chore: enable Claude issue trigger per org CI standard

[don-petry]

Summary

• Adds issues: [labeled] event trigger to claude.yml so applying the claude label to any issue triggers Claude to work it autonomously
• Upgrades contents permission from read to write (required for issue-triggered branch creation)
• Pins claude-code-action to v1.0.89 (6e2bd528) matching the org standard
• Adds label_trigger: "claude" input to the action
• Adds dependabot skip condition
• Created the claude label (#7c3aed) on this repository

Implements the standard defined in petry-projects/.github#24.

Test plan

• Verify CI passes on this PR
• After merge, apply claude label to a test issue and confirm Claude picks it up

🤖 Generated with Claude Code

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 1 minutes and 39 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 1 minutes and 39 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b36257ca-35d4-4530-857e-572699e35007

📥 Commits

Reviewing files that changed from the base of the PR and between 1fe7ea7 and 69c6067.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/claude-issue-trigger-standard

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Enables the repository’s Claude Code GitHub Actions workflow to be triggered by applying a claude label to issues, aligning the workflow configuration with the org CI standard referenced in the PR description.

Changes:

• Add issues: [labeled] trigger and gate job execution on the claude label.
• Update workflow/job permissions (notably contents: write) to support issue-triggered branch creation.
• Pin anthropics/claude-code-action to v1.0.89 and add label_trigger: "claude", plus a dependabot skip condition.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The step-level dependabot guard uses github.event.pull_request.user.login, but this workflow also runs on issue_comment, pull_request_review_comment, and issues events where github.event.pull_request may be unset. This can lead to expression evaluation errors and it also won’t skip dependabot PRs when triggered via comment/review-comment events. Consider rewriting the condition to only reference pull_request fields when event_name == 'pull_request', and add equivalent dependabot checks for the comment/review-comment triggers (e.g., using the PR/issue author login available in those payloads or by fetching the PR via API).

Suggested change

	if: github.event_name != 'pull_request' || github.event.pull_request.user.login != 'dependabot[bot]'
	if: >-
	(github.event_name == 'pull_request' &&
	github.event.pull_request.user.login != 'dependabot[bot]') ||
	(github.event_name == 'issue_comment' &&
	github.event.issue.user.login != 'dependabot[bot]') ||
	(github.event_name == 'pull_request_review_comment' &&
	github.event.pull_request.user.login != 'dependabot[bot]') ||
	(github.event_name == 'issues' &&
	github.event.issue.user.login != 'dependabot[bot]')

[Copilot]

contents: write is now granted for the entire job across all triggers (including automatic runs on pull_request synchronize/open). If write access is only needed for the issue-label workflow (branch creation), consider splitting into separate jobs/workflows so PR/comment handling can keep contents: read (least-privilege) and only the issue-triggered path gets write permissions.