Add Claude Code GitHub Workflow - #158
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
📝 WalkthroughWalkthroughAdds two GitHub Actions workflows that invoke Claude Code for selected pull request events and for issue or review interactions containing ChangesClaude automation
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
📊 Source Code Metrics (this PR vs
|
There was a problem hiding this comment.
Pull request overview
Adds GitHub Actions workflows to integrate the Anthropic Claude Code agent into this repository, enabling automated Claude runs based on mentions/events and an optional automated PR code-review job.
Changes:
- Adds a
Claude Codeworkflow triggered by comment/review events (and issue events) that runsanthropics/claude-code-action. - Adds a
Claude Code Reviewworkflow that runs the same action on PR lifecycle events with a code-review plugin prompt.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.
| File | Description |
|---|---|
| .github/workflows/claude.yml | New workflow to invoke Claude Code when @claude appears in comments/reviews/issues. |
| .github/workflows/claude-code-review.yml | New workflow to invoke an automated Claude-driven PR code review on PR events. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| issues: | ||
| types: [opened, assigned] |
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs |
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@v1 |
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
|
|
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Around line 29-36: Pin the actions/checkout and anthropics/claude-code-action
references to immutable commit SHAs in both
.github/workflows/claude-code-review.yml lines 29-36 and
.github/workflows/claude.yml lines 28-35, replacing the mutable v4 and v1 tags
while preserving the existing action configuration.
- Around line 3-5: Add a workflow-level concurrency configuration alongside the
pull_request trigger, using a pull-request-specific group and enabling
cancel-in-progress so newer synchronize runs cancel older Claude review runs.
Keep the existing trigger types unchanged.
- Around line 36-41: Update the Claude Code action configuration to append
--comment to the prompt and configure claude_args to pass the GitHub CLI and
inline-comment tools, ensuring the code-review command posts review comments on
the pull request instead of only printing output.
- Around line 22-26: Update the permissions for the workflow at
.github/workflows/claude-code-review.yml, lines 22-26, to grant contents,
pull-requests, and issues write access while retaining id-token write. Apply the
same write scopes in .github/workflows/claude.yml, lines 21-26, and preserve
actions read there for CI-result access.
In @.github/workflows/claude.yml:
- Around line 8-19: Remove assigned from the issues.types list in the workflow
trigger, leaving only opened so unrelated issue reassignment cannot rerun the
claude job. Do not change the existing job conditions or other event triggers.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: c9f59661-5d7f-4e17-a016-1293312ae12e
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml.github/workflows/claude.yml
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf 'Files:\n'
git ls-files '.github/workflows/claude-code-review.yml' || true
printf '\nLine-numbered contents:\n'
cat -n .github/workflows/claude-code-review.yml
printf '\nWorkflow outline (if supported):\n'
ast-grep outline .github/workflows/claude-code-review.yml 2>/dev/null || trueRepository: ophi-dev/antlr-rust-runtime
Length of output: 2068
Cancel stale reviews per pull request. Add a workflow-level concurrency group with cancel-in-progress: true so newer synchronize runs replace older Claude review runs and avoid stale duplicate comments.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 3-3: truthy value should be one of [false, true]
(truthy)
🪛 zizmor (1.26.1)
[warning] 3-11: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 3 - 5, Add a
workflow-level concurrency configuration alongside the pull_request trigger,
using a pull-request-specific group and enabling cancel-in-progress so newer
synchronize runs cancel older Claude review runs. Keep the existing trigger
types unchanged.
Source: Linters/SAST tools
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Files ==\n'
git ls-files '.github/workflows/claude-code-review.yml' '.github/workflows/claude.yml' || true
printf '\n== claude-code-review.yml ==\n'
cat -n .github/workflows/claude-code-review.yml
printf '\n== claude.yml ==\n'
cat -n .github/workflows/claude.yml
printf '\n== Search for workflow/action usage ==\n'
rg -n "pull-requests:|issues:|actions:|anthropic|claude|checkout@" .github/workflows .github -g '*.yml' -g '*.yaml' || trueRepository: ophi-dev/antlr-rust-runtime
Length of output: 12325
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "hello"Repository: ophi-dev/antlr-rust-runtime
Length of output: 171
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,220p' .github/workflows/claude-code-review.yml
printf '\n---\n'
sed -n '1,220p' .github/workflows/claude.ymlRepository: ophi-dev/antlr-rust-runtime
Length of output: 3489
🌐 Web query:
anthropics/claude-code-action workflow permissions pull-requests issues write GITHUB_TOKEN OAuth token comments documentation
💡 Result:
To use the anthropics/claude-code-action, you must configure specific GitHub workflow permissions and authentication to enable the action to interact with your repository. Required Workflow Permissions In your GitHub Actions workflow YAML file, you must explicitly define the following permissions to allow the action to read and write to your repository [1][2]: permissions: contents: write pull-requests: write issues: write id-token: write # Required for OIDC authentication to the Claude GitHub App If you need Claude to access workflow runs, job logs, or test results, you must also add actions: read to these permissions [2][3]. Authentication and OAuth Tokens The claude-code-action typically uses the Claude GitHub App [1][4]. The action uses OpenID Connect (OIDC) to exchange an identity token for an app token, which is why id-token: write is mandatory [2][5]. If you choose not to use the official GitHub App or need to override the default behavior, you can provide your own github_token (such as a Personal Access Token or a custom app token) as an input to the action [2][3]. Note that if you use a custom token, you must ensure it has the necessary contents, pull-requests, and issues write permissions to perform its tasks [1][4]. Security Considerations * Repository Write Access: As a security measure, only users with write access to the repository can trigger the action by default [2][4]. * Bot Triggers: By default, other bots cannot trigger the action. If you need to enable this, you must use the allowed_bots parameter [4]. * Least Privilege: Always specify permissions explicitly in your workflow rather than relying on default settings, and use GitHub Secrets for any sensitive tokens [2]. * Fine-Grained Permissions: For more advanced control within the Claude Code tool itself (not just the GitHub Action), you can manage tool-level permissions using the /permissions command in the Claude Code CLI [6][7].
Citations:
- 1: https://code.claude.com/docs/en/github-actions
- 2: https://github.com/anthropics/claude-code-action/blob/main/docs/faq.md
- 3: https://github.com/anthropics/claude-code-action/blob/eb99fb38/docs/faq.md
- 4: https://github.com/anthropics/claude-code-action/blob/refs/heads/main/docs/security.md
- 5: https://github.com/anthropics/claude-code-action/blob/9a3c761f/src/github/token.ts
- 6: https://code.claude.com/docs/en/permissions
- 7: https://code.claude.com/docs/en/commands.md
Grant the Claude workflows the write scopes they require.
.github/workflows/claude-code-review.yml:anthropics/claude-code-actionneedscontents: write,pull-requests: write,issues: write, andid-token: write; the current read-only scopes will block review/comment creation..github/workflows/claude.yml: apply the same write scopes; keepactions: readonly for CI-result access.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 24-24: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
📍 Affects 2 files
.github/workflows/claude-code-review.yml#L22-L26(this comment).github/workflows/claude.yml#L21-L26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 22 - 26, Update the
permissions for the workflow at .github/workflows/claude-code-review.yml, lines
22-26, to grant contents, pull-requests, and issues write access while retaining
id-token write. Apply the same write scopes in .github/workflows/claude.yml,
lines 21-26, and preserve actions read there for CI-result access.
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n## Workflow files\n'
git ls-files .github/workflows/claude-code-review.yml .github/workflows/claude.yml
printf '\n## Relevant lines\n'
for f in .github/workflows/claude-code-review.yml .github/workflows/claude.yml; do
echo "---- $f ----"
cat -n "$f" | sed -n '1,120p'
done
printf '\n## Search for other action pins in workflows\n'
rg -n 'uses:\s*[^@]+@' .github/workflows -g '*.yml' -g '*.yaml'Repository: ophi-dev/antlr-rust-runtime
Length of output: 7088
Pin these workflow actions to immutable SHAs.
Both Claude jobs still reference mutable tags in privileged contexts:
.github/workflows/claude-code-review.yml:actions/checkout@v4,anthropics/claude-code-action@v1.github/workflows/claude.yml:actions/checkout@v4,anthropics/claude-code-action@v1
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 2 files
.github/workflows/claude-code-review.yml#L29-L36(this comment).github/workflows/claude.yml#L28-L35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 29 - 36, Pin the
actions/checkout and anthropics/claude-code-action references to immutable
commit SHAs in both .github/workflows/claude-code-review.yml lines 29-36 and
.github/workflows/claude.yml lines 28-35, replacing the mutable v4 and v1 tags
while preserving the existing action configuration.
