Add Claude Code GitHub Workflow#810
Conversation
📝 WalkthroughWalkthroughAdded two GitHub Actions workflows using 🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Around line 3-5: Add concurrency policies to both workflows: in
.github/workflows/claude-code-review.yml at lines 3-5, define a group keyed by
the pull request number and cancel superseded runs; in
.github/workflows/claude.yml at lines 13-20, define an issue/PR-keyed
concurrency policy and explicitly configure whether independent user requests
queue or cancel.
- Around line 29-32: Disable checkout credential persistence by adding
persist-credentials: false to the checkout inputs in
.github/workflows/claude-code-review.yml lines 29-32 and
.github/workflows/claude.yml lines 28-31, ensuring subsequent Claude action
steps cannot access the checkout GITHUB_TOKEN.
- Line 30: Pin every executable workflow dependency to a verified full commit
SHA: update actions/checkout and anthropics/claude-code-action in
.github/workflows/claude-code-review.yml at lines 30 and 36, the Claude Code
marketplace/plugin repository references at lines 39-40, and the corresponding
actions/checkout and anthropics/claude-code-action references in
.github/workflows/claude.yml at lines 29 and 35. Do not leave mutable tags or
unrevisioned repository URLs.
- Line 41: Update the prompt invoking /code-review in the workflow step to
include the --comment option, ensuring review findings are posted as pull
request comments while preserving the existing repository and pull request
arguments.
- Line 32: Update the checkout step containing fetch-depth to use fetch-depth:
0, ensuring the workflow fetches the full repository history before Claude Code
Review runs.
- Around line 22-27: Update permissions in
.github/workflows/claude-code-review.yml at lines 22-27 to grant pull-requests:
write. Update permissions in .github/workflows/claude.yml at lines 21-26 to
grant contents: write, pull-requests: write, and issues: write while preserving
actions: read.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 68562dd9-63c7-428e-82cd-ab8fb7e3c5c8
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml.github/workflows/claude.yml
| on: | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🔵 Trivial
Define concurrency policies for Claude jobs. Without them, repeated PR updates or interactive mentions can run concurrently, producing stale comments, branch races, and unnecessary API usage. (docs.github.com)
.github/workflows/claude-code-review.yml#L3-L5: add a PR-number concurrency group and cancel superseded review runs..github/workflows/claude.yml#L13-L20: add an issue/PR-keyed policy that explicitly decides whether independent user requests queue or cancel.
🧰 Tools
🪛 YAMLlint (1.37.1)
[warning] 3-3: truthy value should be one of [false, true]
(truthy)
🪛 zizmor (1.26.1)
[warning] 3-11: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting
(concurrency-limits)
📍 Affects 2 files
.github/workflows/claude-code-review.yml#L3-L5(this comment).github/workflows/claude.yml#L13-L20
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 3 - 5, Add concurrency
policies to both workflows: in .github/workflows/claude-code-review.yml at lines
3-5, define a group keyed by the pull request number and cancel superseded runs;
in .github/workflows/claude.yml at lines 13-20, define an issue/PR-keyed
concurrency policy and explicitly configure whether independent user requests
queue or cancel.
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
|
|
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows | sort
echo
echo "== target workflow snippets =="
for f in .github/workflows/claude-code-review.yml .github/workflows/claude.yml; do
if [ -f "$f" ]; then
echo "--- $f ---"
nl -ba "$f" | sed -n '1,80p'
else
echo "missing $f"
fi
done
echo
echo "== GitHub permission usage across workflows =="
rg -n "pull-requests:|contents:|issues:|id-token:|actions:|github\.token|GITHUB_TOKEN|PULL_REQUEST|PUSH|COMMENT|COMMIT" .github/workflows || trueRepository: codespecs/daikon
Length of output: 367
🌐 Web query:
anthropics claude-code-action docs solutions contents write pull requests write comments commits PR updates
💡 Result:
Claude Code provides comprehensive integration with Git and GitHub to streamline developer workflows, including managing commits, pull requests, and automated reviews [1][2]. Git Workflows Claude Code interacts directly with your local Git environment to automate common tasks [1][3]: - Commits: It can stage changes, write descriptive commit messages, and create commits based on natural language instructions [1][3]. - Pull Requests (PRs): It can create, view, list, merge, and close pull requests using GitHub CLI (gh) integrations [4][5]. - Configuration: You can manage Git behaviors, such as PR footers or co-author attribution, via settings in ~/.claude/settings.json [6]. Automated Reviews and Comments Claude Code supports automated code reviews and commenting through multiple channels [7][8]: - GitHub Actions: By installing the Claude GitHub app, you can automate workflows by tagging @claude in PRs or issues [9]. It supports reading/writing repository contents, issues, and pull requests [9]. - Inline Comments: Using the Claude Code Action, you can configure the agent to post review comments directly to specific lines of code via the GitHub API (e.g., mcpgithub_inline_commentcreate_inline_comment) [8][5]. - Automated Code Review: A specialized plugin analyzes PRs in parallel using multiple agents to check for bugs, security vulnerabilities, and adherence to repository standards defined in CLAUDE.md [7][10]. Findings are posted as inline comments or summaries within the PR [7][10]. For detailed implementation and configuration examples, including GitHub Actions workflow files, see the official Claude Code documentation and the Claude Code Action repository [9][8][2].
Citations:
- 1: https://code.claude.com/docs/en/overview
- 2: https://code.claude.com/docs/en/how-claude-code-works
- 3: https://code.claude.com/docs/en
- 4: https://instructkr-claude-code.mintlify.app/reference/commands/git-workflows
- 5: https://engineering-playbook.vercel.app/claude-code/github-integration
- 6: [BUG] Claude Code ignores git.includeCoAuthor setting in settings.json anthropics/claude-code#19463
- 7: https://code.claude.com/docs/en/code-review
- 8: https://github.com/anthropics/claude-code-action/blob/main/docs/solutions.md
- 9: https://code.claude.com/docs/en/github-actions
- 10: https://github.com/anthropics/claude-code/blob/2923bc87/plugins/code-review/README.md
🌐 Web query:
anthropics claude-code-action solutions.md GITHUB_TOKEN contents write pull-requests write permissions
💡 Result:
For the anthropics/claude-code-action to perform operations like commenting on pull requests, it requires specific GitHub Actions permissions defined within your workflow file [1][2][3]. To enable these capabilities, you must include the following permissions in your workflow's job configuration [4][5]: permissions: contents: read pull-requests: write id-token: write Explanation: - contents: read: Required for the action to check out and read the repository code [1][2]. - pull-requests: write: Necessary for the action to post comments and interact with pull requests [1][3]. - id-token: write: Generally required for OIDC-based authentication and secure token handling within the workflow [1][2]. When using the GITHUB_TOKEN, it is automatically scoped to these defined permissions [6]. It is recommended to pass this token to the action using the github_token input [7][8]: - uses: anthropics/claude-code-action@v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ secrets.GITHUB_TOKEN }} As outlined in the official solutions documentation, ensure your claude_args are configured to allow the specific tools needed for your automation, such as gh pr comment or inline comment creation [1][5]. If you are bypassing standard user write-permission checks, you may need to use the allowed_non_write_users parameter, though this carries security risks and should be used with caution [9][6].
Citations:
- 1: https://github.com/anthropics/claude-code-action/blob/main/docs/solutions.md
- 2: https://deepwiki.com/anthropics/claude-code-action/6.2-automated-pull-request-review
- 3: https://engineering-playbook.vercel.app/claude-code/github-integration
- 4: https://git.homeinfra.org/actions/claude-code-action/src/tag/v1.0.72/docs/solutions.md
- 5: https://git.homeinfra.org/actions/claude-code-action/src/commit/59a49d170c94470d444d095ee09b159056581e59/docs/solutions.md
- 6: https://github.com/anthropics/claude-code-action/blob/refs/heads/main/docs/security.md
- 7: https://github.com/open-jarvis/OpenJarvis/blob/8e5dc91691701ec8056b12dc8a4f8289b815c060/.github/workflows/claude-review.yml
- 8: https://github.com/anthropics/claude-code-action/tree/4bd9c2053aef2ba7e636657860ce3edcefd40d4e
- 9: https://git.homeinfra.org/actions/claude-code-action/src/tag/v1.0.76/docs/security.md
🌐 Web query:
anthropics claude-code-action claude-code-action.yml GITHUB_TOKEN contents write pull-requests write permissions
💡 Result:
When configuring the claude-code-action in your.github/workflows/claude-code-action.yml file, you should explicitly define the permissions for the GITHUB_TOKEN to adhere to the principle of least privilege [1]. If your workflow requires Claude to read and modify code, create pull requests, or update issues, you should grant the following permissions in your workflow configuration [2][3][4]: permissions: contents: write issues: write pull-requests: write id-token: write # Required if using OIDC-based authentication Key considerations for permissions: - Default Security: By default, if the permissions key is omitted, a workflow may receive a broadly scoped token [1]. Explicitly defining permissions ensures that the GITHUB_TOKEN used by the action has only the minimum necessary access, regardless of the permissions granted to the Claude GitHub App itself [1]. - Claude GitHub App: The Claude GitHub App, when installed, requests contents, issues, and pull-requests permissions (read and write) by default [2][3][4]. However, the actual permissions available to the action during a specific run are the intersection of the App's granted permissions and the permissions you explicitly define in your workflow file [1]. - OIDC Authentication: If you are using OIDC for authentication (e.g., via Google Cloud workload identity federation), the id-token: write permission is strictly required [5][6]. - Security Best Practices: Use the permissions block to lock down the token [1]. Avoid granting excessive permissions such as administration: write or actions: write unless specifically required for your automation logic [1]. For more advanced scenarios or if you are not using the Claude GitHub App, you may provide a custom github_token input to the action; however, this is generally unnecessary if the App is installed [6][2]. If you use a custom token, be aware that Claude's comments may appear under that token's username rather than the claude[bot] identity [6].
Citations:
- 1: Privilege escalation with Claude Code GitHub Actions? anthropics/claude-code#3858
- 2: https://code.claude.com/docs/en/github-actions
- 3: https://code.claude.com/docs/en/github-actions.md
- 4: https://git.homeinfra.org/actions/claude-code-action/src/tag/v1.0.76/docs/security.md
- 5: https://github.com/anthropics/claude-code-action/blob/main/action.yml
- 6: https://github.com/anthropics/claude-code-action/blob/main/docs/faq.md
🌐 Web query:
github.com anthropics claude-code-action docs solutions.md claude code read write comments commits pull requests permissions
💡 Result:
Claude Code is an agentic coding assistant designed to operate within your terminal and integrate with development workflows like GitHub [1][2][3]. It utilizes a set of built-in tools to read, edit, and manage code, as well as interact with Git and GitHub [1][3]. For the claude-code-action repository, the docs/solutions.md file serves as a guide for implementing automation patterns, such as automatic PR code reviews, issue triage, and documentation syncing [4][5]. Key capabilities regarding permissions and Git operations include: Permissions and Security Claude Code uses a permission system that allows users to specify exactly what the agent can and cannot do [6]. Permission rules can be configured in settings.json files and support fine-grained controls such as allow, deny, or ask for confirmation [6][7][8]. Read and Edit tools are restricted to specific paths, and bash commands can be matched using patterns (e.g., Bash(gh pr view *)) [6][9][7]. In CI environments or when using GitHub Actions, the agent requires specific scope permissions to function, typically contents: read, pull-requests: write, and issues: write [9]. Git and GitHub Operations Claude Code integrates directly with command-line Git and GitHub tools (like gh CLI) [9][2][3]. It can perform tasks including: Staging changes, committing, and pushing code [1][3]. Creating, listing, viewing, merging, and closing pull requests [9][2][3]. Posting line comments on PRs and interacting with issues [9][1]. Managing repository maintenance and workflow triggers [4][9]. Best Practices for Automation When implementing these solutions, especially in automated pipelines: Always include necessary GitHub context in your prompts, such as the repository name and PR number [5]. Use the provided solutions.md examples as a reference for configuration details and expected outcomes [4][5]. Be mindful of permission scope; using the principle of least privilege ensures the agent only has access to what it needs for the specific task (e.g., avoiding unnecessary admin or workflow scope unless required) [9].
Citations:
- 1: https://code.claude.com/docs/en/how-claude-code-works
- 2: https://claude.com/product/claude-code?gad_campaignid=23253558478
- 3: https://code.claude.com/docs/en
- 4: https://github.com/anthropics/claude-code-action/blob/main/docs/solutions.md
- 5: https://git.homeinfra.org/actions/claude-code-action/src/commit/59a49d170c94470d444d095ee09b159056581e59/docs/solutions.md
- 6: https://code.claude.com/docs/en/permissions.md
- 7: https://code.claude.com/docs/en/tools-reference.md
- 8: https://code.claude.com/docs/en/auto-mode-config.md
- 9: https://engineering-playbook.vercel.app/claude-code/github-integration
🌐 Web query:
"anthropics/claude-code-action@v1" "pull-requests:" "contents:" "GITHUB_TOKEN"
💡 Result:
The anthropics/claude-code-action@v1 GitHub Action uses the github_token input to allow Claude to authenticate with GitHub and perform operations on your behalf, such as posting comments or interacting with issues and pull requests [1][2]. Key details regarding the use of GITHUB_TOKEN with this action include: Authentication and Behavior By default, the action uses its own built-in authentication, which causes comments and actions to appear as claude[bot] [2]. Providing a github_token in your workflow allows the action to use that token’s authentication instead [2]. Note that if you provide your own github_token, comments will appear under the associated username rather than as claude[bot], and certain features like "sticky comments" may not function correctly because they expect the claude[bot] identity [2]. Security Considerations The use of GITHUB_TOKEN is particularly critical when employing the allowed_non_write_users parameter, which is a significant security risk and should be used with extreme caution [3]. When using this feature, you must pass github_token: ${{ secrets.GITHUB_TOKEN }} [3]. The auto-generated GITHUB_TOKEN is scoped to the job's declared permissions and expires upon job completion, whereas using a Personal Access Token (PAT) is discouraged because it does not rotate and poses a greater risk of recovery via prompt injection [3]. Workflow Configuration To integrate this, you typically define the token in your workflow step as shown below [1][2]: - uses: anthropics/claude-code-action@v1 with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ secrets.GITHUB_TOKEN }} If your workflow requires specific interactions (such as reading actions or workflow runs), ensure your job permissions are configured accordingly [2]: permissions: contents: write pull-requests: write issues: write actions: read
Citations:
- 1: https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
- 2: https://github.com/anthropics/claude-code-action/blob/eb99fb38/docs/faq.md
- 3: https://github.com/anthropics/claude-code-action/blob/refs/heads/main/docs/security.md
🌐 Web query:
official claude-code-action solutions.md "permissions:" "contents: read" "pull-requests: write"
💡 Result:
When configuring the permissions for the Claude Code GitHub Action in your workflow file (e.g., in solutions.md or your local .github/workflows/claude.yml), you should generally set contents: write and pull-requests: write [1][2][3]. While some generated workflow templates may default to read-only permissions, the official documentation and best practices recommend using write permissions to ensure the action can perform its intended tasks, such as creating branches, pushing commits, and managing pull requests [4][2][3]. It is important to understand a key distinction regarding how these permissions function: * Workflow Permissions: The permissions block in your workflow file configures the auto-minted GITHUB_TOKEN [5]. * App Permissions: The Claude GitHub App uses its own installation token, which is independent of the workflow's GITHUB_TOKEN [5][6][3]. Even if you set your workflow permissions to read, the GitHub App itself has the broader permissions granted to it during installation (which typically include write access to contents, pull-requests, and issues) [5][6][7]. For security-conscious setups, you can restrict the GitHub App's permissions directly within the GitHub UI under Settings > Integrations > Claude Code > Configure [5]. If you encounter errors, verify that both the GitHub App and your workflow permissions are configured correctly for the specific operations you want Claude to perform [2][3].
Citations:
- 1: https://github.com/anthropics/claude-code-action/blob/eb99fb38/docs/faq.md
- 2: https://claude-code.mintlify.app/en/github-actions?_rsc=1tg4o
- 3: [BUG] /install-github-app generates workflows with incorrect read-only permissions anthropics/claude-code#7710
- 4: https://code.claude.com/docs/en/github-actions
- 5: claude-code-action pushes commits when only review was requested; workflow
permissions: contents: readdoes not constrain it anthropics/claude-code-action#1289 - 6: Permission is
contents: read, but Claude can create a new branch and commit anthropics/claude-code-action#474 - 7: https://github.com/anthropics/claude-code-action/blob/refs/heads/main/docs/security.md
🌐 Web query:
github.com anthropics claude-code-action docs solutions.md "pull-requests: write"
💡 Result:
The Claude Code Action enables GitHub pull request interactions through the anthropics/claude-code-action repository [1][2]. To write to pull requests (e.g., to create, comment on, or review them), you must explicitly configure the necessary permissions and tool access in your GitHub workflow. Permissions Setup In your workflow YAML file, you must grant the action sufficient permissions to modify pull requests [3][4]. The required permission scope is: permissions: contents: write pull-requests: write issues: write id-token: write [4] Tool Access (claude_args) When configuring the action, you must ensure Claude has the necessary tool permissions to perform these operations [5][6]. This is typically managed through the claude_args input [7][5]. For example, to enable PR comments, you should configure the following [6]: with: claude_args: | --allowedTools "Bash(gh pr comment:*),mcpgithub_inline_commentcreate_inline_comment" [5][6] Key Considerations - PR Comments: Using Bash(gh pr comment:*) allows Claude to post comments on pull requests [5][6]. - Inline Comments: The mcpgithub_inline_commentcreate_inline_comment tool handles inline feedback [5][6]. To post immediately, pass confirmed: true [5][6]. If omitted, comments are buffered and classified to prevent test/probe feedback from reaching the PR [5][6]. You can disable this classification by setting classify_inline_comments: 'false' [5][6]. - GitHub Context: For automated workflows, ensure you pass necessary context like REPO and PR NUMBER to the prompt so the action correctly targets the active pull request [5][8]. - Official Documentation: Detailed implementation examples, including those for PR reviews and security-focused workflows, are available in the solutions.md file within the official repository [5][9][10].
Citations:
- 1: https://github.com/anthropics/claude-code-action
- 2: https://github.com/marketplace/actions/claude-code-action-official
- 3: https://engineering-playbook.vercel.app/claude-code/github-integration
- 4: https://claude-code.mintlify.app/en/github-actions?_rsc=1tg4o
- 5: https://github.com/anthropics/claude-code-action/blob/main/docs/solutions.md
- 6: https://git.homeinfra.org/actions/claude-code-action/src/tag/v1.0.71/docs/solutions.md
- 7: https://github.com/anthropics/claude-code-action/blob/main/docs/custom-automations.md
- 8: feat: improve examples and migration guide with GitHub context anthropics/claude-code-action#505
- 9: https://github.com/anthropics/claude-code-action/blob/f1bd27ca/docs/solutions.md
- 10: https://git.homeinfra.org/actions/claude-code-action/src/commit/9441a7fe224ee09e3609eae6d1bb862443f72fad/docs/solutions.md
🏁 Script executed:
#!/bin/sh
set -euo pipefail
python3 - <<'PY'
from pathlib import Path
for path in [Path('.github/workflows/claude-code-review.yml'), Path('.github/workflows/claude.yml')]:
text = path.read_text()
print(f'--- {path} ---')
for i, line in enumerate(text.splitlines(), 1):
if 1 <= i <= 80:
print(f'{i:3}: {line}')
PY
echo
echo "== GITHUB_TOKEN / github_token usages =="
grep -RIn --include='*.yml' --include='*.yaml' 'github\.token\|github_token\|GITHUB_TOKEN' .github/workflows || trueRepository: codespecs/daikon
Length of output: 4071
🌐 Web query:
"anthropics/claude-code-plugins" "code-review@claude-code-plugins" "GITHUB_TOKEN" "GITHUB_TOKEN" "claude"
💡 Result:
The code-review plugin (part of the anthropics/claude-code-plugins collection) is an official Claude Code tool designed to automate pull request reviews [1][2][3]. When running this plugin—whether locally via the Claude Code CLI or in automated workflows like GitHub Actions—the GITHUB_TOKEN is essential for authenticated API interactions, such as posting inline comments to pull requests [4][5]. Key details regarding your query: 1. Functionality: The code-review plugin audits pull requests by launching multiple agents in parallel to check for bugs and compliance with CLAUDE.md guidelines [1][6]. It uses confidence-based scoring to filter out false positives and focuses on actionable feedback [1]. 2. GitHub Integration: - CLI Usage: To have the plugin post findings as inline review comments on GitHub, you must provide the --comment flag and have a valid GITHUB_TOKEN set in your environment [4]. - GitHub Actions: In automated CI/CD workflows, you configure the action with the plugin and provide the GITHUB_TOKEN (typically via secrets) to grant the necessary permissions for repository interactions [7][5]. 3. Installation: You can add the plugin marketplace using the command /plugin marketplace add anthropics/claude-code [2]. Once added, the code-review plugin can be installed and referenced as code-review@claude-code-plugins [7][8][2]. If you are encountering issues with private repositories or credential handling, ensure that your environment supports GITHUB_TOKEN or other standard git authentication methods, as the Claude CLI relies on these to perform repository operations [9].
Citations:
- 1: https://github.com/anthropics/claude-code/blob/main/plugins/code-review/README.md
- 2: https://code.claude.com/docs/en/discover-plugins
- 3: https://github.com/anthropics/claude-code/blob/main/plugins/README.md
- 4: https://pondero.ai/coding/guides/claude-code-review-command-may-2026/
- 5: https://claude-code.mintlify.app/en/github-actions?_rsc=1tg4o
- 6: https://github.com/anthropics/claude-code/blob/main/plugins/code-review/commands/code-review.md
- 7: https://code.claude.com/docs/en/github-actions
- 8: https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
- 9: https://www.stepcodex.com/en/issue/feature-support-github-token-git-askpass
Grant GitHub write permissions where Claude needs to publish results. These workflows read the repo and CI status but never pass a github_token, and they declare pull-requests: read / contents: read, so /code-review: PR comments, comments, commits, and PR updates can fail unless Claude uses GitHub App/authenticated credentials elsewhere.
.github/workflows/claude-code-review.yml#L22-L26: setpull-requests: writefor PR review commenting..github/workflows/claude.yml#L21-L26: grantcontents: write,pull-requests: write, andissues: writewhen the workflow is intended to comment, commit, or update PRs, while keepingactions: read.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 24-24: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment
(undocumented-permissions)
📍 Affects 2 files
.github/workflows/claude-code-review.yml#L22-L27(this comment).github/workflows/claude.yml#L21-L26
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 22 - 27, Update
permissions in .github/workflows/claude-code-review.yml at lines 22-27 to grant
pull-requests: write. Update permissions in .github/workflows/claude.yml at
lines 21-26 to grant contents: write, pull-requests: write, and issues: write
while preserving actions: read.
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files '.github/workflows/*'
echo
echo "== checkout steps with fetch-depth and persist-credentials =="
python3 - <<'PY'
from pathlib import Path
import re
for p in Path('.github/workflows').glob('*.yml'):
text=p.read_text()
for m in re.finditer(r'(uses:\s*actions/checkout@[^\s]+|fetch-depth:\s*[^ \n]+|persist-credentials:\s*[^ \n]+)', text):
line=text[:m.start()].count('\n')+1
print(f'{p}:{line}:{m.group(0)}')
PY
echo
echo "== workflows around checkout steps =="
for f in .github/workflows/claude-code-review.yml .github/workflows/claude.yml; do
[ -f "$f" ] || continue
echo "--- $f"
sed -n '1,90p' "$f" | cat -n
done
echo
echo "== relevant env/permissions in workflows =="
python3 - <<'PY'
from pathlib import Path
import re
for p in Path('.github/workflows').glob('*.yml'):
text=p.read_text()
lines=text.splitlines()
for i,l in enumerate(lines,1):
if re.search(r'(permissions:|GITHUB_TOKEN|permissions|contents|pull-requests|read|write)', l):
print(f'{p}:{i}:{l}')
PYRepository: codespecs/daikon
Length of output: 5718
🌐 Web query:
actions/checkout persist-credentials default true documentation
💡 Result:
In the official actions/checkout GitHub Action, the persist-credentials input defaults to true [1]. When set to true (the default), the action configures the authentication token or SSH key used for the checkout into the local git configuration [2][3]. This allows subsequent git commands (such as git push or git fetch) executed within your workflow to be authenticated automatically [2][4]. The credentials are removed during the post-job cleanup process [2][3]. If you wish to prevent this behavior—for example, if you do not want your scripts to have access to these credentials—you can explicitly set persist-credentials to false in your workflow file [2][3]: - uses: actions/checkout@v4 with: persist-credentials: false Recent versions of the action (v6.0.0 and later) have improved security by storing these credentials in a separate file under $RUNNER_TEMP rather than directly in the.git/config file, though the behavior remains compatible with existing workflows [5][6].
Citations:
- 1: https://github.com/actions/checkout/blob/master/action.yml
- 2: https://github.com/actions/checkout?tab=readme-ov-file
- 3: https://github.com/actions/checkout
- 4: https://github.com/marketplace/actions/checkout
- 5: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 6: https://github.com/actions/checkout/tree/v6.0.0
🌐 Web query:
actions/checkout persist-credentials: false security checkout credential repository token
💡 Result:
The persist-credentials input in the actions/checkout GitHub Action controls whether the repository's access token (typically GITHUB_TOKEN) is configured in the local Git configuration for the checked-out repository [1][2]. When persist-credentials is set to its default value of true, the action automatically configures the Git credential helper to use the provided token [1][3]. This allows subsequent steps in your workflow to execute authenticated Git commands (such as git push or git fetch) without needing to manually configure credentials [1][4]. Security considerations: 1. Exposure Risk: Because the token is persisted, it can theoretically be accessed by any subsequent steps in the same job [5][2]. If a workflow creates artifacts that include the repository files (and thus the Git configuration), there is a risk that the token could be leaked if those artifacts are exposed [2]. 2. Improved Security Mechanisms: In recent versions of actions/checkout (starting from v6.0.0), the action was updated to store credentials in a separate file under $RUNNER_TEMP rather than directly in .git/config [6]. This change reduces the risk of accidental exposure via artifact uploads [7][6]. 3. Best Practice: To follow the principle of least privilege and minimize exposure, it is a recommended security best practice to set persist-credentials: false if your workflow does not require executing authenticated Git commands [5][2]. To opt out of persisting credentials, configure your step as follows [1][2]: - uses: actions/checkout@v4 with: persist-credentials: false
Citations:
- 1: https://www.github.com/actions/checkout
- 2: https://yossarian.net/til/post/actions-checkout-can-leak-github-credentials/
- 3: https://github.com/actions/checkout
- 4: https://github.com/actions/checkout/tree/v6.0.2?tab=readme-ov-file
- 5: Remove
persist-credentialsor change the default tofalseactions/checkout#485 - 6: https://github.com/actions/checkout/tree/v6.0.0
- 7: [security] Escalate concerning default
persist-credentials=trueplease actions/checkout#2312
Disable checkout credential persistence for Claude steps. Add persist-credentials: false to the checkout inputs so subsequent Claude action steps cannot access the checkout GITHUB_TOKEN.
.github/workflows/claude-code-review.yml#L29-L32.github/workflows/claude.yml#L28-L31
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 2 files
.github/workflows/claude-code-review.yml#L29-L32(this comment).github/workflows/claude.yml#L28-L31
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml around lines 29 - 32, Disable
checkout credential persistence by adding persist-credentials: false to the
checkout inputs in .github/workflows/claude-code-review.yml lines 29-32 and
.github/workflows/claude.yml lines 28-31, ensuring subsequent Claude action
steps cannot access the checkout GITHUB_TOKEN.
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "Repository workflow files:"
git ls-files '.github/workflows/*' || true
echo
echo "Relevant workflow excerpts:"
for f in .github/workflows/claude-code-review.yml .github/workflows/claude.yml; do
if [ -f "$f" ]; then
echo "--- $f"
wc -l "$f"
cat -n "$f"
else
echo "--- missing $f"
fi
done
echo
echo "Search for Claude marketplace/plugin references:"
rg -n "plugin_marketplaces|plugins:|claude-code-action@|actions/checkout@" .github/workflows || trueRepository: codespecs/daikon
Length of output: 4995
🌐 Web query:
GitHub Actions pin to full commit SHA security refer to external plugin marketplace source pin or vendor
💡 Result:
Pinning GitHub Actions to a full-length (40-character) commit SHA is a critical security best practice recommended by GitHub and industry standards to prevent supply chain attacks [1][2][3]. Why Pin to Full Commit SHA: Mutable references (such as tags like @v1, @v4 or branches like @main, @master) are pointers that can be re-targeted at any time by the action's maintainer [4][3]. If an attacker compromises a maintainer's account, they can update these tags to point to malicious code, which would then execute automatically within your workflow with access to your repository's secrets and tokens [4][5][6]. Pinning to a full-length SHA ensures immutability; once a workflow is configured to use a specific SHA, it will always execute the exact same code, regardless of future updates or unauthorized changes to the upstream repository [1][7][8]. How to Implement Safely: 1. Pin to the 40-character SHA: Use the full length SHA, not a short hash or a tag [1][3]. 2. Maintain Readability and Automation: Append the human-readable version as a trailing comment (e.g., - uses: actions/checkout@08c6903 # v5.0.0) [4][8][3]. Modern dependency management tools like Dependabot and Renovate are designed to read these comments, allowing them to continue monitoring for updates and opening pull requests to update the SHA and version comment simultaneously [4][5][3]. 3. Enforce via Policy: GitHub administrators can enforce this practice across an organization or repository using the "Allowed actions and reusable workflows" policy [1][9]. When enabled, workflows attempting to use mutable references will fail, ensuring compliance across the codebase [9][6]. 4. Sub-actions: Be aware that the SHA pinning policy often applies to the entire dependency tree, including sub-actions called by the primary action [6]. If you maintain actions, ensure you pin all internal references to SHAs to avoid breaking your users' workflows [6]. Vendor Risk Considerations: Pinning protects against "tag-retargeting" attacks, but it does not protect against an action that was malicious from the start or that becomes compromised internally [5]. Always verify the origin of an action, ensure it is from a trusted repository (not a fork), and monitor the action maintainer's activity [1][2][10]. For high-security environments, some organizations may choose to "vendor" critical actions—copying the source code into their own repository—to gain complete control and eliminate dependency on external availability and integrity [4].
Citations:
- 1: https://docs.github.com/en/actions/reference/security/secure-use
- 2: https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md
- 3: https://tomodahinata.com/en/blog/dependabot-github-actions-sha-pinning-supply-chain-security-guide
- 4: https://starsling.dev/best-practices/github-actions/pin-action-shas
- 5: https://emmer.dev/blog/pin-your-github-actions-to-protect-against-mutability/
- 6: https://www.romainlespinasse.dev/posts/github-actions-commit-sha-pinning/
- 7: https://github.com/github/codeql/blob/main/actions/ql/src/Security/CWE-829/UnpinnedActionsTag.md
- 8: https://nearform.com/insights/why-you-should-pin-your-github-actions-by-commit-hash/
- 9: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 10: https://securitylab.github.com/resources/github-actions-building-blocks/
Pin all workflow dependencies to immutable revisions. Both workflows use mutable tags for actions/checkout and anthropics/claude-code-action; .github/workflows/claude-code-review.yml also pulls the Claude Code plugin marketplace/plugins by repo URL without a revision. Replace these with verified full commit SHAs (or vendor reviewed code) for each executable dependency.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 30-30: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
📍 Affects 2 files
.github/workflows/claude-code-review.yml#L30-L30(this comment).github/workflows/claude-code-review.yml#L36-L36.github/workflows/claude-code-review.yml#L39-L40.github/workflows/claude.yml#L29-L29.github/workflows/claude.yml#L35-L35
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml at line 30, Pin every executable
workflow dependency to a verified full commit SHA: update actions/checkout and
anthropics/claude-code-action in .github/workflows/claude-code-review.yml at
lines 30 and 36, the Claude Code marketplace/plugin repository references at
lines 39-40, and the corresponding actions/checkout and
anthropics/claude-code-action references in .github/workflows/claude.yml at
lines 29 and 35. Do not leave mutable tags or unrevisioned repository URLs.
| - name: Checkout repository | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/claude-code-review.yml ]; then
nl -ba .github/workflows/claude-code-review.yml | sed -n '1,120p'
else
echo "missing .github/workflows/claude-code-review.yml"
fi
echo
echo "== references to fetch-depth / claude action =="
rg -n "fetch-depth|claude|code-review|COT|history|blame" .github/workflows || true
echo
echo "== repository files mentioning anthropics/claude-code or code-review =="
rg -n "anthropics/claude-code|code-review|codeReview|history-blame" . || trueRepository: codespecs/daikon
Length of output: 217
🌐 Web query:
anthropics claude-code plugin code-review fetch-depth 1 history blame analysis
💡 Result:
The Code Review plugin for Claude Code performs git blame and history analysis to provide context-based insights during automated pull request reviews [1][2][3][4]. Because these operations rely on git history, they may encounter issues if the environment uses a shallow clone [5][6]. Regarding fetch-depth and git history: 1. Operational Context: The Code Review plugin explicitly utilizes a dedicated agent (Agent #4) to analyze git blame and history to identify issues based on historical context [1][2][3]. 2. Shallow Clone Limitations: When Claude Code operates in a shallow clone environment—common in CI/CD pipelines where checkout often uses a limited fetch-depth (e.g., depth=1)—it may be unable to access the full commit graph [5][6]. This can cause commands like git blame or git log to fail or return incomplete results if the required history exists outside the fetched depth [5][6]. 3. Fetch-Depth Configuration: While early performance optimizations introduced shallow fetching (e.g., --depth=1) to improve speed for large repositories [7][8], subsequent adjustments were made to ensure better context. The Claude Code Action has evolved to use a dynamic fetch depth, specifically calculated as max(PR commits, 20), to balance performance with the need for sufficient git context [9]. 4. Recommended Resolution: If you encounter errors such as unable to access beyond shallow boundary or failures in git blame/history analysis, it is recommended to ensure the environment has sufficient history [6]. For CI/CD workflows, this typically involves setting fetch-depth: 0 in your checkout step, or using git fetch --unshallow to convert the repository to a full clone when deep history analysis is required [6][10].
Citations:
- 1: https://github.com/anthropics/claude-plugins-official/blob/main/plugins/code-review/commands/code-review.md
- 2: https://github.com/anthropics/claude-plugins-official/tree/main/plugins/code-review
- 3: https://github.com/anthropics/claude-code/blob/main/plugins/code-review/README.md
- 4: https://claude.com/plugins/code-review
- 5: Claude is not informed about shallow clone limitations; no user-configurable fetch depth anthropics/claude-code-action#781
- 6: https://claudecodeguides.com/claude-code-shallow-clone-missing-history-blame-fix-2026/
- 7: Add shallow fetch to improve performance for large repositories anthropics/claude-code-action#53
- 8: Take long time to fetch large repository anthropics/claude-code-action#52
- 9: feat: use dynamic fetch depth based on PR commit count anthropics/claude-code-action#169
- 10: https://starsling.dev/best-practices/github-actions/shallow-checkout
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
if [ -f .github/workflows/claude-code-review.yml ]; then
sed -n '1,120p' .github/workflows/claude-code-review.yml
else
echo "missing .github/workflows/claude-code-review.yml"
fi
echo
echo "== references to fetch-depth / claude action =="
grep -Rn "fetch-depth\|claude\|code-review\|COT\|history\|blame" .github/workflows || true
echo
echo "== repository files mentioning anthropics/claude-code or code-review =="
grep -RIn "anthropics/claude-code\|code-review\|codeReview\|history-blame" . || trueRepository: codespecs/daikon
Length of output: 4945
🌐 Web query:
anthropics/claude-code-action v1 fetch-depth pull_request
💡 Result:
In the context of the anthropics/claude-code-action GitHub Action, the fetch-depth parameter is not a direct input of the action itself [1][2]. Instead, it refers to the configuration of the actions/checkout step that must precede the Claude Code action in your workflow [3][4]. When setting up your workflow, you should configure the fetch-depth within the actions/checkout step [5][4]: - Typical use: For standard pull request reviews, a fetch-depth of 0 (full history) is often recommended to ensure Claude has the complete context necessary for deep analysis [4]. - Performance consideration: Some users use smaller values (e.g., fetch-depth: 2) to reduce repository clone time while still providing enough history for simple diff comparisons [4]. Important Context regarding Claude Code Action: - Internal Fetching: The Claude Code action internally manages its own git operations [6]. It has been updated to dynamically calculate its own required fetch depth based on the number of commits in a pull request (using a minimum of 20 commits to ensure adequate context) [2][7]. - Shallow Clone Limitations: Because the action performs its own git operations, it operates within a shallow clone environment if you have configured the initial checkout step that way [2]. There is currently no user-configurable input in the Claude Code action to override or explicitly set this internal fetch depth [2]. Recommendation: For the most reliable behavior in pull request workflows, use fetch-depth: 0 in your actions/checkout step [4]. This ensures that the environment provided to the Claude Code action contains the full history, avoiding potential issues where Claude might be unable to verify commit information due to shallow clone limitations [2][4].
Citations:
- 1: https://code.claude.com/docs/en/github-actions?_rsc=4Vrbm42DZc3Y7r9j
- 2: Claude is not informed about shallow clone limitations; no user-configurable fetch depth anthropics/claude-code-action#781
- 3: https://github.com/anthropics/claude-code-action/blob/main/docs/solutions.md
- 4: https://systemprompt.io/guides/claude-code-github-actions
- 5: https://www.github.com/actions/checkout
- 6: https://github.com/anthropics/claude-code-action/blob/d4d7974604c97ec79208ca115b863b41a325d62d/src/github/operations/branch.ts
- 7: feat: use dynamic fetch depth based on PR commit count anthropics/claude-code-action#169
🌐 Web query:
Anthropics Claude Code shallow checkout fetch-depth 1 plugin code review
💡 Result:
Claude Code and its associated GitHub Action (anthropics/claude-code-action) utilize shallow git clones to optimize performance, especially for large repositories [1][2][3]. Key points regarding shallow checkouts and fetch depth: 1. Internal Defaults: The claude-code-action explicitly enforces shallow fetches during its internal git operations [4]. Specifically, it performs a fetch with --depth=20 when checking out existing pull request branches to provide some context while maintaining speed, and a fetch with --depth=1 when creating new branches [3][4]. Similarly, the Claude Code CLI uses shallow clones (typically --depth=1) for operations like updating the plugin marketplace to reduce execution time [5]. 2. Impact on Context: Because these operations are shallow, Claude may have limited visibility into the full git history [6]. This can cause issues if Claude attempts to reason about commits or file changes that exist outside the defined fetch depth [6]. 3. Overriding for Full History: If your workflow requires the full git history for accurate code reviews or context, you can override the default behavior by configuring the actions/checkout step in your GitHub Actions workflow file. By setting fetch-depth: 0, you ensure that the full repository history is available on the runner before Claude Code executes [7][8][3]: yaml - uses: actions/checkout@v4 with: fetch-depth: 0 # Fetches full history 4. Potential Issues: - Performance vs. Depth: While shallow clones significantly speed up workflows, they may omit older context that is occasionally necessary for advanced analysis [9][8]. - Plugin Marketplace: Users have reported that shallow cloning in the CLI can sometimes lead to incomplete working trees or file-sync issues, which may require manual remediation (e.g., performing a full fetch) if specific plugin files are missing [10]. - CI/CD Configuration: When using actions/checkout with persist-credentials: false alongside the Claude Code Action, ensure your authentication flow is configured correctly to avoid fetch errors, as the action performs its own git operations [11].
Citations:
- 1: Add shallow fetch to improve performance for large repositories anthropics/claude-code-action#53
- 2: Take long time to fetch large repository anthropics/claude-code-action#52
- 3: https://git.homeinfra.org/actions/claude-code-action/src/commit/e0d3fec39f30dc4ed990b3ada4cbed665ce797a0/FAQ.md
- 4: https://git.homeinfra.org/actions/claude-code-action/src/commit/52efa5e498aaed954a436f12fad256d8f8a02903/src/github/operations/branch.ts
- 5: [FEATURE] plugins marketplace update should use shallow clone (--depth 1) for faster performance anthropics/claude-code#46458
- 6: Claude is not informed about shallow clone limitations; no user-configurable fetch depth anthropics/claude-code-action#781
- 7: https://github.com/FlorianBruniaux/claude-code-ultimate-guide/blob/main/whitepapers/recap-cards/en/m19-github-actions.qmd
- 8: https://claudeimplementation.com/blog/claude-code-automated-code-reviews
- 9: Add Claude Code GitHub Workflow FabienDehopre/dehopre.dev#5
- 10: Plugin marketplace: shallow clone + SSH remote causes missing plugin files anthropics/claude-code#29122
- 11: claude-code-action fails when actions/checkout uses persist-credentials: false anthropics/claude-code-action#1236
Fetch enough history for Claude Code Review history/blame analysis.
fetch-depth: 1 leaves a shallow clone before the plugin runs, which can prevent or degrade /code-review history/blame analysis. Use fetch-depth: 0 for the checkout step, or otherwise ensure the checkout includes enough historical commits for the plugin’s required context.
