Add Claude Code GitHub Workflow

[thomhurst]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[greptile-apps]

Greptile Summary

This PR adds Claude Code automation to GitHub Actions. The main changes are:

• Automatic Claude reviews for pull-request updates.
• Mention-driven Claude tasks in issues, comments, and reviews.
• Read access to repository, pull-request, issue, and CI data.

Confidence Score: 4/5

The workflows need fixes for fork authentication, GitHub write permissions, and pull-request checkout selection before merging.

• Fork pull-request reviews start without the required OAuth secret.
• Both workflows can be unable to publish Claude's response.
• Interactive PR requests can operate on the default branch instead of the PR revision.

.github/workflows/claude-code-review.yml and .github/workflows/claude.yml

Important Files Changed

Filename	Overview
.github/workflows/claude-code-review.yml	Adds automatic PR reviews, but fork events cannot access the OAuth secret and the token cannot publish review results.
.github/workflows/claude.yml	Adds mention-driven tasks, but replies lack write permission and PR discussion events check out the default branch.

_{Reviews (1): Last reviewed commit: ""Claude Code Review workflow"" | Re-trigger Greptile}

[greptile-apps]

Fork Reviews Lack Authentication

A fork pull request reaches this job, but GitHub withholds CLAUDE_CODE_OAUTH_TOKEN from pull_request workflows triggered by forks. Opening, updating, reopening, or marking such a PR ready therefore starts a review that cannot authenticate.

Suggested change

	jobs:
	claude-review:
	# Optional: Filter by PR author
	jobs:
	claude-review:
	if: github.event.pull_request.head.repo.full_name == github.repository
	# Optional: Filter by PR author

[greptile-apps]

Review Token Cannot Publish Findings

The action falls back to github.token, but this job grants only read access to pull requests and issues. When the review finds a problem, GitHub rejects creation of its review or comment, so the workflow cannot publish its result.

Suggested change

	pull-requests: read
	issues: read
	pull-requests: write
	issues: write

[greptile-apps]

Interactive Replies Are Read-Only

The action uses github.token by default, while this job grants read-only issue and pull-request scopes. A valid @claude request can run Claude but receive a GitHub API authorization error when the action tries to post its reply.

Suggested change

	contents: read
	pull-requests: read
	issues: read
	contents: read
	pull-requests: write
	issues: write

[greptile-apps]

PR Requests Check Out Main

For issue_comment, pull_request_review_comment, and pull_request_review events, the default checkout ref is the repository's default branch rather than the pull request head. An @claude request about changed code can therefore inspect or modify the wrong revision and return an answer that omits the PR changes.