Source: Linters/SAST tools
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow =="
sed -n '1,120p' .github/workflows/claude-code-review.yml
echo
echo "== repo references =="
rg -n --hidden --glob '!**/.git/**' --glob '!**/node_modules/**' "code-review|claude_args|--comment|plugin_marketplaces|plugins:" .github/workflows . || trueRepository: ophi-dev/antlr-rust-runtime
Length of output: 2890
🏁 Script executed:
#!/bin/bash
set -euo pipefail
wc -l .github/workflows/claude-code-review.yml
printf '\n'
cat -n .github/workflows/claude-code-review.yml | sed -n '1,120p'Repository: ophi-dev/antlr-rust-runtime
Length of output: 1951
🌐 Web query:
Anthropic claude-code code-review README --comment claude_args inline-comment GitHub CLI tools
💡 Result:
Claude Code provides a dedicated /code-review command designed to analyze diffs for correctness bugs, style issues, and efficiency improvements [1][2][3]. When using this command, the --comment flag is specifically used to post findings as inline comments directly on a GitHub Pull Request [1][2]. Usage and Integration: - Local Execution: The /code-review command is run within a Claude Code terminal session [1][3]. It automatically detects the open GitHub pull request associated with your current branch, provided the GitHub CLI (gh) is installed [2]. - Command Syntax: To run a review and post findings as inline comments, use: /code-review --comment [2][4] - Modifiers: You can specify effort levels (e.g., /code-review high --comment) to control the depth of the analysis [2][3]. - Alternative (GitHub App/Actions): For team-wide automation, you can use the managed Claude GitHub App (via Anthropic's organization settings) to trigger reviews on PR events (creation, push, or manual comment), or use the anthropics/claude-code-action in self-hosted GitHub Actions workflows to achieve similar inline feedback [1][3]. The --comment flag effectively bridges the local CLI environment with GitHub's code review interface, allowing for seamless integration into development workflows without leaving the terminal [2][3].
Citations:
- 1: https://code.claude.com/docs/en/code-review
- 2: https://claudcod.com/blog/claude-code-review-command/
- 3: https://getclaudekit.com/blog/guide/development/reviewing-pull-requests
- 4: https://padezhnov.com/en/blog/claude-code-review-catch-real-bugs-not-style-nits/
🏁 Script executed:
#!/bin/bash
set -euo pipefail
sed -n '1,120p' .github/workflows/claude.ymlRepository: ophi-dev/antlr-rust-runtime
Length of output: 2051
Run /code-review in comment mode
Add --comment to the prompt and pass the GitHub CLI/inline-comment tools through claude_args; otherwise this step only prints to the terminal instead of posting PR review comments.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 36-36: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 36 - 41, Update the
Claude Code action configuration to append --comment to the prompt and configure
claude_args to pass the GitHub CLI and inline-comment tools, ensuring the
code-review command posts review comments on the pull request instead of only
printing output.
| issues: | ||
| types: [opened, assigned] | ||
| pull_request_review: | ||
| types: [submitted] | ||
|
|
||
| jobs: | ||
| claude: | ||
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
🚀 Performance & Scalability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced lines.
git ls-files .github/workflows/claude.yml
wc -l .github/workflows/claude.yml
cat -n .github/workflows/claude.yml | sed -n '1,220p'Repository: ophi-dev/antlr-rust-runtime
Length of output: 2462
Remove the assigned issue trigger.
issues.assigned re-runs this workflow whenever the issue still contains @claude, so unrelated reassignment can invoke Claude again. Keep it only if assignment is meant to trigger Claude and is gated to the configured assignee.
🧰 Tools
🪛 zizmor (1.26.1)
[info] 14-14: workflow or action definition without a name (anonymous-definition): this job
(anonymous-definition)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 8 - 19, Remove assigned from the
issues.types list in the workflow trigger, leaving only opened so unrelated
issue reassignment cannot rerun the claude job. Do not change the existing job
conditions or other event triggers.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e47ecb134
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
With this prompt, the automatic pull_request workflow invokes the code-review plugin without --comment; the upstream command instructions say the plugin stops after printing the terminal summary when that flag is absent, so each PR review can consume a Claude run and finish without posting any PR summary or inline comments. Add --comment to the slash command so the workflow actually publishes review feedback.
Useful? React with 👍 / 👎.
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} |
There was a problem hiding this comment.
For pull_request runs opened from forks, GitHub does not pass repository secrets other than GITHUB_TOKEN, so secrets.CLAUDE_CODE_OAUTH_TOKEN is empty and this action has no Claude authentication to use. Because the workflow has no fork guard, external contributor PRs will get a failed Claude Code Review check instead of a skipped review; add an if that excludes forked heads or switch to a carefully scoped pull_request_target pattern.
Useful? React with 👍 / 👎.
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit