Skip to content

Add claude workflow #378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
chowbao wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Add claude workflow #378

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f8ace88
Add claude workflow
chowbao Feb 23, 2026
bc425a7
Merge branch 'master' into add-claude-workflow
chowbao Feb 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Claude Code

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened, assigned]
pull_request_review:
types: [submitted]

Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow is missing the concurrency configuration that is present in all other workflows in the repository. All other workflows include a concurrency setting to prevent multiple concurrent runs and manage workflow execution properly. Add the following after the 'on' section:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha || github.ref }}-{{ github.event_name }}
  cancel-in-progress: true

This ensures that for event-driven workflows like this one, only the most recent instance runs, which is important for managing Claude's responses to comments and avoiding confusion from multiple concurrent executions.

Suggested change
concurrency:
group: ${{ github.workflow }}-${{ github.ref_protected == 'true' && github.sha || github.ref }}-{{ github.event_name }}
cancel-in-progress: true

Copilot uses AI. Check for mistakes.
jobs:
claude:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.assignees.*.login, 'claude[bot]')))
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The condition on line 19 uses 'contains(github.event.issue.assignees..login, 'claude[bot]')' which may not work as intended. The 'github.event.issue.assignees..login' syntax is not valid for filtering arrays in GitHub Actions expressions.

To check if 'claude[bot]' is among the assignees, you would need to use a different approach, such as converting the assignees array to JSON and using the 'contains()' function on the JSON string. However, this is complex and error-prone. Consider removing this check or using a separate step with a script to properly validate assignees if this functionality is needed.

Suggested change
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.assignees.*.login, 'claude[bot]')))
(github.event_name == 'issues' && contains(github.event.issue.body, '@claude'))

Copilot uses AI. Check for mistakes.
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
issues: write
id-token: write
steps:
- uses: anthropics/claude-code-action@v1
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For better security, consider pinning the action to a specific commit SHA rather than using a mutable version tag like @v1. Version tags can be moved to point to different commits, potentially introducing malicious code. This is especially important for third-party actions that have write permissions to the repository.

For example, instead of:

- uses: anthropics/claude-code-action@v1

Use:

- uses: anthropics/claude-code-action@<commit-sha>  # v1

This pattern is already used for the docker/login-action in build.yml:31, which pins to a specific SHA.

Suggested change
- uses: anthropics/claude-code-action@v1
- uses: anthropics/claude-code-action@<commit-sha> # v1

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Feb 23, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The step using the claude-code-action is missing a 'name' attribute. All other workflow steps in the repository include descriptive names for better readability and debugging. Add a name to this step, such as:

- name: Run Claude Code Action
  uses: anthropics/claude-code-action@v1
Suggested change
- uses: anthropics/claude-code-action@v1
- name: Run Claude Code Action
uses: anthropics/claude-code-action@v1

Copilot uses AI. Check for mistakes.
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Loading