Add Claude Code GitHub Workflow

[shdwmtr]

No description provided.

[shdwmtr]

@claude review this

[claude]

Claude finished @shdwmtr's task in 37s —— View job

---

Claude Code Workflow Review

• Gather context
• Read workflow files
• Provide review feedback

---

This PR adds two workflow files to integrate Claude Code into the repository. The PR is already merged — this review is informational.

claude.yml — On-demand Claude interactions

Issues:

1. Missing write permissions (claude.yml:22-26): Claude needs pull-requests: write and issues: write to post comments in response to @claude mentions. Without these, the action will fail to write its responses. This explains why this very workflow run needed special handling.

   permissions:
     contents: write       # needed if Claude pushes changes
     pull-requests: write  # needed to post PR comments
     issues: write         # needed to post issue comments
     id-token: write
     actions: read

2. Redundant actions: read (claude.yml:25 and claude.yml:40-41): actions: read appears in both the permissions block and the additional_permissions input. The latter is redundant — the GitHub token already gets the permission from the permissions block.

---

claude-code-review.yml — Automatic PR review

Issues:

1. Missing write permissions (claude-code-review.yml:22-27): Same problem as above — Claude needs pull-requests: write to post review comments. Currently only has read permissions.

2. code-review plugin dependency (claude-code-review.yml:39-40): This workflow pulls a plugin from an external marketplace (https://github.com/anthropics/claude-code.git) via plugins: 'code-review@claude-code-plugins'. This is a supply chain risk — if that repository or branch is compromised or removed, the workflow breaks or worse, runs malicious code. Consider pinning to a specific commit SHA rather than a mutable branch reference, or verify this is an official/trusted Anthropic source.

3. fetch-depth: 1 (claude-code-review.yml:32-33): Shallow clone may cause issues if Claude needs to compare the PR diff against a base that isn't the immediate parent. For most PRs this is fine, but it can cause git diff failures on PRs with many commits. Consider fetch-depth: 0 for review workflows.

---

Summary

The primary actionable issue is missing write permissions on both workflows — the Claude action cannot post comments without pull-requests: write and issues: write. These should be patched.

[ArjixWasTaken]

@claude review this

Edit: looks like it only runs for those with write access, good