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' ||
  github.event.pull_request.author_association == 'NONE'

3. Missing actions: write Permission

The auto-review workflow needs to post comments but only has:

permissions:
  contents: read
  pull-requests: read
  issues: read
  id-token: write

Issue: Missing pull-requests: write permission means gh pr comment will fail.

Fix needed in .github/workflows/claude-code-review.yml:26:

permissions:
  contents: read
  pull-requests: write  # Changed from 'read' - needed for gh pr comment
  issues: read
  id-token: write

4. Fetch Depth Consideration

Both workflows use fetch-depth: 1 which is efficient but means Claude can't see git history. For auto-reviews, you might want fetch-depth: 0 or a higher number to allow Claude to see recent commits for context. The interactive workflow is fine at 1.

5. Path Filters (Optional Optimization)

The commented-out path filters in claude-code-review.yml are a good idea. For this SuperCollider extension, consider:

paths:
  - 'src/**/*.rs'
  - 'server/**/*.rs'
  - 'server/**/*.sc'
  - 'languages/**/*.toml'
  - '.zed/**/*.json'

This would skip reviews for documentation-only changes.

6. Claude Args in Interactive Workflow

The claude.yml workflow has commented-out claude_args but doesn't define allowed tools. Consider adding project-specific tool allowances that align with your workflow (e.g., if you want Claude to run tests or builds when mentioned in comments).

🐛 Bugs Found

Critical: Missing pull-requests: write permission in claude-code-review.yml will cause the auto-review workflow to fail when trying to post comments.

🎯 Testing Recommendations

After merge:

1. Test @claude mentions in a new issue
2. Test @claude mentions in a PR comment
3. Verify the auto-review runs on a new PR (or create a test PR)
4. Check GitHub Actions logs to confirm permissions are working
5. Verify comments appear from the Claude bot

📊 Test Coverage

N/A - This PR only adds workflow configuration files with no testable code logic.

🔒 Security Assessment

Overall: Good ✅

The security model is sound:

• Token stored as secret
• Minimal permissions granted
• Tool allowlist prevents arbitrary command execution
• Only repository collaborators can trigger workflows

One consideration: The auto-review workflow runs on all PRs from all authors. While Claude is sandboxed and can only read code (not execute it), you might want to limit auto-reviews to trusted contributors or specific scenarios to control costs and noise.

📝 Final Recommendation

Status: Approve with minor fix required

The critical issue is the missing pull-requests: write permission. Once that's fixed, this PR is ready to merge. The optional suggestions above can be addressed in follow-up PRs based on your team's preferences and usage patterns.

---

Action Items:

1. ✅ Fix: Add pull-requests: write permission to .github/workflows/claude-code-review.yml:26
2. 🔄 Consider: Adding author/path filters to reduce auto-review noise
3. 📖 Consider: Documenting the post-merge testing steps in the README or AGENTS.md