Skip to content

ci: dogfood git-mind suggest action with Claude CLI #294

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
flyingrobots wants to merge 2 commits into from
Closed

ci: dogfood git-mind suggest action with Claude CLI #294

Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cbf4b9d
ci: add gitmind-suggest workflow for PR review dogfooding (#293)
flyingrobots Feb 24, 2026
561c33b
feat: replace post-commit hook with pre-push hook for directives + su…
flyingrobots Feb 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 64 additions & 0 deletions .github/workflows/gitmind-suggest.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,64 @@
name: git-mind Suggest

on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review]
branches: [main]

concurrency:
group: gitmind-suggest-${{ github.event.pull_request.number }}
cancel-in-progress: true

permissions:
contents: read
pull-requests: write

jobs:
suggest:
if: >
!github.event.pull_request.draft &&
github.actor != 'dependabot[bot]'
Comment on lines +18 to +20

@coderabbitai coderabbitai Bot Feb 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick | 🔵 Trivial

Bot guard only excludes dependabot[bot] — other automation actors will consume API quota.

renovate[bot], github-actions[bot], and custom bots are not excluded. Unless intentional, tighten the guard.

🤖 Proposed fix 
     if: >
       !github.event.pull_request.draft &&
-      github.actor != 'dependabot[bot]'
+      github.actor != 'dependabot[bot]' &&
+      !endsWith(github.actor, '[bot]')
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
if: >
!github.event.pull_request.draft &&
github.actor != 'dependabot[bot]'
if: >
!github.event.pull_request.draft &&
github.actor != 'dependabot[bot]' &&
!endsWith(github.actor, '[bot]')
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gitmind-suggest.yml around lines 18 - 20, The current
GitHub Actions workflow if condition only excludes 'dependabot[bot]' which
allows other automation actors to trigger the job and consume API quota; update
the if condition used in the workflow (the if: > block) to also exclude known
automation actors such as 'renovate[bot]' and 'github-actions[bot]' (and any
organization-specific bot names you use) alongside 'dependabot[bot]' so that
those actors are skipped when evaluating the job run.

🧹 Nitpick | 🔵 Trivial

Bot guard only excludes dependabot[bot] — other automation actors will consume API credits.

renovate[bot], github-actions[bot], and any custom bot actors are not excluded. Unless intentional, add a broader guard.

🤖 Proposed fix 
     if: >
       !github.event.pull_request.draft &&
-      github.actor != 'dependabot[bot]'
+      github.actor != 'dependabot[bot]' &&
+      github.actor != 'renovate[bot]' &&
+      !endsWith(github.actor, '[bot]')
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gitmind-suggest.yml around lines 18 - 20, The workflow
currently only excludes 'dependabot[bot]'; update the if conditional in the
gitmind-suggest.yml workflow (the "if:" expression) to broadly exclude bot
actors by replacing or extending the github.actor check with a suffix test such
as !endsWith(github.actor, '[bot]') (e.g. use "!github.event.pull_request.draft
&& !endsWith(github.actor, '[bot]')") so renovate[bot], github-actions[bot], and
other bot actors are skipped as well.

runs-on: ubuntu-latest
continue-on-error: true
Comment on lines +21 to +22

@chatgpt-codex-connector chatgpt-codex-connector Bot May 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Surface failures from the suggest job

Because the whole job is marked continue-on-error, failures in checkout, dependency installation, Claude CLI installation, git-mind suggest, or comment posting still leave the PR check successful. If this is intended as a usable dogfood signal, broken automation will be hidden from reviewers; either let the job fail or emit a durable failure status/comment while keeping the advisory behavior explicit.

