Add Claude Code GitHub Workflow#2
Conversation
|
Caution Review failedPull request was closed or merged during review 📝 WalkthroughSummary by CodeRabbit
WalkthroughThis PR introduces two GitHub Actions workflows that enable Claude-based code review automation. The first workflow ( ChangesClaude Code Review Automation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 2✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
Up to standards ✅🟢 Issues
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2305ae90e0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
This job is triggered by pull_request and unconditionally passes secrets.CLAUDE_CODE_OAUTH_TOKEN, but GitHub does not expose repository secrets to workflows triggered from fork-origin PR events. In that scenario (including many external contributor and Dependabot PRs), the token is empty and the Claude step fails instead of producing a review. Add a fork guard (or a safe split workflow) so fork PRs do not hard-fail.
Useful? React with 👍 / 👎.
| id: claude | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
This workflow listens to PR-related comment/review events and always relies on secrets.CLAUDE_CODE_OAUTH_TOKEN. For fork-origin PR contexts, those events are delivered to the base repo but repository secrets are withheld, so @claude invocations on such PRs will fail at runtime with no usable auth token. Add conditions to skip fork-origin PR contexts or route them through a trusted pattern.
Useful? React with 👍 / 👎.
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read |
There was a problem hiding this comment.
This workflow runs Claude’s code-review plugin, which posts findings back to the PR, but the job grants only pull-requests: read. With read-only PR scope, the action cannot reliably create or update review output on the pull request, so reviews can run without publishing actionable feedback. Change this permission to pull-requests: write for the review job.
Useful? React with 👍 / 👎.
| contents: read | ||
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The @claude workflow is configured with read-only contents, pull-requests, and issues permissions, but this action’s default behavior is to respond by creating/updating GitHub comments and potentially pushing branch updates. In this state, valid @claude requests can fail with permission errors instead of replying. Set the job permissions to write for these scopes.
Useful? React with 👍 / 👎.
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
The trigger condition matches any new comment containing @claude but does not exclude github.actor == 'claude[bot]'. Claude’s own status or error comments can include that text and then re-trigger the same job, creating duplicate or cascading runs and unnecessary spend until someone intervenes. Add an actor guard in the job-level if condition to ignore bot-authored events.
Useful? React with 👍 / 👎.
Adds templates/triage-bot.yml — exact copy of the validated workflow from ANcpLua/triage-bot-playground PR #1 + #2 (2026-05-18) with a documentation header explaining decision rules, prerequisites, and the gap it closes. Decision rules (v1, deterministic): body contains [triage:auto-resolve] → dismiss body matches /^(nit:|nitpick:|praise:)/i → dismiss author is Copilot, body < 200 chars → dismiss anything else → needs-human (default) The gap it closes: GitHub native auto-merge fires the moment CI goes green, even if Copilot / CodeRabbit later post review comments. With branch protection or a ruleset enforcing required_conversation_resolution=true, any unresolved thread keeps the PR mergeStateStatus=BLOCKED until explicitly resolved. The bot auto-resolves the non-blocking threads (so they don't accumulate as noise) while leaving real concerns to block the merge until a human acts. This is the structural fix that makes the pr-heal.yml cooldown (commit 22d0b28) belt-and-suspenders rather than the primary line of defence — the cooldown buys time for reviewers, the native gate deterministically waits for explicit resolution. enforce-repo-settings.yml extended (both enforce-user and enforce-org jobs): seed-if-missing pattern. Skip-if-exists because adopting the workflow requires a per-repo TRIAGE_PAT secret and the required_conversation_resolution gate on the default branch; this sweep can put the file in place but can't safely flip either. Gotcha (in the workflow's docstring): GITHUB_TOKEN cannot resolveReviewThread on threads it didn't author — needs a classic PAT or GitHub App installation token with pull_requests: write.
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!