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 29-32: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml at line 32, Update the checkout
step containing fetch-depth to use fetch-depth: 0, ensuring the workflow fetches
the full repository history before Claude Code Review runs.
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' | ||
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== repo files =="
git ls-files | rg '(^|/)(claude-code-review|action|README|package)'
echo
echo "== workflow snippet =="
if [ -f .github/workflows/claude-code-review.yml ]; then
nl -ba .github/workflows/claude-code-review.yml | sed -n '1,120p'
fi
echo
echo "== search for code-review prompts/actions/comment =="
rg -n "code-review|--comment|claude-code|github/anthropics|uses:.*claude" .github README.md package*.json 2>/dev/null || true
echo
echo "== exact README from repo, if present =="
if [ -f README.md ]; then
rg -n -C 4 "code-review|--comment|pull request|comment" README.md || true
fiRepository: codespecs/daikon
Length of output: 2485
🌐 Web query:
Anthropics Claude Code code-review plugin --comment pull request
💡 Result:
Anthropic provides two primary ways to perform automated code reviews with Claude: a local command-line interface (CLI) tool and a managed "Code Review" feature for GitHub pull requests [1][2][3]. 1. Local CLI Review The Claude Code CLI includes a built-in /code-review command that performs a code review directly in your terminal [4][1]. - Usage: Run /code-review within your terminal session [1][2]. You can pass a specific target (such as a branch name, PR number, or file path) to review changes [1][2]. - Posting to GitHub: By default, this command outputs findings to your terminal [4][5]. To post the findings as comments on a GitHub pull request, use the --comment flag [4][6]: /code-review --comment - Functionality: This command uses specialized agents to analyze diffs for logic errors, bugs, and compliance with CLAUDE.md guidelines, filtering findings based on a confidence threshold (default 80) [4][5]. 2. Managed "Code Review" for GitHub (Team/Enterprise) Anthropic also offers a managed "Code Review" feature designed to run automatically on GitHub pull requests [1][3]. - Setup: This requires a Team or Enterprise subscription and involves enabling the feature in your Claude Code settings and installing the official GitHub App [1][3]. - Triggering: Once enabled, reviews can be configured to trigger automatically when a PR is opened or pushed, or manually by commenting @claude review on the pull request [1][2]. - Functionality: This service performs multi-agent, deep analysis of the codebase, providing both a summary overview and inline comments on the pull request [2][3]. The /code-review CLI command is available for broader use, while the managed GitHub integration is currently focused on Team and Enterprise plans [1][2][3]. Both systems aim to reduce noise by focusing on high-confidence findings [4][3].
Citations:
- 1: https://code.claude.com/docs/en/code-review?_rsc=4Vrbm42DZc3Y7r9j
- 2: https://code.claude.com/docs/en/code-review
- 3: https://claude.com/blog/code-review/
- 4: https://github.com/anthropics/claude-code/blob/main/plugins/code-review/README.md
- 5: https://github.com/anthropics/claude-code/blob/2923bc87/plugins/code-review/README.md
- 6: https://github.com/anthropics/claude-code/blob/2923bc87/plugins/code-review/commands/code-review.md
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow =="
awk '{printf "%5d\t%s\n", NR, $0}' .github/workflows/claude-code-review.yml
echo
echo "== references to code review workflow/flags =="
rg -n "claude-code-review|/code-review|--comment|repository/ pull|pull_request.number" .github README README.source 2>/dev/null || trueRepository: codespecs/daikon
Length of output: 2073
Pass --comment so code review findings are posted to the PR.
/code-review prints findings to the terminal by default; add --comment so review results are created as PR comments.
Proposed fix
- prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
+ prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }} --comment'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' | |
| prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }} --comment' |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude-code-review.yml at line 41, Update the prompt
invoking /code-review in the workflow step to include the --comment option,
ensuring review findings are posted as pull request comments while preserving
the existing repository and pull request arguments.
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.github/workflows/claude.yml (1)
8-9: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not trigger Claude on ordinary issue assignments.
Because
issues.assigneduses the same condition as issue creation, assigning an issue whose existing title or body contains@claudestarts a new run without a new mention. Removeassignedor add an assignment-specific trigger condition.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/claude.yml around lines 8 - 9, Update the issues trigger configuration to stop launching Claude for ordinary assignments by removing assigned from the types list, or add a condition that requires a new `@claude` mention for assignment events while preserving the opened trigger.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/analyze-comp-file.py`:
- Line 61: Replace the invalid human-readable Ruff suppression on the loop in
scripts/analyze-comp-file.py at line 61 with the stable codes B007 and PERF102.
Also update the suppression in scripts/dfec-to-kvasir.py at lines 50-56 to use
SIM115; no other behavior changes are needed.
---
Outside diff comments:
In @.github/workflows/claude.yml:
- Around line 8-9: Update the issues trigger configuration to stop launching
Claude for ordinary assignments by removing assigned from the types list, or add
a condition that requires a new `@claude` mention for assignment events while
preserving the opened trigger.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 7497025a-7002-4ec4-a67e-f83d250dca18
📒 Files selected for processing (4)
.github/workflows/claude-code-review.yml.github/workflows/claude.ymlscripts/analyze-comp-file.pyscripts/dfec-to-kvasir.py
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!