Useful? React with 👍 / 👎.


steps:
- name: Check for API key
id: check-key
env:
HAS_KEY: ${{ secrets.ANTHROPIC_API_KEY != '' }}
run: |
if [ "$HAS_KEY" != "true" ]; then
echo "::notice::ANTHROPIC_API_KEY not configured — skipping suggest"
echo "skip=true" >> "$GITHUB_OUTPUT"
else
echo "skip=false" >> "$GITHUB_OUTPUT"
fi

- name: Checkout
if: steps.check-key.outputs.skip != 'true'
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Setup Node.js
if: steps.check-key.outputs.skip != 'true'
uses: actions/setup-node@v4
with:
node-version: '22'
cache: 'npm'

- name: Install dependencies
if: steps.check-key.outputs.skip != 'true'
run: npm ci

- name: Install Claude CLI
if: steps.check-key.outputs.skip != 'true'
run: npm install -g @anthropic-ai/claude-code
Comment on lines +54 to +56

@coderabbitai coderabbitai Bot Feb 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

@anthropic-ai/claude-code npm package latest version

💡 Result:

The latest published version of @anthropic-ai/claude-code on npm is 1.0.108. [1]

Source: npm package “Versions” tab shows Version 1.0.108 and “Last publish 5 hours ago.” [1]

References

  1. @anthropic-ai/claude-code (npm, versions tab)

Pin @anthropic-ai/claude-code to an exact version; unpinned global installs are indefensible.

Line 56: npm install -g @anthropic-ai/claude-code`` fetches whatever the registry serves on the next run. One semver bump (malicious or accidental) and your workflow executes unknown code with ANTHROPIC_API_KEY access. No audit trail, no rollback, silent failure. Current stable is `1.0.108` — pin it and let Dependabot handle updates.

Fix 
-        run: npm install -g `@anthropic-ai/claude-code`
+        run: npm install -g `@anthropic-ai/claude-code`@1.0.108
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
- name: Install Claude CLI
if: steps.check-key.outputs.skip != 'true'
run: npm install -g @anthropic-ai/claude-code
- name: Install Claude CLI
if: steps.check-key.outputs.skip != 'true'
run: npm install -g `@anthropic-ai/claude-code`@1.0.108
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gitmind-suggest.yml around lines 54 - 56, The workflow
currently installs `@anthropic-ai/claude-code` without a fixed version; update the
install step so the global npm install pins the package to the exact safe
version (e.g., change the command that currently reads npm install -g
`@anthropic-ai/claude-code` to install the exact release, such as npm install -g
`@anthropic-ai/claude-code`@1.0.108) to prevent unintentionally running unvetted
code and allow Dependabot to manage future updates.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Anthropic Claude CLI npm deprecated official documentation

💡 Result:

Anthropic’s official Claude Code (Claude CLI) docs state that “NPM installation is deprecated” and recommend using the native installation method instead; to migrate an existing npm install to native, run claude install. The same page still shows the legacy command npm install -g @anthropic-ai/claude-code`` under “NPM installation (deprecated)”. [1]

Recent Claude CLI release notes also mention an added deprecation notification for npm installations, pointing users to run claude install and to the same “getting started” documentation page. [2]

Sources:
[1] Anthropic Claude Code Docs – “Set up Claude Code” → “NPM installation (deprecated)”
[2] Claude CLI Release Notes (notes referencing npm-install deprecation notice)

🌐 Web query:

@anthropic-ai/claude-code npm package latest version

💡 Result:

The latest published version of the @anthropic-ai/claude-code npm package is 1.0.108 (last published ~5 hours ago). [1]

Source: npm package “Versions” tab. [1]

🌐 Web query:

Anthropic Claude CLI native installer setup github

💡 Result:

  • Official GitHub repo (Claude Code CLI): anthropics/claude-code (README includes install commands and project details). [1]
  • Native (binary) installer setup (Beta): Anthropic’s official setup docs recommend installing via the hosted installer scripts (not a GitHub “native installer” release asset): [2]
    • macOS / Linux / WSL: curl -fsSL https://claude.ai/install.sh | bash
    • Windows (PowerShell): irm https://claude.ai/install.ps1 | iex
    • You can also pin a version (e.g., ... | bash -s 1.0.58) and, if you already have Claude Code installed, start native install via claude install. [2]
  • Alternative install path (Node): npm install -g @anthropic-ai/claude-code`` (also documented in the repo + docs). [1][2]

🌐 Web query:

