Skip to content

ci: give the @claude mention handler a review-sized budget #280

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
allxsmith merged 2 commits into from
Jul 11, 2026
Merged

ci: give the @claude mention handler a review-sized budget #280

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b5f8c8a
ci: give the @claude mention handler a review-sized budget
claude Jul 11, 2026
739d79f
ci: allowlist pnpm so the mention handler can use the provisioned too…
claude Jul 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,15 @@ jobs:
# anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
# and set a monthly spend limit in the Anthropic console.
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
# 60 turns + read-only diff tools so review-sized asks fit: at 20
# turns with no diff access, PR-review requests burned turns on
# permission denials and died on error_max_turns (runs 29136350689,
# 29147803092). The pnpm entries make the pre-provisioned toolchain
# above actually usable (tests/lint/build — same list as
# claude-review.yml, plus install since no workflow step installs
# deps here). No node/Edit/Write additions: the write surface is
# unchanged.
claude_args: |
--max-turns 20
--max-turns 60
--model claude-sonnet-5
--allowedTools "Bash(git diff:*),Bash(git log:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(pnpm install:*),Bash(pnpm run:*),Bash(pnpm test:*),Bash(pnpm exec:*),Bash(pnpm --filter:*)"

@coderabbitai coderabbitai Bot Jul 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Inspect claude.yml: permissions block, whether github_token/GH_TOKEN is provided,
# and how sibling workflows authenticate gh.
fd -a 'claude.yml' .github/workflows | xargs -r sed -n '1,90p'
echo '--- token/permissions references across claude* workflows ---'
fd . .github/workflows -e yml -e yaml | xargs -r rg -n 'permissions:|github_token|GH_TOKEN|GITHUB_TOKEN|gh pr (view|diff)'

Repository: allxsmith/bestax

Length of output: 12420

🌐 Web query:

anthropics/claude-code-action gh pr view GH_TOKEN GITHUB_TOKEN allowlisted Bash tools token handling

💡 Result:

Claude Code interacts with GitHub through the GitHub CLI (gh) and the anthropic/claude-code-action in GitHub Actions. Managing token authentication and tool permissions effectively is critical for these workflows. ### Token Handling and Precedence The gh CLI follows a specific order of precedence for authentication, which can lead to conflicts if not managed correctly [1][2][3]. * Precedence: The CLI prioritizes GH_TOKEN over GITHUB_TOKEN [1][2]. * Injection Conflict: Claude Code historically injected a GITHUB_TOKEN (often a Personal Access Token) directly into the environment of the Bash tool. This could override OAuth tokens stored in the system's local keychain, causing authentication failures or unexpected behavior when using gh commands [3]. * Best Practice: In CI/CD workflows, it is recommended to explicitly set GH_TOKEN in the environment to ensure the gh CLI uses the intended credentials [1][2]. For example: env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} [2] ### Bash Tools and Permission Management Claude Code uses an allowlist/denylist permission system to control access to Bash commands [4][5][6]. * Allowlisting: You can add specific commands to permissions.allow to permit them without manual approval [4]. * Sandboxing: When autoAllowBashIfSandboxed is enabled (default), commands running within a sandbox boundary are automatically allowed, bypassing the standard prompt for most Bash tools [4][5]. * Security Risks: * Compound Commands: Relying on simple allowlists can be risky because compound commands (e.g., cmd1 && cmd2) might bypass permission filters if only the first token is evaluated [7]. * Command Parsing: Claude Code parses commands into an Abstract Syntax Tree (AST) to match against rules. Commands that cannot be parsed safely or do not match an allowlist entry trigger manual approval [6]. * Credential Masking: To prevent credentials from being exposed, use the mask mode in sandbox settings. This protects the environment variable while allowing tools (like gh or npm) to remain functional [8]. ### Specific GitHub Actions Considerations The claude-code-action is designed to run on your infrastructure [9]. It intelligently selects execution modes and can be configured to use specific secrets for authentication [10][9]. When using features like gh pr view, be aware that automated polling or frequent executions can trigger high CPU usage or bypass intended permission constraints if not properly cached [11][12]. To mitigate this, ensure your configuration balances automation needs with resource and security constraints [12][6].

Citations:

🌐 Web query:

anthropics/claude-code-action README GH_TOKEN github_token claude_code_oauth_token gh CLI authentication

💡 Result:

In Claude Code, authentication is separated into two primary domains: Anthropic API access and GitHub repository access. 1. Anthropic/Claude Code Authentication The CLAUDE_CODE_OAUTH_TOKEN is used for long-lived authentication to Claude Code itself, particularly in CI/CD or non-interactive environments where a browser-based login is not possible [1][2]. You can generate this token by running the command 'claude setup-token' locally in your terminal [3][2]. Once generated, set this token as the CLAUDE_CODE_OAUTH_TOKEN environment variable in your CI/CD configuration or environment [2]. 2. GitHub CLI (gh) and Repository Authentication Claude Code uses the GitHub CLI ('gh') to interact with repositories [4][5]. To authenticate GitHub operations, Claude Code looks for a GitHub token in the following order [6]: - Provider-specific environment variables - GH_TOKEN - GITHUB_TOKEN - 'gh auth token' (retrieved from the local GitHub CLI configuration) [6] For GitHub Actions workflows, it is best practice to pass the 'GITHUB_TOKEN' (provided automatically by the workflow) to the 'claude-code-action' [4]. In your workflow file, you can explicitly map this token: - name: Run Claude Code uses: anthropics/claude-code-action@beta env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: github_token: ${{ secrets.GITHUB_TOKEN }} #... other configuration [7][8] When running Claude Code locally, you can authenticate the GitHub CLI by running 'gh auth login' [4][6]. This stores your credentials securely, and Claude Code will automatically detect and use them [5][1]. If you need to run Claude Code in a headless or CI environment, setting the 'GH_TOKEN' or 'GITHUB_TOKEN' environment variable directly is the standard method for providing repository-level credentials [4][6].

Citations:

Pass GH_TOKEN into the Claude step Bash(gh pr view:*) and Bash(gh pr diff:*) need a GitHub token. This step only sets claude_code_oauth_token, so add GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} (or github_token) here to avoid auth failures and wasted turns.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/claude.yml at line 83, Add GH_TOKEN to the Claude workflow
step that configures claude_code_oauth_token, sourcing it from
secrets.GITHUB_TOKEN (or the existing github_token equivalent). Keep the
allowedTools entries for gh pr view and gh pr diff unchanged, and ensure the
token is available in that step’s environment.

Loading