From c1c0418b11684eb418524e03d77afc35a50b16d8 Mon Sep 17 00:00:00 2001 From: DJ Date: Sun, 5 Apr 2026 21:04:40 -0700 Subject: [PATCH 1/3] feat: split Claude workflow into interactive + issue automation jobs Align with org CI standard. The single `claude` job is now split into: - `claude`: interactive mode for PR reviews and @claude mentions - `claude-issue`: automation mode triggered by the `claude` label on issues, with explicit allowed tools, progress tracking, and a structured prompt that implements, opens a PR, self-reviews, checks CI, and notifies owners. Adds `actions: read` and `checks: read` permissions to both jobs. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 57 ++++++++++++++++++++++++++++++++---- 1 file changed, 52 insertions(+), 5 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 42373af6..91a59405 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -1,3 +1,6 @@ +# AI-assisted code review via Claude Code Action on PRs. +# Issue automation: implement, open PR, self-review, check CI, notify maintainer. +# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#4-claude-code-claudeyml name: Claude Code on: @@ -14,6 +17,7 @@ on: permissions: {} jobs: + # Interactive mode: PR reviews and @claude mentions claude: if: >- (github.event_name == 'pull_request' && @@ -23,17 +27,16 @@ jobs: contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && - contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || - (github.event_name == 'issues' && github.event.action == 'labeled' && - github.event.label.name == 'claude') + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) runs-on: ubuntu-latest timeout-minutes: 60 permissions: - # write required for issue-triggered branch creation contents: write id-token: write pull-requests: write issues: write + actions: read + checks: read steps: - name: Checkout repository uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -44,4 +47,48 @@ jobs: uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - label_trigger: 'claude' + additional_permissions: | + actions: read + checks: read + + # Automation mode: issue-triggered work — implement, open PR, review, and notify + claude-issue: + if: >- + github.event_name == 'issues' && github.event.action == 'labeled' && + github.event.label.name == 'claude' + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: write + id-token: write + pull-requests: write + issues: write + actions: read + checks: read + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + fetch-depth: 1 + - name: Run Claude Code + uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89 + with: + claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + label_trigger: "claude" + track_progress: "true" + additional_permissions: | + actions: read + checks: read + claude_args: | + --allowedTools "Bash(gh pr create:*),Bash(gh pr view:*),Bash(gh run view:*),Bash(gh run watch:*),Bash(cat:*),Edit,Write" + prompt: | + Implement a fix for issue #${{ github.event.issue.number }}. + + After implementing: + 1. Create a pull request with a clear title and description. Include "Closes #${{ github.event.issue.number }}" in the PR body. + 2. Self-review your own PR — look for bugs, style issues, missed edge cases, and test gaps. If you find problems, push fixes. + 3. Review all comments and review threads on the PR. For each one: + - If you can address the feedback, make the fix, push, and mark the conversation as resolved. + - If the comment requires human judgment, leave a reply explaining what you need. + 4. Check CI status. If CI fails, read the logs, fix the issues, and push again. Repeat until CI passes. + 5. When CI is green, all actionable review comments are resolved, and the PR is ready, read the CODEOWNERS file and leave a comment tagging the relevant code owners to review and merge. From 22008c2d2184d61c5fb277e580bad28cab00eadf Mon Sep 17 00:00:00 2001 From: DJ Date: Mon, 6 Apr 2026 04:46:10 -0700 Subject: [PATCH 2/3] fix: add concurrency guard and comment tools to claude-issue job - Add concurrency group keyed on issue number to prevent duplicate runs - Add gh pr comment and gh issue comment to allowedTools for review replies, thread resolution, and code owner tagging - Remove Bash(cat:*) since the Read tool already covers file reads Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 91a59405..c26c538f 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -56,6 +56,9 @@ jobs: if: >- github.event_name == 'issues' && github.event.action == 'labeled' && github.event.label.name == 'claude' + concurrency: + group: claude-issue-${{ github.event.issue.number }} + cancel-in-progress: true runs-on: ubuntu-latest timeout-minutes: 60 permissions: @@ -80,7 +83,7 @@ jobs: actions: read checks: read claude_args: | - --allowedTools "Bash(gh pr create:*),Bash(gh pr view:*),Bash(gh run view:*),Bash(gh run watch:*),Bash(cat:*),Edit,Write" + --allowedTools "Bash(gh pr create:*),Bash(gh pr view:*),Bash(gh pr comment:*),Bash(gh issue comment:*),Bash(gh run view:*),Bash(gh run watch:*),Edit,Write" prompt: | Implement a fix for issue #${{ github.event.issue.number }}. From e16d0de33cf15b6addbc8bf5c3b4e21e4158a206 Mon Sep 17 00:00:00 2001 From: DJ Date: Mon, 6 Apr 2026 04:49:13 -0700 Subject: [PATCH 3/3] style: use single quotes for prettier consistency Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index c26c538f..ad10d911 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -77,8 +77,8 @@ jobs: uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89 with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - label_trigger: "claude" - track_progress: "true" + label_trigger: 'claude' + track_progress: 'true' additional_permissions: | actions: read checks: read