Skip to content

Add Claude Code GitHub Workflow #66

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
devondragon merged 2 commits into from
Jan 20, 2026
Merged

Add Claude Code GitHub Workflow #66

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a8a8f50
"Update Claude PR Assistant workflow"
devondragon Jan 20, 2026
492ec4d
"Update Claude Code Review workflow"
devondragon Jan 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 4 additions & 17 deletions .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ name: Claude Code Review

on:
pull_request:
types: [opened, synchronize]
types: [opened, synchronize, ready_for_review, reopened]
Copy link

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The added trigger type 'ready_for_review' will cause the workflow to run when a draft PR is marked as ready for review. However, this workflow also runs on 'opened' and 'synchronize', which means a typical PR flow could trigger multiple redundant reviews: once when opened (if not a draft), again on each push (synchronize), and potentially again when marked ready for review. Consider whether all these triggers are necessary or if this could lead to excessive Claude API usage and duplicate reviews.

Suggested change
types: [opened, synchronize, ready_for_review, reopened]
types: [opened, synchronize, reopened]

Copilot uses AI. Check for mistakes.
# Optional: Only run on specific file changes
# paths:
# - "src/**/*.ts"
Expand Down Expand Up @@ -36,22 +36,9 @@ jobs:
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
prompt: |
REPO: ${{ github.repository }}
PR NUMBER: ${{ github.event.pull_request.number }}

Please review this pull request and provide feedback on:
- Code quality and best practices
- Potential bugs or issues
- Performance considerations
- Security concerns
- Test coverage

Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.

Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.

plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
Comment on lines +39 to +40
Copy link

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removal of claude_args with the allowed-tools specification eliminates explicit control over which bash commands Claude can execute. The previous configuration had granular permissions ('gh issue view', 'gh pr comment', etc.), but the new plugin-based approach doesn't show what tools or permissions the code-review plugin has. This could be a security concern if the plugin has broader permissions than the previous configuration. Consider documenting what permissions the code-review plugin requires and whether this change maintains the same security posture.

Suggested change
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
# Security note:
# - The "code-review@claude-code-plugins" plugin is used only for static code review.
# - It operates via the Claude Code backend using the OAuth token above, with read-only
# access to repository contents, pull request metadata, and issues (see the job
# permissions: contents: read, pull-requests: read, issues: read, id-token: write).
# - This workflow no longer exposes granular "allowed-tools" bash/gh commands directly.
# Instead, the plugin's capabilities are restricted by the Claude Code service and are
# intended to match or be more restrictive than the previous allowed-tools configuration
# (e.g., viewing PRs/issues and posting review comments), without granting arbitrary
# shell or GitHub CLI execution in this runner.
plugins: 'code-review@claude-code-plugins'
# The prompt below invokes the code-review plugin on the target pull request.
# It does not execute local shell commands; all operations are performed by the
# Claude Code service within the permissions described above.

Copilot uses AI. Check for mistakes.
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
Comment on lines +39 to +41
Copy link

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The plugin marketplace URL 'https://github.com/anthropics/claude-code.git' appears to point to a Git repository rather than a plugin marketplace endpoint. The configuration for plugin_marketplaces and plugins fields may not be valid for the claude-code-action@v1. Please verify that this syntax is supported by the action, as the standard documentation for claude-code-action typically doesn't include these fields. If this is a new feature, consider adding a comment explaining the plugin system to help maintainers understand this configuration.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Jan 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The prompt format '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' uses a non-standard syntax that may not be recognized by the claude-code-action. This appears to be attempting to invoke a plugin command, but without documentation or validation that this format is supported, this could cause the workflow to fail. Consider adding inline comments explaining this syntax or verifying this is the correct format for the plugin system.

Suggested change
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
# Instruct Claude (with the code-review plugin) to review the current pull request.
prompt: >
Please run a code review on the pull request at
https://github.com/${{ github.repository }}/pull/${{ github.event.pull_request.number }}.

Copilot uses AI. Check for mistakes.
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options
claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'

Loading