Skip to content

Add Claude Code GitHub Workflow - #1

Merged
twistedmelonman merged 2 commits into
mainfrom
add-claude-github-actions-1772055004271
Feb 25, 2026
Merged

Add Claude Code GitHub Workflow#1
twistedmelonman merged 2 commits into
mainfrom
add-claude-github-actions-1772055004271

Conversation

@twistedmelonman

Copy link
Copy Markdown
Member

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

  • Bug fixes and improvements
  • Documentation updates
  • Implementing new features
  • Code reviews and suggestions
  • Writing tests
  • And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

  • This workflow won't take effect until this PR is merged
  • @claude mentions won't work until after the merge is complete
  • The workflow runs automatically whenever Claude is mentioned in PR or issue comments
  • Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

  • Our Anthropic API key is securely stored as a GitHub Actions secret
  • Only users with write access to the repository can trigger the workflow
  • All Claude runs are stored in the GitHub Actions run history
  • Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
  • We can add more allowed tools by adding them to the workflow file like:
allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

@twistedmelonman
twistedmelonman merged commit 437e97a into main Feb 25, 2026
1 check passed
@twistedmelonman
twistedmelonman deleted the add-claude-github-actions-1772055004271 branch February 25, 2026 21:30
Comment on lines +22 to +26
permissions:
contents: read
pull-requests: read
issues: read
id-token: write

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The new GitHub workflows claude.yml and claude-code-review.yml lack the necessary write permissions to post comments on pull requests and issues, which will cause them to fail.
Severity: HIGH

Suggested Fix

Add pull-requests: write and issues: write to the permissions block in both claude.yml and claude-code-review.yml to allow the actions to post comments as intended.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/claude-code-review.yml#L22-L26

Potential issue: The new GitHub workflows, `claude.yml` and `claude-code-review.yml`,
are configured with read-only permissions for `pull-requests` and `issues`. However,
their intended function is to post review comments, which requires `pull-requests:
write` and `issues: write` permissions. This is confirmed by an existing, similar
workflow (`claude-blocking-review.yml`) that already uses these write permissions.
Without the correct permissions, these new workflows will fail with a permission denied
error every time they attempt to post a comment, preventing them from performing their
core function.

Did we get this right? 👍 / 👎 to inform future reviews.

twistedmelonman added a commit that referenced this pull request Mar 9, 2026
Add permissions block to claude.yml (the github-workflows repo's own
thin caller) and update the usage comment in claude-assistant.yml to
show callers should include it.

Explicit permissions are required because:
- GitHub Actions security scanner flags callers without explicit scopes
- id-token: write is needed by claude-code-action for internal auth
- Without it, the caller inherits default read-only scopes but without
  the explicit declaration that makes the security scanner happy

Addresses security/code-scanning alert #1 (actions/missing-workflow-permissions).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant