Add Claude Code GitHub Workflow by zircote · Pull Request #1 · zircote/mnemonic

zircote · 2026-01-30T02:27:05Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate Claude Code into the repository for interactive assistance and automated PR reviews.

Changes:

Adds an @claude-triggered workflow for issue/PR comment and review events.
Adds a PR-triggered workflow intended to run a Claude-based code review plugin on pull requests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
`.github/workflows/claude.yml`	Introduces an `@claude` mention-triggered workflow that runs the Claude Code action on comments/reviews/issues.
`.github/workflows/claude-code-review.yml`	Introduces an automatic PR workflow to run a Claude Code Review plugin on PR lifecycle events.

Copilot · 2026-01-30T02:29:58Z

.github/workflows/claude.yml

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The workflow can be triggered by any commenter who includes "@claude" (issue comments, PR review comments, PR reviews) and by anyone opening an issue with "@claude" in the title/body. This contradicts the PR description’s claim that only users with write access can trigger the workflow and is a security risk because it allows untrusted users to run the action (and potentially access repository context/secrets). Add an author trust check to the if: condition (e.g., restrict to OWNER/MEMBER/COLLABORATOR or a maintained allowlist) for each event type you support.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)

) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)

) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)

) ||

(github.event_name == 'issues' &&

(contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)

)

Copilot · 2026-01-30T02:29:58Z

.github/workflows/claude.yml

+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs


The job-level permissions are read-only for contents, pull-requests, and issues, but the PR description states Claude can create comments/branches/commits. With the current permissions, the workflow will not be able to post comments or push changes via GITHUB_TOKEN. Update the workflow permissions to match the intended capabilities (e.g., at least issues: write / pull-requests: write, and only add contents: write if you actually want Claude to be able to push commits).

Copilot · 2026-01-30T02:29:58Z

.github/workflows/claude.yml

+name: Claude Code
+
+on:
+  issue_comment:
+    types: [created]


Repository convention: other workflows start with a YAML document header and quote the on key (e.g., .github/workflows/ci.yml:1-5, .github/workflows/copilot-setup-steps.yml:1-6). To keep workflow files consistent (and avoid YAML tooling edge cases around on), consider adding --- and using "on": here as well.

Copilot · 2026-01-30T02:29:59Z

.github/workflows/claude-code-review.yml

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This workflow runs on every PR open/sync/etc (no if: gating), which doesn’t match the PR description’s behavior of running only when someone mentions @claude in a comment. If the intent is “on-demand via mention”, add an if: filter (or change triggers) so you don’t run Claude on all PRs by default.

Copilot · 2026-01-30T02:29:59Z

.github/workflows/claude-code-review.yml

+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'


This workflow uses secrets.CLAUDE_CODE_OAUTH_TOKEN on the pull_request event. For PRs from forks, GitHub does not provide repository secrets, so this job will fail noisily on external contributions. Add an if: guard to skip forks (e.g., only run when github.event.pull_request.head.repo.full_name == github.repository) or otherwise handle the missing secret case explicitly.

Copilot · 2026-01-30T02:29:59Z

.github/workflows/claude-code-review.yml

+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


Repository convention: other workflows include a YAML document header and quote the on key (e.g., .github/workflows/ci.yml:1-5, .github/workflows/copilot-setup-steps.yml:1-6). Consider adding --- and using "on": here for consistency with the rest of the repo’s workflows.

zircote · 2026-01-30T03:55:48Z

@copilot open a new pull request to apply changes based on the comments in this thread

Copilot · 2026-01-30T03:55:55Z

@zircote I've opened a new pull request, #2, to work on those changes. Once the pull request is ready, I'll request review from you.

zircote added 2 commits January 29, 2026 21:26

"Claude PR Assistant workflow"

40cc113

"Claude Code Review workflow"

48543cd

Copilot AI review requested due to automatic review settings January 30, 2026 02:27

Copilot started reviewing on behalf of zircote January 30, 2026 02:27 View session

Copilot AI reviewed Jan 30, 2026

View reviewed changes

Copilot AI mentioned this pull request Jan 30, 2026

Fix security and permissions in Claude workflow files #2

Merged

zircote merged commit 06e0d55 into main Feb 6, 2026
10 of 12 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Claude Code GitHub Workflow#1

Add Claude Code GitHub Workflow#1
zircote merged 2 commits intomainfrom
add-claude-github-actions-1769740011136

zircote commented Jan 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

Copilot AI Jan 30, 2026

Uh oh!

zircote commented Jan 30, 2026

Uh oh!

Copilot AI commented Jan 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

zircote commented Jan 30, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 30, 2026

Choose a reason for hiding this comment

Uh oh!

zircote commented Jan 30, 2026

Uh oh!

Copilot AI commented Jan 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants