From 275cdc8f23e38c426111510733f83eb90ef629cc Mon Sep 17 00:00:00 2001 From: DJ Date: Thu, 26 Mar 2026 20:31:32 -0700 Subject: [PATCH 1/5] Add Claude Code GitHub Action for PR reviews --- .github/workflows/claude.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/workflows/claude.yml diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml new file mode 100644 index 00000000..866fb8eb --- /dev/null +++ b/.github/workflows/claude.yml @@ -0,0 +1,23 @@ +name: Claude Code + +on: + pull_request: + types: [opened, reopened, synchronize] + issue_comment: + types: [created] + +jobs: + claude: + if: | + (github.event_name == 'pull_request') || + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) + runs-on: ubuntu-latest + permissions: + contents: read + pull-requests: write + issues: write + steps: + - name: Run Claude Code + uses: anthropics/claude-code-action@v1 + with: + anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} From ecac5ae0f01a6d36cfc98b25ad1d3c9b1c8e5aec Mon Sep 17 00:00:00 2001 From: DJ Date: Fri, 27 Mar 2026 06:04:01 -0700 Subject: [PATCH 2/5] fix: address review feedback on Claude Code workflow - Restrict issue_comment trigger to PR comments only - Add author-association check (OWNER/MEMBER/COLLABORATOR) - Add pull_request_review_comment trigger - Add timeout-minutes to prevent runaway jobs Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 866fb8eb..78889dfd 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -5,13 +5,21 @@ on: types: [opened, reopened, synchronize] issue_comment: types: [created] + pull_request_review_comment: + types: [created] jobs: claude: if: | (github.event_name == 'pull_request') || - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) + (github.event_name == 'issue_comment' && github.event.issue.pull_request && + contains(github.event.comment.body, '@claude') && + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || + (github.event_name == 'pull_request_review_comment' && + contains(github.event.comment.body, '@claude') && + contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) runs-on: ubuntu-latest + timeout-minutes: 60 permissions: contents: read pull-requests: write From 67ac41175e2c004a796539ed435d7d0707556809 Mon Sep 17 00:00:00 2001 From: DJ Date: Fri, 27 Mar 2026 06:19:17 -0700 Subject: [PATCH 3/5] fix: use CLAUDE_CODE_OAUTH_TOKEN org secret Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 78889dfd..00737107 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -28,4 +28,4 @@ jobs: - name: Run Claude Code uses: anthropics/claude-code-action@v1 with: - anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} + anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} From 1c1a5ae85e7b47d9a22329d9de7158244b8a975e Mon Sep 17 00:00:00 2001 From: DJ Date: Fri, 27 Mar 2026 06:21:11 -0700 Subject: [PATCH 4/5] fix: add id-token: write permission for OAuth auth Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 00737107..df8bbcb9 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -22,6 +22,7 @@ jobs: timeout-minutes: 60 permissions: contents: read + id-token: write pull-requests: write issues: write steps: From 09410661faa5608b3bdb86f623855a53daba6230 Mon Sep 17 00:00:00 2001 From: DJ Date: Fri, 27 Mar 2026 06:31:51 -0700 Subject: [PATCH 5/5] fix: address remaining review comments - Pin claude-code-action to commit SHA for supply-chain safety - Add fork PR guard (secrets unavailable for fork PRs) - Scope pull_request trigger to main branch - Use >- folded scalar for if expression Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/claude.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index df8bbcb9..7297276c 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -2,6 +2,7 @@ name: Claude Code on: pull_request: + branches: [main] types: [opened, reopened, synchronize] issue_comment: types: [created] @@ -10,8 +11,9 @@ on: jobs: claude: - if: | - (github.event_name == 'pull_request') || + if: >- + (github.event_name == 'pull_request' && + github.event.pull_request.head.repo.full_name == github.repository) || (github.event_name == 'issue_comment' && github.event.issue.pull_request && contains(github.event.comment.body, '@claude') && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || @@ -27,6 +29,6 @@ jobs: issues: write steps: - name: Run Claude Code - uses: anthropics/claude-code-action@v1 + uses: anthropics/claude-code-action@094bd24d575e7b30ac1576024817bf1a97c81262 # v1 with: anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}