Add Claude Code GitHub Workflow - #1
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
|
Caution Review failedThe pull request is closed. WalkthroughThe PR adds two new GitHub Actions workflows that integrate Claude AI services into the repository. One workflow performs automated code reviews on pull requests, while the other enables interactive Claude-powered code assistance triggered through issue and PR comments. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds GitHub Actions workflows to integrate Anthropic Claude Code into the repository (interactive “@claude” runs and an automated PR review workflow).
Changes:
- Introduces a workflow (
claude.yml) that runs Claude Code when “@claude” appears in issue/PR comments or review text. - Introduces a workflow (
claude-code-review.yml) that runs a Claude code-review plugin on PR lifecycle events.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/claude.yml | Adds comment/review/issue-triggered Claude runs based on “@claude” detection. |
| .github/workflows/claude-code-review.yml | Adds an automated Claude-driven PR code review workflow using a plugin. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
Security: this workflow can be triggered by anyone who can comment/open an issue by including "@claude". For issue_comment / pull_request_review_comment events, secrets are available in the base repo context, so an external user could cause this job to run with secrets.CLAUDE_CODE_OAUTH_TOKEN. Add an authorization gate to the if: (e.g., allow only OWNER/MEMBER/COLLABORATOR author_association or explicitly check write permissions via the GitHub API) before invoking the action.
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| (github.event_name == 'issue_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| (github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR')) || | |
| (github.event_name == 'pull_request_review_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| (github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR')) || | |
| (github.event_name == 'pull_request_review' && | |
| contains(github.event.review.body, '@claude') && | |
| (github.event.review.author_association == 'OWNER' || | |
| github.event.review.author_association == 'MEMBER' || | |
| github.event.review.author_association == 'COLLABORATOR')) || | |
| (github.event_name == 'issues' && | |
| (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && | |
| (github.event.issue.author_association == 'OWNER' || | |
| github.event.issue.author_association == 'MEMBER' || | |
| github.event.issue.author_association == 'COLLABORATOR')) |
| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
The job-level permissions are read-only for pull-requests and issues, which will typically prevent the action from posting comments/reviews back to GitHub (and contents: read prevents creating branches/commits). If the intent is for Claude to comment or push commits (as described in the PR description), update permissions to the minimum required writes (e.g., pull-requests: write, issues: write, and contents: write only if you want commit/branch creation).
| pull-requests: read | |
| issues: read | |
| pull-requests: write | |
| issues: write |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
contains(github.event.issue.body, ...) / contains(github.event.review.body, ...) can evaluate against null when an issue/review has no body. In GitHub Actions expressions this can error rather than return false. Consider normalizing with ... || '' before calling contains() (e.g., contains(github.event.issue.body || '', '@claude')).
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body || '', '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body || '', '@claude') || contains(github.event.issue.title, '@claude'))) |
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] | ||
| # Optional: Only run on specific file changes |
There was a problem hiding this comment.
PR description says Claude is triggered by mentioning @claude, but this workflow runs on every PR open/synchronize/etc. If the always-on review is intended, please update the PR description; otherwise add an if: condition (or paths filter) so it only runs when explicitly requested.
| - name: Run Claude Code Review | ||
| id: claude-review | ||
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
Operational: this workflow uses the pull_request event but requires secrets.CLAUDE_CODE_OAUTH_TOKEN. For PRs from forks, GitHub does not provide repository secrets to pull_request workflows, so this job will fail (or run without auth). If you need this to work on forked PRs, consider pull_request_target with strict safety checks; otherwise, add an if: to skip fork PRs (e.g., compare github.event.pull_request.head.repo.fork or repo full_name).
… cost ModelPricingRow already carried CacheReadCost/CacheWriteCost/ReasoningCost columns but ComputeCost only priced input+output, and no span-level cache/ reasoning token fields existed -- so all three columns were dead. Transpiled from yurekami/aegis CostEntry.compute_cost (harvest #7). End-to-end wiring (sanctioned regenerate path, no hand-edited .g.cs): - collector-semantic-policy.json: projectionConstants + spanHotAttributeKeys for gen_ai.usage.cache_read/cache_creation.input_tokens + reasoning.output_tokens - regenerated CollectorSemanticAttributeCatalog.g.cs (3 new consts) - StorageAttributeProjection + SpanHotAttributeProjection: extract the 3 fields - SpanStorageRow: 3 new columns + upsert DO UPDATE SET clause - IngestionStorageMapper: map projection -> row - ComputeCost: additive per-class pricing, cache/reasoning rates fall back to input/output rate when a model omits them Token classes are disjoint (Anthropic/OpenAI report them separately) so costs add. Collector build 0W/0E; VerifyCollectorSemanticAttributeCatalog green. Also recorded scoping verdicts in yurekami-harvest.md: harvest #1/#3/#4 are REF-ONLY (already handled in qyl) -- no dead code written. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.