Add Claude Code GitHub Actions workflows (#7)

* Add Claude Code GitHub Actions workflows

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: track major-version action tags instead of pinned SHAs

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: drop concurrency limit from the @claude workflow

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jnasbyupgrade

.github/workflows/claude-code-review.yml

@@ -0,0 +1,54 @@
+name: Claude Code Review
+
+# Runs on PRs INTO this repo. We use pull_request_target (not pull_request) so
+# that PRs from a fork can access CLAUDE_CODE_OAUTH_TOKEN — GitHub withholds
+# secrets from `pull_request` runs triggered by forks, which is why the plain
+# `pull_request` version never worked for fork PRs.
+#
+# SECURITY: pull_request_target runs in the BASE repo with secrets and a
+# write-capable token. The job is gated to PRs from the trusted `jnasbyupgrade`
+# fork only — an arbitrary external fork can never trigger this secret-bearing
+# job. The workflow file always comes from the base branch (master), so a PR
+# cannot modify the reviewer that runs on it. We check out the PR head only for
+# read context (persist-credentials: false) and never build or execute PR code.
+on:
+  pull_request_target:
+    types: [opened, synchronize, reopened, ready_for_review]
+
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  claude-review:
+    # Trusted fork only, and skip drafts (don't spend API/CI on unfinished PRs).
+    # To add more trusted owners, extend the head-owner check.
+    if: >-
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.owner.login == 'jnasbyupgrade'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      pull-requests: write   # post the review comments
+      id-token: write
+    steps:
+      - name: Check out PR head (read-only context)
+        # Intentionally tracks the major-version tag (not a pinned SHA) so
+        # upstream fixes are picked up automatically.
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Run Claude Code Review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # NOTE: plugin_marketplaces can't be pinned — it tracks the
+          # marketplace repo's default branch (upstream anthropics/claude-code).
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

.github/workflows/claude.yml

@@ -0,0 +1,46 @@
+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+# No concurrency limit: @claude mentions are independent, read-only requests;
+# serializing would only delay responses and cancelling would drop them.
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        # Intentionally tracks the major-version tag (not a pinned SHA) so
+        # upstream fixes are picked up automatically.
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read