Add claude GitHub actions 1752454958200 #3
Conversation
WalkthroughTwo new GitHub Actions workflow files are added: one for automated code review using Claude on pull requests, and another to trigger Claude in response to "@claude" mentions in issues, comments, and reviews. Both workflows leverage the "anthropics/claude-code-action@beta" action and provide optional customization parameters. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub User
participant GitHub Actions
participant Claude Code Action
GitHub User->>GitHub Actions: Open PR or synchronize PR
GitHub Actions->>Claude Code Action: Trigger code review workflow
Claude Code Action->>GitHub Actions: Analyze PR, post review comments
GitHub User->>GitHub Actions: Comment/issue/review with "@claude"
GitHub Actions->>Claude Code Action: Trigger on "@claude" mention
Claude Code Action->>GitHub Actions: Respond/analyze as configured
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Claude finished @webdevtodayjason's task —— View job PR Code Review Complete ✅I've thoroughly reviewed both GitHub Actions workflow files. Here's my comprehensive analysis: Tasks:
🔍 Code Review FindingsSecurity Assessment: ✅ GoodPositive Security Practices:
Security Recommendations:
Best Practices Assessment: ✅ ExcellentStrong Points:
Minor Suggestions:
Configuration Quality: ✅ Very Goodclaude-code-review.yml (
claude.yml (
Potential Issues:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (3)
.github/workflows/claude.yml (1)
40-64: Strip trailing whitespace – YAML-lint currently failsYAML-lint reports trailing-space errors on these commented/blank lines.
While GitHub Actions ignores them, keeping the file lint-clean avoids red CI lights in upstream tooling.- actions: read␠ + actions: read … - # model: "claude-opus-4-20250514"␠ + # model: "claude-opus-4-20250514" … - # trigger_phrase: "/claude"␠ + # trigger_phrase: "/claude" … - # assignee_trigger: "claude-bot"␠ + # assignee_trigger: "claude-bot" … - # allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"␠ + # allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)" … - # Use TypeScript for new files␠ + # Use TypeScript for new files.github/workflows/claude-code-review.yml (2)
40-56: YAML-lint trailing-space warningsMultiple comment lines carry stray spaces, causing lint noise. Removing them keeps the repo tidy and prevents false-positive CI failures.
- # model: "claude-opus-4-20250514"␠ + # model: "claude-opus-4-20250514" … - # use_sticky_comment: true␠ + # use_sticky_comment: true
28-33: Optional: addconcurrencygrouping to avoid duplicate reviewsA force-push triggers the
synchronizeevent and can queue several concurrent runs for the same PR.
Adding a concurrency block keeps only the latest review, reducing noise and compute:concurrency: group: pr-${{ github.event.pull_request.number }} cancel-in-progress: true
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml(1 hunks).github/workflows/claude.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/claude-code-review.yml
[error] 20-20: trailing spaces
(trailing-spaces)
[error] 27-27: trailing spaces
(trailing-spaces)
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 73-73: trailing spaces
(trailing-spaces)
[warning] 78-78: too many blank lines (1 > 0)
(empty-lines)
.github/workflows/claude.yml
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 48-48: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 54-54: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[warning] 64-64: too many blank lines (1 > 0)
(empty-lines)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: claude-review
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
Guard against empty review.body to avoid expression failures
pull_request_review events generated by the GitHub UI can have an empty review.body when the reviewer only submits an approval/request-changes without writing text.
contains(github.event.review.body, '@claude') will then evaluate against null and the expression engine raises a runtime error, aborting the job.
- (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+ (github.event_name == 'pull_request_review' && contains(github.event.review.body || '', '@claude')) ||Adding the || '' fallback keeps the expression robust.
📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| if: | | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| runs-on: ubuntu-latest | |
| if: | | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body || '', '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| runs-on: ubuntu-latest |
🤖 Prompt for AI Agents
In .github/workflows/claude.yml around lines 15 to 20, the condition checking
for '@claude' in pull_request_review events can fail if review.body is empty or
null. To fix this, modify the expression to use a fallback empty string by
replacing contains(github.event.review.body, '@claude') with
contains(github.event.review.body || '', '@claude') to prevent runtime errors
when review.body is missing.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs |
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Re-verify the need for id-token: write
anthropics/claude-code-action@beta performs only REST-API calls and does not request an OIDC token (checked in the action source). Granting id-token: write therefore unnecessarily broadens the token surface.
Unless you have an internal fork that consumes OIDC, drop this permission:
- id-token: write#!/bin/bash
set -euo pipefail
echo "🔍 Fetching Claude action source (beta)…"
curl -sSL https://github.com/anthropics/claude-code-action/beta/dist/index.js -o /tmp/claude-dist.js
echo "🔎 Checking for OIDC/GetIDToken usage in dist/index.js"
grep -R -n "getIDToken" /tmp/claude-dist.js || echo "✔️ No getIDToken calls found"
echo "🔎 Checking for oidcToken references in dist/index.js"
grep -R -n "oidcToken" /tmp/claude-dist.js || echo "✔️ No oidcToken references"
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "🔍 Fetching anthopics/claude-code-action@beta dist/index.js…"
curl -sSL https://github.com/anthropics/claude-code-action/beta/dist/index.js -o /tmp/claude-dist.js
echo "🔎 Searching for getIDToken references…"
grep -n "getIDToken" /tmp/claude-dist.js || echo "✔️ No getIDToken references found"
echo "🔎 Searching for oidcToken references…"
grep -n "oidcToken" /tmp/claude-dist.js || echo "✔️ No oidcToken references found"Length of output: 677
Drop unnecessary id-token: write permission
After inspecting anthropics/claude-code-action@beta’s compiled source (no getIDToken or oidcToken usage), the action doesn’t request an OIDC token. You can safely remove the extra permission to tighten security.
• File: .github/workflows/claude.yml (lines 21–26)
• Remove this line:
- id-token: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| actions: read # Required for Claude to read CI results on PRs |
🤖 Prompt for AI Agents
In .github/workflows/claude.yml between lines 21 and 26, remove the line
granting `id-token: write` permission as it is unnecessary for the
`anthropics/claude-code-action@beta` action. This will tighten security by
limiting permissions to only those required.
|
|
||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
|
|
There was a problem hiding this comment.
💡 Verification agent
🧩 Analysis chain
Same permission concern – confirm id-token: write necessity
As with the other workflow, the action does not currently exchange an OIDC token.
Consider removing the line to follow the principle of least privilege.
- id-token: write🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
# Display the Claude Code Review workflow to inspect steps and confirm OIDC/id-token usage
cat .github/workflows/claude-code-review.ymlLength of output: 3105
Remove unnecessary id-token: write permission
The anthropics/claude-code-action@beta step uses the CLAUDE_CODE_OAUTH_TOKEN secret for authentication and does not exchange an OIDC token. You can safely drop the id-token: write grant to adhere to the principle of least privilege.
• File: .github/workflows/claude-code-review.yml
Lines 20–27
permissions:
contents: read
pull-requests: read
issues: read
- id-token: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read |
🧰 Tools
🪛 YAMLlint (1.37.1)
[error] 20-20: trailing spaces
(trailing-spaces)
[error] 27-27: trailing spaces
(trailing-spaces)
🤖 Prompt for AI Agents
In .github/workflows/claude-code-review.yml around lines 20 to 27, remove the
line granting `id-token: write` permission under the permissions section, as it
is unnecessary for the authentication method used and removing it follows the
principle of least privilege.
Summary by CodeRabbit