Add Claude Code GitHub Workflow

[johnlindquist]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Summary by CodeRabbit

• Chores
  • Added GitHub Actions workflows for AI-assisted code reviews on pull requests.
  • Enabled on-demand AI responses when mentioning @claude in issues and PR discussions.
  • Configured permissions, secrets, and structured prompts to guide reviews and comments.
  • Improved CI automation without impacting the app’s runtime behavior.

[coderabbitai]

Caution

Review failed

The pull request is closed.

Walkthrough

Adds two GitHub Actions workflows to run the Claude Code Review/Code actions: one auto-reviews pull requests on open/sync with a structured prompt; another listens for @claude mentions and selected issue/PR events to invoke the action. Both set permissions, check out the repo, and run anthropics/claude-code-action@v1 using a secret token.

Changes

Cohort / File(s)	Summary
GitHub Actions: PR auto review .github/workflows/claude-code-review.yml	New workflow “Claude Code Review” triggered on pull_request opened/synchronize. Checks out code, runs anthropics/claude-code-action@v1 with a detailed review prompt and claude_args, posts review via gh pr comment. Sets read permissions for contents/pull-requests/issues and write for id-token.
GitHub Actions: on-demand mentions and issue/PR events .github/workflows/claude.yml	New workflow triggering on @claude mentions in comments/reviews and on selected issue/PR events. Grants required permissions (contents, pull-requests, issues, id-token, actions). Checks out code and runs anthropics/claude-code-action@v1 with a CLAUDE OAuth token. Includes optional commented configurations.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub (PR)
  participant GHA as GitHub Actions
  participant Repo as Repo Checkout
  participant Claude as claude-code-action@v1
  participant API as GitHub API

  Dev->>GH: Open/Synchronize Pull Request
  GH-->>GHA: Trigger workflow (claude-code-review.yml)
  GHA->>Repo: actions/checkout
  GHA->>Claude: Run with token, prompt, claude_args
  Claude->>API: gh pr comment (post review)
  API-->>Dev: Review comment visible on PR

Loading

sequenceDiagram
  autonumber
  actor User as User
  participant GH as GitHub (Issues/PRs)
  participant GHA as GitHub Actions
  participant Repo as Repo Checkout
  participant Claude as claude-code-action@v1
  participant API as GitHub API

  User->>GH: Comment with @claude / Open/Assign Issue or PR Review
  GH-->>GHA: Trigger workflow (claude.yml)
  GHA->>Repo: actions/checkout
  GHA->>Claude: Run with OAuth token
  Claude->>API: Create comment/response via GitHub CLI
  API-->>User: Bot response posted

Loading

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Poem

I twitch my ears at every PR flight,
Summoned by mentions in the moonlit night.
With checkout hops and tokens tight,
I nibble through diffs, set comments right—
A Claude-coded rabbit, reviewing by byte. 🐇✨

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch add-claude-github-actions-1759683826452

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between f71eca0 and 1598ca8.

📒 Files selected for processing (2)

• .github/workflows/claude-code-review.yml (1 hunks)
• .github/workflows/claude.yml (1 hunks)

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Code Review: Claude Code GitHub Workflow

Thank you for adding Claude Code integration! This is a well-structured PR that adds valuable AI assistance capabilities. Here's my detailed review:

✅ Strengths

1. Clear separation of concerns: Two workflows with distinct purposes

   • claude.yml: Interactive @claude mentions
   • claude-code-review.yml: Automated PR reviews

2. Good security practices:

   • Proper use of CLAUDE_CODE_OAUTH_TOKEN secret
   • Appropriate permissions scoping (contents: read, pull-requests: read, etc.)
   • id-token: write for OIDC authentication

3. Well-documented: Excellent PR description explaining the feature, security implications, and next steps

4. Follows existing patterns: Consistent with the repository's release.yml workflow style

---

🔍 Code Quality & Best Practices

claude.yml (.github/workflows/claude.yml:1-50)

• ✅ Comprehensive trigger events covering all comment types
• ✅ Smart conditional logic to detect @claude mentions
• ✅ fetch-depth: 1 is appropriate for shallow clones (matches release.yml)
• ⚠️ Minor: The additional_permissions section (lines 39-40) uses literal string formatting which works but could be simplified

claude-code-review.yml (.github/workflows/claude-code-review.yml:1-57)

• ✅ Triggers on relevant PR events (opened, synchronize)
• ✅ Helpful commented examples for filtering by paths and authors
• ✅ Clear, actionable prompt for code reviews
• ⚠️ Consideration: Currently runs on ALL PRs - consider if this is desired or if filtering would be beneficial

---

🐛 Potential Issues

1. Resource usage (claude-code-review.yml:21)

   • Running automated reviews on every PR could consume API credits quickly
   • Suggestion: Consider uncommenting the author filter to limit to specific contributors or first-time contributors

2. Workflow trigger optimization (claude.yml:6-10)

   • pull_request_review: [submitted] might trigger on approve/request changes/comment reviews
   • Verify: Ensure this doesn't create duplicate runs when combined with pull_request_review_comment

3. Missing error handling

   • No explicit handling if Claude Code action fails
   • Suggestion: Consider adding a failure notification or status check

---

⚡ Performance Considerations

1. checkout@v4 usage: Good choice, consistent with release.yml
2. fetch-depth: 1: Optimal for this use case (shallow clone)
3. Concurrent workflow runs: Multiple @claude mentions could trigger parallel runs - this is likely fine but monitor for rate limiting

---

🔒 Security Concerns

1. ✅ Secrets management: Properly using GitHub secrets

2. ✅ Permission scoping: Minimal permissions granted (read-only access)

3. ⚠️ Tool restrictions:

   • claude.yml has NO allowed_tools restriction (line 48-49 commented)
   • claude-code-review.yml restricts to gh commands only (line 56)
   • Recommendation: Add allowed_tools restriction to claude.yml for consistency

4. ✅ Write access requirement: Correctly noted that only users with write access can trigger workflows (prevents abuse)

---

🧪 Test Coverage

• ⚠️ No tests included: This is acceptable for workflow files, but consider:
  • Manual testing plan after merge
  • Documentation of expected behavior
  • Monitoring strategy for the first few runs

---

📋 Recommendations

High Priority

1. Add allowed_tools restriction to claude.yml (security)
2. Document expected API usage costs (for budget planning)

Medium Priority

3. Consider adding workflow status notifications on failure
4. Add path filters or author filters to claude-code-review.yml to control costs
5. Verify that pull_request_review and pull_request_review_comment don't create duplicate triggers

Low Priority

6. Consider adding a rate limit check or cooldown period
7. Document expected response time for @claude mentions

---

✨ Overall Assessment

Verdict: ✅ Approve with minor suggestions

This is a high-quality PR that follows best practices and adds valuable functionality. The workflows are well-structured, secure, and properly documented. The minor issues identified are primarily around cost optimization and security hardening, which can be addressed in follow-up PRs if needed.

Suggested merge strategy:

1. Merge as-is if you're comfortable with current API usage expectations
2. OR address the high-priority security recommendation (adding allowed_tools to claude.yml) before merging

Great work! 🎉

[github-actions]

🎉 This PR is included in version 2.8.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