claude-write.yml

name: Claude Code (Write)

# Setup
# 1. Create a dedicated GitHub App and install it only on this repository.
# 2. Grant the App only:
#    - Contents: Read & write
#    - Issues: Read & write
#    - Pull requests: Read & write
# 3. Create a GitHub Actions environment named `claude-automation`.
# 4. Store these environment secrets in `claude-automation`:
#    - APP_ID
#    - APP_PRIVATE_KEY
#    - CLAUDE_CODE_OAUTH_TOKEN
# 5. Create a repository or organization Actions variable:
#    - CLAUDE_APP_LOGIN
#      Set this to the bot login for the GitHub App, usually `<app-slug>[bot]`.
#
# Why this workflow exists separately
# - This is the only workflow that can read the GitHub App private key.
# - It is primarily issue-driven. The only PR path it allows is a follow-up comment
#   on a same-repo PR that was already opened by the Claude GitHub App.
# - Claude uses a short-lived GitHub App installation token, not GITHUB_TOKEN, so
#   PRs opened by Claude trigger normal `pull_request` workflows.
# - A gate job runs before the environment is attached so untrusted events are
#   rejected before the private key is exposed.
# - GitHub exposes the author of an app-created PR as the app's bot login rather
#   than the numeric App ID in the PR payload, so the gate checks `CLAUDE_APP_LOGIN`
#   instead of comparing directly to `APP_ID`.

on:
  issues:
    types: [opened, assigned]
  issue_comment:
    types: [created]

jobs:
  gate:
    name: Gate Issue Trigger
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: read
      pull-requests: read
    outputs:
      should_run: ${{ steps.gate.outputs.should_run }}
      reason: ${{ steps.gate.outputs.reason }}
      checkout_ref: ${{ steps.gate.outputs.checkout_ref }}
    steps:
      - name: Check whether this event is allowed to reach Claude
        id: gate
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
        with:
          github-token: ${{ github.token }}
          script: |
            const sender = context.payload.sender?.login ?? '';
            const senderType = context.payload.sender?.type ?? '';
            const trustedClaudeLogin = process.env.CLAUDE_APP_LOGIN ?? '';

            async function getPermission(username) {
              try {
                const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  username,
                });
                return data.permission;
              } catch (error) {
                if (error.status === 404) {
                  return 'none';
                }
                throw error;
              }
            }

            let mentioned = false;
            let reason = '';
            let checkoutRef = context.payload.repository?.default_branch ?? '';

            if (context.eventName === 'issues') {
              const title = context.payload.issue?.title ?? '';
              const body = context.payload.issue?.body ?? '';
              mentioned = title.includes('@claude') || body.includes('@claude');
            } else if (context.eventName === 'issue_comment') {
              const body = context.payload.comment?.body ?? '';
              mentioned = body.includes('@claude');

              if (context.payload.issue?.pull_request) {
                const response = await github.rest.pulls.get({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  pull_number: context.payload.issue.number,
                });
                const pr = response.data;

                checkoutRef = pr.head.sha;

                const headRepo = pr.head.repo;
                const isFork = !headRepo || headRepo.fork || headRepo.full_name !== `${context.repo.owner}/${context.repo.repo}`;
                if (isFork) {
                  reason = 'fork_pr_refused';
                } else if (!trustedClaudeLogin) {
                  reason = 'missing_claude_app_login';
                } else if ((pr.user?.login ?? '') !== trustedClaudeLogin) {
                  reason = 'pr_not_owned_by_claude_app';
                }

                if (!reason) {
                  const files = await github.paginate(github.rest.pulls.listFiles, {
                    owner: context.repo.owner,
                    repo: context.repo.repo,
                    pull_number: context.payload.issue.number,
                    per_page: 100,
                  });
                  // Refuse workflow changes so write-capable automation never acts on
                  // `.github/` modifications from the same pull request.
                  if (files.some(f => f.filename.startsWith('.github/'))) {
                    reason = 'modifies_github_dir';
                  }
                }
              }
            }

            if (!reason && !mentioned) {
              reason = 'not_mentioned';
            }

            if (!reason && senderType === 'Bot') {
              reason = 'bot_sender_refused';
            }

            if (!reason) {
              const permission = await getPermission(sender);
              core.setOutput('actor_permission', permission);
              if (!['admin', 'maintain', 'write'].includes(permission)) {
                reason = 'actor_lacks_write';
              }
            }

            core.setOutput('checkout_ref', checkoutRef);
            core.setOutput('should_run', !reason ? 'true' : 'false');
            core.setOutput('reason', reason || 'allowed');
        env:
          CLAUDE_APP_LOGIN: ${{ vars.CLAUDE_APP_LOGIN }}

  claude:
    name: Run Claude Code
    needs: gate
    if: needs.gate.outputs.should_run == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    concurrency:
      group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }}
      cancel-in-progress: true

    environment:
      # The App private key lives only in this environment so only this single job
      # can mint a GitHub App installation token.
      name: claude-automation
      deployment: false

    permissions:
      contents: read
      issues: read
      pull-requests: read
      actions: read
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6
        with:
          ref: ${{ needs.gate.outputs.checkout_ref }}
          fetch-depth: 0
          # Do not leave the built-in GITHUB_TOKEN in git config. Claude should use
          # only the GitHub App token generated below so its PRs trigger CI normally.
          persist-credentials: false

      - name: Generate short-lived GitHub App token
        id: app-token
        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          permission-contents: write
          permission-issues: write
          permission-pull-requests: write

      - name: Setup Rust toolchain
        uses: ./.github/actions/setup-rust
        with:
          enable-sccache: "false"

      - name: Install uv
        uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63  # 0.18.6
        with:
          sync: false

      - name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@fbda2eb1bdc90d319b8d853f5deb53bca199a7c1  # v1.0.140
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          github_token: ${{ steps.app-token.outputs.token }}

          # Claude may inspect CI state on related PRs, but this workflow is otherwise
          # issue-driven and is the only place with write-capable GitHub credentials.
          additional_permissions: |
            actions: read

          claude_args: |
            --model claude-opus-4-8
            --allowedTools "Bash(cargo nextest:*),Bash(cargo check:*),Bash(cargo clippy:*),Bash(cargo fmt:*),Bash(uv run:*)"
            --system-prompt "You are the repository's write-capable Claude workflow. You run only from trusted issue traffic and from trusted PR conversation comments on same-repo pull requests that were previously opened by the repository's Claude GitHub App. Create or update branches and pull requests using the provided GitHub App token. Do not use fork pull request content because those runs are blocked before this job starts."

      - name: Open pull request for issue branch
        if: ${{ steps.claude.outputs.branch_name != '' && !github.event.issue.pull_request }}
        env:
          GH_TOKEN: ${{ steps.app-token.outputs.token }}
          REPO: ${{ github.repository }}
          BASE_BRANCH: ${{ github.event.repository.default_branch }}
          BRANCH_NAME: ${{ steps.claude.outputs.branch_name }}
          PR_TITLE: ${{ github.event.issue.title }}
          PR_BODY: |
            Fixes #${{ github.event.issue.number }}

            Generated with Claude Code.

            [View Claude run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
        run: |
          commits_ahead="$(
            gh api \
              "repos/$REPO/compare/$BASE_BRANCH...$BRANCH_NAME" \
              --jq .ahead_by 2>/dev/null || echo 0
          )"

          if [[ "$commits_ahead" == "0" ]]; then
            echo "Branch has no commits ahead of $BASE_BRANCH; skipping PR creation."
            exit 0
          fi

          existing_pr="$(
            gh pr list \
              --repo "$REPO" \
              --head "$BRANCH_NAME" \
              --state all \
              --json url \
              --jq '.[0].url // ""'
          )"

          if [[ -n "$existing_pr" ]]; then
            echo "Pull request already exists: $existing_pr"
            exit 0
          fi

          pr_url="$(
            gh pr create \
              --repo "$REPO" \
              --base "$BASE_BRANCH" \
              --head "$BRANCH_NAME" \
              --title "$PR_TITLE" \
              --body "$PR_BODY"
          )"
          echo "Created pull request: $pr_url"