ci: add @claude PR comment responder workflow #973
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,68 @@ | ||
| name: Claude | ||
|
|
||
| # Runs a Claude Code session when a collaborator mentions "@claude" on a pull | ||
| # request comment or review. Claude reads the triggering comment, works on the | ||
| # PR's current head, pushes a scoped fix to the PR branch, and replies in the | ||
| # thread. Unlike a subscribed chat session, this fires on the webhook every | ||
| # time, so it keeps working after the session that opened the PR has ended. | ||
|
|
||
| on: | ||
| issue_comment: | ||
| types: [created] | ||
| pull_request_review_comment: | ||
| types: [created] | ||
| pull_request_review: | ||
| types: [submitted] | ||
|
|
||
| # Least privilege by default; the job widens only what Claude needs. | ||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| claude: | ||
| name: Respond to @claude | ||
| runs-on: ubuntu-24.04 | ||
| # Only run when a human (not a bot) mentions @claude on a pull request, so | ||
| # ordinary comments — and Claude's own replies — never spin up a runner. | ||
| if: > | ||
| (github.event_name == 'issue_comment' && | ||
| github.event.issue.pull_request != null && | ||
| github.event.comment.user.type != 'Bot' && | ||
| contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && | ||
| github.event.comment.user.type != 'Bot' && | ||
| contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && | ||
| github.event.review.user.type != 'Bot' && | ||
| github.event.review.body != null && | ||
| contains(github.event.review.body, '@claude')) | ||
| permissions: | ||
| contents: write # push the scoped fix to the PR branch | ||
| pull-requests: write # comment back and update the PR | ||
| issues: write # comment on the PR conversation thread | ||
| id-token: write # OIDC used by the action | ||
| actions: read # read CI results for context | ||
| concurrency: | ||
| group: claude-${{ github.event.issue.number || github.event.pull_request.number }} | ||
| cancel-in-progress: false | ||
| timeout-minutes: 30 | ||
| env: | ||
| # Assigned to job env so a step-level `if` can detect an unconfigured | ||
| # secret and skip gracefully instead of hard-failing the check. | ||
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| steps: | ||
| - name: Warn when the API key is not configured | ||
| if: ${{ env.ANTHROPIC_API_KEY == '' }} | ||
| run: echo "::warning title=Claude::ANTHROPIC_API_KEY secret is not configured; skipping. Add ANTHROPIC_API_KEY (or switch the action input to claude_code_oauth_token) in repository secrets so @claude mentions are handled." | ||
| - name: Checkout repository | ||
| if: ${{ env.ANTHROPIC_API_KEY != '' }} | ||
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | ||
| with: | ||
| fetch-depth: 1 | ||
| - name: Run Claude Code | ||
| if: ${{ env.ANTHROPIC_API_KEY != '' }} | ||
| uses: anthropics/claude-code-action@af0559ee4f514d1ef21826982bed13f7edc3c35e # v1.0.178 | ||
|
Comment on lines
+57
to
+64
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
file=".github/workflows/claude.yml"
echo "=== file listing ==="
git ls-files "$file"
echo
echo "=== line count ==="
wc -l "$file"
echo
echo "=== relevant excerpt ==="
sed -n '1,220p' "$file"Repository: BigSimmo/Database Length of output: 3354 🌐 Web query:
💡 Result: The actions/checkout action has specific default behaviors regarding what it checks out depending on the triggering event, and navigating these defaults—particularly for issue_comment events or pull request contexts—often requires explicit configuration [1][2][3]. Default Behavior By default, actions/checkout checks out the reference or SHA that triggered the workflow [1][3]. For events that do not have a specific reference (or when the context is ambiguous), it falls back to the default branch [1][2][3]. Notably, for pull_request events, the default is to checkout the merge commit (refs/pull/PULL_REQUEST_NUMBER/merge), not the individual head branch of the pull request [4][5]. Issue Comment and Pull Request Contexts When a workflow is triggered by an issue_comment event, GitHub does not automatically checkout the pull request branch [6][2]. To checkout the source branch of a pull request from an issue_comment event, you must dynamically determine the PR head reference and pass it to the ref input [6]: 1. Use actions/github-script to retrieve the pull request head ref [6]. 