Claude CLI binary path installation $HOME/.claude/bin official documentation

💡 Result:

Anthropic’s official Claude Code docs do not state that the CLI binary installs to $HOME/.claude/bin. In the official docs, ~/.claude/ is used for Claude Code’s user configuration, while the claude executable comes from your install method. (docs.anthropic.com)

Official install methods & where the claude binary comes from:

  • Global npm install (standard):

    • Install: npm install -g @anthropic-ai/claude-code`` (docs.anthropic.com)
    • Binary path is your global npm “bin” directory (varies by system). To see the exact location: 
      which claude
npm prefix -g
ls -l "$(npm prefix -g)/bin/claude"

  • Native binary install (beta):

    • Install via the official script (macOS/Linux/WSL): curl -fsSL https://claude.ai/install.sh | bash (docs.anthropic.com)
    • After install, Anthropic recommends running: 
      claude doctor
      to verify the installation type/version. (docs.anthropic.com)

Citations:

npm install -g @anthropic-ai/claude-code`` is deprecated AND unpinned — this step will break.

"Installation via npm is deprecated. Use one of the recommended methods below." Anthropic's official documentation and release notes are explicit about this. The package itself now ships with a deprecation notification for npm installations.

Beyond deprecation, the install is unpinned — every run silently picks up whatever the registry serves, with no auditability or rollback path if a breaking release lands.

🚑 Proposed fix — switch to the native installer at the current version 
      - name: Install Claude CLI
        if: steps.check-key.outputs.skip != 'true'
-       run: npm install -g `@anthropic-ai/claude-code`
+       run: curl -fsSL https://claude.ai/install.sh | bash -s 1.0.108

(The proposed fix in the original comment uses an incorrect version number 2.1.52 and malformed syntax --version; the correct native installer syntax is bash -s VERSION where VERSION is the pinned release like 1.0.108.)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/gitmind-suggest.yml around lines 54 - 56, Replace the
deprecated and unpinned npm installation in the "Install Claude CLI" step
(currently using `npm install -g `@anthropic-ai/claude-code``) with the native
installer and pin to a known stable release; specifically, remove the npm
command and invoke the native installer with the correct syntax `bash -s
VERSION`, using a pinned VERSION (for example `1.0.108`) instead of `--version`
so the workflow installs a fixed, auditable Claude CLI release.

Comment on lines +54 to +56

@chatgpt-codex-connector chatgpt-codex-connector Bot May 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pin the Claude CLI version

Installing @anthropic-ai/claude-code without a version makes every PR run depend on whatever package version is latest at that moment. A future CLI release can break old commits or change suggestion behavior without any repository change, so pin this tool or manage it through a lockfile-controlled dependency.

Useful? React with 👍 / 👎.


- name: Run git-mind suggest
if: steps.check-key.outputs.skip != 'true'
uses: ./
with:
agent: 'claude -p --output-format json'
env:
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
Comment on lines +60 to +64

@chatgpt-codex-connector chatgpt-codex-connector Bot Feb 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Run trusted action code when exposing repository secrets

This step executes the local action from the PR checkout (uses: ./) while injecting ANTHROPIC_API_KEY, and on pull_request events that action code is sourced from the PR head. A contributor can modify action.yml or scripts it runs (including npm ci lifecycle hooks in the composite action) to exfiltrate the secret during CI, so this workflow should run trusted code from the base branch when secrets are present (for example via pull_request_target + trusted checkout) or avoid passing secrets to PR-head code.

Useful? React with 👍 / 👎.

Comment on lines +58 to +64

@chatgpt-codex-connector chatgpt-codex-connector Bot May 31, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid running PR code with repository secrets

For same-repository PRs, this job checks out the PR contents and then executes the local action from that checkout while exposing ANTHROPIC_API_KEY and a pull-requests: write token. A contributor branch can modify action.yml, package.json scripts, or files invoked by the action so the secret-bearing job runs attacker-controlled repository code; run the secret-bearing logic from trusted/pinned code or gate it behind an explicit trusted trigger.

Useful? React with 👍 / 👎.

Loading