Skip to content

feat: switch to org-level reusable Claude Code workflow #134

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
don-petry merged 1 commit into from
Apr 6, 2026
Merged

feat: switch to org-level reusable Claude Code workflow #134

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
78 changes: 5 additions & 73 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# AI-assisted code review via Claude Code Action on PRs.
# Issue automation: implement, open PR, self-review, check CI, notify maintainer.
# Claude Code — thin caller that delegates to the org-level reusable workflow.
# All logic and prompts are maintained centrally in claude-code-reusable.yml.
# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#4-claude-code-claudeyml
name: Claude Code

Expand All @@ -17,81 +17,13 @@ on:
permissions: {}

jobs:
# Interactive mode: PR reviews and @claude mentions
claude:
if: >-
(github.event_name == 'pull_request' &&
github.event.pull_request.head.repo.full_name == github.repository) ||
(github.event_name == 'issue_comment' && github.event.issue.pull_request &&
contains(github.event.comment.body, '@claude') &&
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
(github.event_name == 'pull_request_review_comment' &&
contains(github.event.comment.body, '@claude') &&
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
runs-on: ubuntu-latest
timeout-minutes: 60
claude-code:

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Job now delegates to a reusable workflow without any of the previous job-level if: guards (same-repo PR check + @claude author_association allowlist). If the reusable workflow doesn’t replicate those checks, this becomes a security regression (external users could trigger the automation via comments/PR review comments). Consider keeping the if: conditions here in the caller (or add an explicit note + link to where the checks live in the reusable workflow).

Suggested change
claude-code:
claude-code:
if: >-
${{
(github.event_name == 'pull_request' &&
github.event.pull_request.head.repo.full_name == github.repository) ||
(github.event_name == 'issue_comment' &&
github.event.issue.pull_request &&
contains(github.event.comment.body, '@claude') &&
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
(github.event_name == 'pull_request_review_comment' &&
contains(github.event.comment.body, '@claude') &&
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
(github.event_name == 'issues' &&
github.event.issue.pull_request &&
github.event.label.name == '@claude' &&
contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.sender.author_association))
}}

Copilot uses AI. Check for mistakes.
uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@main

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uses: ...@main means the workflow behavior can change without any change in this repository (and can break builds or alter automation unexpectedly). Prefer pinning the reusable workflow to an immutable ref (tag or commit SHA) and updating intentionally when you want new behavior.

Suggested change
uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@main
uses: petry-projects/.github/.github/workflows/claude-code-reusable.yml@<PINNED_COMMIT_SHA>

Copilot uses AI. Check for mistakes.
secrets: inherit

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

secrets: inherit passes all repository/environment secrets to the called workflow. Even if the org workflow is trusted, this is broader than necessary and increases blast radius if the reusable workflow is ever modified or misconfigured. Prefer passing only the required secrets (e.g., CLAUDE_CODE_OAUTH_TOKEN / GH_PAT_WORKFLOWS) explicitly.

Suggested change
secrets: inherit
secrets:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }}

Copilot uses AI. Check for mistakes.
permissions:
contents: write
id-token: write
pull-requests: write
issues: write
actions: read
checks: read
Comment on lines 23 to 29

Copilot AI Apr 6, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says this adds a token with workflows write scope so Claude can push .github/workflows/*, but this job’s permissions don’t include workflows: write. Because reusable workflows can’t elevate permissions beyond the caller, Claude still won’t be able to modify workflow files via GITHUB_TOKEN unless workflows: write is granted here (or you rely solely on a PAT).

Copilot uses AI. Check for mistakes.
Comment on lines 23 to 29

@coderabbitai coderabbitai Bot Apr 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Missing workflows: write permission contradicts PR objectives.

The PR description states this change "Adds a github_token with workflows write scope enabling Claude to push files into .github/workflows/". However, the permissions block does not include workflows: write. Without this permission, Claude will still be blocked from modifying workflow files.

If the intent is to grant this permission from within the reusable workflow, note that callers cannot grant more permissions than they themselves possess—the permission must be declared here.

Proposed fix to add the missing permission 
     permissions:
       contents: write
       id-token: write
       pull-requests: write
       issues: write
       actions: read
       checks: read
+      workflows: write
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
permissions:
contents: write
id-token: write
pull-requests: write
issues: write
actions: read
checks: read
permissions:
contents: write
id-token: write
pull-requests: write
issues: write
actions: read
checks: read
workflows: write
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/claude.yml around lines 23 - 29, The permissions block in
the workflow is missing the required workflows: write permission described in
the PR; update the permissions map (the permissions: block in
.github/workflows/claude.yml) to include workflows: write alongside contents:
write, id-token: write, pull-requests: write, issues: write, actions: read,
checks: read so the generated github_token can push to .github/workflows/, and
ensure this permission is declared in this reusable workflow (callers cannot
elevate permissions for it).

steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
- name: Run Claude Code
if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
additional_permissions: |
actions: read
checks: read

# Automation mode: issue-triggered work — implement, open PR, review, and notify
claude-issue:
if: >-
github.event_name == 'issues' && github.event.action == 'labeled' &&
github.event.label.name == 'claude'
concurrency:
group: claude-issue-${{ github.event.issue.number }}
cancel-in-progress: true
runs-on: ubuntu-latest
timeout-minutes: 60
permissions:
contents: write
id-token: write
pull-requests: write
issues: write
actions: read
checks: read
steps:
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
fetch-depth: 1
- name: Run Claude Code
uses: anthropics/claude-code-action@6e2bd52842c65e914eba5c8badd17560bd26b5de # v1.0.89
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
label_trigger: 'claude'
track_progress: 'true'
additional_permissions: |
actions: read
checks: read
claude_args: |
--allowedTools "Bash(gh pr create:*),Bash(gh pr view:*),Bash(gh pr comment:*),Bash(gh issue comment:*),Bash(gh run view:*),Bash(gh run watch:*),Edit,Write"
prompt: |
Implement a fix for issue #${{ github.event.issue.number }}.

After implementing:
1. Create a pull request with a clear title and description. Include "Closes #${{ github.event.issue.number }}" in the PR body.
2. Self-review your own PR — look for bugs, style issues, missed edge cases, and test gaps. If you find problems, push fixes.
3. Review all comments and review threads on the PR. For each one:
- If you can address the feedback, make the fix, push, and mark the conversation as resolved.
- If the comment requires human judgment, leave a reply explaining what you need.
4. Check CI status. If CI fails, read the logs, fix the issues, and push again. Repeat until CI passes.
5. When CI is green, all actionable review comments are resolved, and the PR is ready, read the CODEOWNERS file and leave a comment tagging the relevant code owners to review and merge.
Loading