2. Pass that reference to actions/checkout [6]. Example pattern to checkout the PR branch or fallback to default: - uses: actions/github-script@v7 id: pr if: ${{ github.event.issue.pull_request }} with: github-token: ${{ secrets.GITHUB_TOKEN }} script: | const { data: pr } = await github.rest.pulls.get({ owner: context.repo.owner, repo: context.repo.repo, pull_number: context.payload.issue.number }); core.setOutput('head_ref', pr.head.ref); - uses: actions/checkout@v4 with: ref: ${{ github.event.issue.pull_request && steps.pr.outputs.head_ref || github.ref }} Claude Code Action Configuration For users of anthropics/claude-code-action, the action expects a repository checkout to exist before it runs [7][8]. Standard practice is to run actions/checkout@v4 before the Claude step [7][8]. If you encounter failures related to branch setup (e.g., when using persist-credentials: false), it is often because the action attempts to fetch origin before configuring its own authentication; in such cases, ensure proper credential persistence or follow the maintainer-recommended workarounds for your specific environment [9]. Citations:
🌐 Web query:
💡 Result: In GitHub Actions workflows using Citations:
Check out the PR head before running Claude on 🧰 Tools🪛 zizmor (1.26.1)[warning] 57-61: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI Agents |
||
| with: | ||
| # The action's default trigger phrase is "@claude"; it reads the | ||
| # triggering comment/review and acts on the current PR head. | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
|
Comment on lines
+62
to
+68
Contributor
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== workflow file ==\n'
cat -n .github/workflows/claude.yml | sed -n '1,180p'
printf '\n== references to claude-code-action ==\n'
rg -n "claude-code-action|ANTHROPIC_API_KEY|`@claude`|claude/" .github/workflows . -g '*.yml' -g '*.yaml' -g '*.md' -g '*.txt' || trueRepository: BigSimmo/Database Length of output: 50374 🏁 Script executed: #!/bin/bash
set -euo pipefail
cat -n .github/workflows/claude.yml | sed -n '1,180p'Repository: BigSimmo/Database Length of output: 3702 🌐 Web query:
💡 Result: Claude Code and its associated GitHub Action provide automated workflows for branch management and pull request (PR) creation, supported by specific security configurations [1][2]. Security and Default Behaviors: For the Claude Code Action on GitHub, bot user control is enabled by default for security, meaning bots cannot trigger the action unless explicitly configured via the allowed_bots parameter [3][4]. Caution is advised when using wildcards ('*') for allowed bots, as this can allow external, uninstalled apps to trigger workflows on public repositories [3][4]. Claude Code itself enforces strict read-only permissions by default, requiring explicit user approval for any operations that modify files, execute shell commands, or perform network requests [5][6]. Branch and PR Creation Flow: Claude Code automates the Git lifecycle through natural language instructions [2][7]. Users can request branch creation and PR generation directly within the conversational interface [8][2]. 1. Branch Creation: When asked to create a branch, Claude Code typically handles the naming based on project conventions (e.g., CLAUDE.md) or defaults to patterns like feature/ or fix/ [9][7]. It executes the necessary git checkout commands automatically [2]. 2. PR Creation: Claude uses the GitHub CLI (gh) tool under the hood to manage pull requests [2][7]. A single command like "create a PR" triggers a process where Claude analyzes commits, generates a title and summary, and creates the PR via gh pr create [2][7]. 3. Session Linking: When a PR is created through this flow, the active conversational session is automatically linked to that PR [8][9]. This allows users to resume the session later using the PR number or URL to continue working on feedback or CI results [8][10]. For direct update flows, Claude Code performs background checks for updates on startup, with native installations updating automatically by default [11][12]. Users can configure release channels or disable these updates depending on their installation method (e.g., Homebrew/WinGet vs. native) [11][12]. Citations:
🌐 Web query:
💡 Result: Key points from
If you want, I can extract the exact YAML-safe pattern from that doc. Update 🤖 Prompt for AI Agents |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: BigSimmo/Database
Length of output: 4863
🏁 Script executed:
Repository: BigSimmo/Database
Length of output: 28335
Require collaborator-only gating before invoking Claude
.github/workflows/claude.yml:27-38The job still accepts any non-bot
@claudemention and then runs with write permissions plusANTHROPIC_API_KEY. Restrict each trigger to trusted repository associations likeOWNER,MEMBER, orCOLLABORATORbefore allowing it to run.🤖 Prompt for AI Agents