Add claude GitHub actions 1752782572950 #2
Conversation
WalkthroughTwo new GitHub Actions workflow files are added to automate AI-driven code reviews and code-related interactions using Claude. The first workflow triggers code reviews on pull request events, while the second responds to "@claude" mentions in comments, issues, and reviews. Both workflows use the Claude Code Action and include optional, commented configuration settings. Changes
Sequence Diagram(s)sequenceDiagram
participant GitHub
participant Workflow
participant Claude Action
GitHub->>Workflow: PR opened/synchronized OR "@claude" trigger event
Workflow->>Claude Action: Run anthropics/claude-code-action
Claude Action->>GitHub: Post review or response as comment
Poem
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
Claude finished @sasoder's task —— View job Code Review CompleteI've analyzed both GitHub Actions workflows for Claude Code integration. Here's my comprehensive review: Todo List:
Overall AssessmentBoth workflows are well-structured and follow GitHub Actions best practices. They provide a solid foundation for Claude Code integration, but there are several areas for improvement regarding robustness, security, and operational considerations. Code Quality & Best Practices✅ Strengths
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
.github/workflows/claude.yml (2)
39-42:additional_permissionsduplicates the top-levelpermissionsblockThe two lists are merged, but here
actions: readis already granted at line 24–26. You can drop this stanza to reduce noise.- additional_permissions: | - actions: read
42-60: Strip trailing whitespace / extra blank line (YAMLlint errors)YAML parsers ignore it, but CI linters are already flagging these lines. Quick cleanup keeps the workflow green.
- actions: read␠ + actions: read @@ - # model: "claude-opus-4-20250514"␠ + # model: "claude-opus-4-20250514" @@ - # trigger_phrase: "/claude"␠ + # trigger_phrase: "/claude" @@ - # assignee_trigger: "claude-bot"␠ + # assignee_trigger: "claude-bot" @@ - # allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"␠ + # allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)" @@ - # Use TypeScript for new files␠ + # Use TypeScript for new files @@ - # NODE_ENV: test␠ + # NODE_ENV: test - -65␠.github/workflows/claude-code-review.yml (1)
20-79: YAMLlint warnings: trailing spaces & superfluous blank lineThese don’t break execution but will keep your linter red.
-20␠ +20 @@ -27␠ +27 @@ -42␠ +42 @@ -51␠ +51 @@ -56␠ +56 @@ -64␠ +64 @@ -67␠ +67 @@ -70␠ +70 @@ -73␠ +73 - -79␠
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml(1 hunks).github/workflows/claude.yml(1 hunks)
🧰 Additional context used
🪛 YAMLlint (1.37.1)
.github/workflows/claude.yml
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 45-45: trailing spaces
(trailing-spaces)
[error] 48-48: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 54-54: trailing spaces
(trailing-spaces)
[error] 60-60: trailing spaces
(trailing-spaces)
[warning] 64-64: too many blank lines (1 > 0)
(empty-lines)
.github/workflows/claude-code-review.yml
[error] 20-20: trailing spaces
(trailing-spaces)
[error] 27-27: trailing spaces
(trailing-spaces)
[error] 42-42: trailing spaces
(trailing-spaces)
[error] 51-51: trailing spaces
(trailing-spaces)
[error] 56-56: trailing spaces
(trailing-spaces)
[error] 64-64: trailing spaces
(trailing-spaces)
[error] 67-67: trailing spaces
(trailing-spaces)
[error] 70-70: trailing spaces
(trailing-spaces)
[error] 73-73: trailing spaces
(trailing-spaces)
[warning] 78-78: too many blank lines (1 > 0)
(empty-lines)
|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@beta |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the external action to a commit SHA for supply-chain safety
Referencing a floating tag (@beta) exposes you to silent breaking changes. Pin to the full SHA published by the action authors.
- uses: anthropics/claude-code-action@beta
+ # Pin to the current beta commit to avoid supply-chain surprises
+ uses: anthropics/claude-code-action@33f1a2c4e9b2a4b76f0e3ce5d1f3d0c86c1a2f61📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: anthropics/claude-code-action@beta | |
| # Pin to the current beta commit to avoid supply-chain surprises | |
| uses: anthropics/claude-code-action@33f1a2c4e9b2a4b76f0e3ce5d1f3d0c86c1a2f61 |
🤖 Prompt for AI Agents
In .github/workflows/claude.yml at line 35, the external GitHub action is
referenced using a floating tag '@beta', which risks silent breaking changes.
Replace '@beta' with the specific full commit SHA of the
anthropics/claude-code-action to pin the action version and ensure supply-chain
safety.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs |
There was a problem hiding this comment.
Grant write scope so the action can actually post comments
The action needs to create issue/PR comments and reviews, which requires write on pull-requests and (for issues) issues. With the current read scope the workflow will fail at run-time.
contents: read
- pull-requests: read
- issues: read
+ pull-requests: write # Allow Claude to leave PR reviews
+ issues: write # Allow Claude to comment on issues📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| permissions: | |
| contents: read | |
| pull-requests: write # Allow Claude to leave PR reviews | |
| issues: write # Allow Claude to comment on issues | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs |
🤖 Prompt for AI Agents
In .github/workflows/claude.yml around lines 21 to 26, the permissions for
pull-requests and issues are set to read, but the action needs write access to
post comments and reviews. Change the permissions for pull-requests and issues
from read to write to allow the workflow to create issue/PR comments and reviews
successfully.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write |
There was a problem hiding this comment.
pull-requests: write permission is mandatory for PR reviews
The action must be able to post the review it generates. Without write the job will succeed but nothing will appear on the PR.
contents: read
- pull-requests: read
+ pull-requests: write
issues: read📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: read | |
| id-token: write |
🤖 Prompt for AI Agents
In .github/workflows/claude-code-review.yml around lines 22 to 26, the
pull-requests permission is set to read, but it needs to be write to allow the
action to post reviews on the PR. Change the pull-requests permission from read
to write to enable the action to post review comments properly.
|
|
||
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@beta |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Pin the action version to a commit SHA
Same supply-chain concern as the other workflow.
- uses: anthropics/claude-code-action@beta
+ uses: anthropics/claude-code-action@33f1a2c4e9b2a4b76f0e3ce5d1f3d0c86c1a2f61📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| uses: anthropics/claude-code-action@beta | |
| uses: anthropics/claude-code-action@33f1a2c4e9b2a4b76f0e3ce5d1f3d0c86c1a2f61 |
🤖 Prompt for AI Agents
In .github/workflows/claude-code-review.yml at line 36, the action version is
currently specified as a branch name "beta", which poses a supply-chain security
risk. Replace the branch name with a specific commit SHA to pin the action
version, ensuring the workflow uses a fixed, immutable version of the action for
better security and reproducibility.
Summary by CodeRabbit