Add Claude Code GitHub Workflow

[jonahgabriel]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[claude]

Code Review - PR #3: Add Claude Code GitHub Workflow

Thank you for setting up Claude Code integration! I've reviewed both workflow files and have some feedback organized by priority.

🔴 Critical Issues

1. Missing Write Permissions for Comments

File: Both claude.yml and claude-code-review.yml

Both workflows need write permissions to post comments/reviews. Currently they only have read permissions.

Fix needed in claude.yml (line 22-26):

permissions:
  contents: write      # Changed from read
  pull-requests: write # Changed from read
  issues: write        # Changed from read
  id-token: write
  actions: read

Fix needed in claude-code-review.yml (line 22-26):

permissions:
  contents: read
  pull-requests: write # Changed from read - needed to post review comments
  issues: read
  id-token: write

2. Infinite Loop Risk - Code Review Workflow

File: .github/workflows/claude-code-review.yml

The automatic code review workflow will run on every PR, including:

• This setup PR itself
• PRs created by Claude
• PRs that update the workflow files

This could create infinite loops or unnecessary reviews.

Recommended fixes (choose one or combine):

Option A - Exclude workflow changes:

on:
  pull_request:
    types: [opened, synchronize]
    paths-ignore:
      - '.github/workflows/**'

Option B - Exclude bot PRs:

jobs:
  claude-review:
    if: github.actor != 'github-actions[bot]' && !contains(github.event.pull_request.title, '[Claude]')
    runs-on: ubuntu-latest

Option C - Opt-in with labels:

on:
  pull_request:
    types: [opened, synchronize, labeled]

jobs:
  claude-review:
    if: contains(github.event.pull_request.labels.*.name, 'needs-review')
    runs-on: ubuntu-latest

🟡 Important Issues

3. Missing CLAUDE.md File

File: .github/workflows/claude-code-review.yml (line 50)

The review prompt references a CLAUDE.md file that doesn't exist in the repository. Claude will handle this gracefully but won't have style guidance.

Recommended action:
Either create a CLAUDE.md with your coding conventions or update the prompt to reference existing docs (README.md has naming conventions).

🟢 Suggestions for Improvement

4. Limited Git History

Files: Both workflows (line 32)

fetch-depth: 1 limits Claude to seeing only the latest commit. For better context in reviews, consider:

- name: Checkout repository
  uses: actions/checkout@v4
  with:
    fetch-depth: 0  # Full history for better context
    ref: ${{ github.event.pull_request.head.sha }}

5. Add Workflow Run Indicators

Consider adding a comment when the review starts to give users feedback that the review is in progress.

✅ What Looks Good

• ✅ Proper use of GitHub Actions secrets for API token
• ✅ Appropriate permissions scoping (just needs write access added)
• ✅ Clear and comprehensive PR description
• ✅ Good use of the official Claude Code action
• ✅ Appropriate trigger conditions for interactive workflow
• ✅ Comments explaining optional configurations

Security Assessment

Overall: Good ✅

• Secrets are properly stored and referenced
• Permissions follow least-privilege (just need write for comments)
• No exposure of sensitive data
• allowed_tools appropriately restricts Claude to GitHub CLI read operations in code review workflow
• No dangerous commands allowed

Test Coverage

N/A - These are workflow files. Consider testing after merge:

1. Create a test PR and verify auto-review triggers
2. Comment with @claude on an issue
3. Verify no infinite loops occur

Recommendations Summary

Before merging:

1. ✅ Add write permissions for pull-requests and issues
2. ✅ Add protection against infinite loops (workflow path exclusion recommended)
3. ✅ Update CLAUDE.md reference or create the file

After merging (optional):

• Consider increasing fetch-depth for better context
• Add workflow status indicators
• Create CLAUDE.md with project-specific conventions

Great work setting this up! The workflows are well-structured and just need a few permission and safety adjustments before they're ready to go. 🚀