ci: fix Claude auto-review auth (use github_token, skip OIDC exchange) #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code Review | |
| # Runs on PRs INTO this repo. We use pull_request_target (not pull_request) so | |
| # that PRs from a fork can access CLAUDE_CODE_OAUTH_TOKEN — GitHub withholds | |
| # secrets from `pull_request` runs triggered by forks, which is why the plain | |
| # `pull_request` version never worked for fork PRs. | |
| # | |
| # SECURITY: pull_request_target runs in the BASE repo with secrets and a | |
| # write-capable token. The job is gated to PRs from the trusted `jnasbyupgrade` | |
| # fork only — an arbitrary external fork can never trigger this secret-bearing | |
| # job. The workflow file always comes from the base branch (master), so a PR | |
| # cannot modify the reviewer that runs on it. We check out the PR head only for | |
| # read context (persist-credentials: false) and never build or execute PR code. | |
| on: | |
| pull_request_target: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| concurrency: | |
| group: claude-review-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| jobs: | |
| claude-review: | |
| # Trusted fork only, and skip drafts (don't spend API/CI on unfinished PRs). | |
| # To add more trusted owners, extend the head-owner check. | |
| if: >- | |
| github.event.pull_request.draft == false && | |
| github.event.pull_request.head.repo.owner.login == 'jnasbyupgrade' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| pull-requests: write # post the review comments | |
| steps: | |
| - name: Check out PR head (read-only context) | |
| # Intentionally tracks the major-version tag (not a pinned SHA) so | |
| # upstream fixes are picked up automatically. | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| - name: Run Claude Code Review | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # Provide github_token so the action uses it directly for GitHub API | |
| # calls instead of the OIDC->GitHub-App-token exchange, which 401s under | |
| # pull_request_target. GITHUB_TOKEN is repo/workflow-scoped (independent | |
| # of the actor's role) and has pull-requests: write here. | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| # NOTE: plugin_marketplaces can't be pinned — it tracks the | |
| # marketplace repo's default branch (upstream anthropics/claude-code). | |
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | |
| plugins: 'code-review@claude-code-plugins' | |
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |