ci(release): re-arm the merge trigger behind the central guard #2272
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| issues: | |
| types: [opened, assigned] | |
| pull_request_review: | |
| types: [submitted] | |
| # Declare default permissions as read only (principle of least privilege) | |
| permissions: | |
| contents: read | |
| jobs: | |
| claude: | |
| if: | | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| # Matches every other checkout in this repository. It matters more here than elsewhere: | |
| # this job runs an LLM agent with Bash access (git*, gh*) over comment bodies that any | |
| # commenter can author, so leaving the token in .git/config would put a credential | |
| # directly in reach of the very surface this workflow hands to a model. The job needs no | |
| # authenticated git operation — the action talks to the API with its own token. | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| java-version: '25' | |
| distribution: 'temurin' | |
| cache: maven | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@220272d38887a1caed373da96a9ffdb0919c26cc # beta | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read | |
| allowed_tools: "Bash(./mvnw*),Bash(./mvnw -Ppre-commit clean verify -DskipTests),Bash(./mvnw clean verify),Bash(./mvnw clean install),Bash(./mvnw -Ppre-commit clean verify -DskipTests -pl api-sheriff),Bash(./mvnw -Ppre-commit clean verify -DskipTests -pl integration-tests),Bash(./mvnw -Ppre-commit clean verify -DskipTests -pl benchmarks),Bash(./mvnw clean install -pl api-sheriff),Bash(./mvnw clean install -pl integration-tests),Bash(./mvnw clean install -pl benchmarks),Bash(git*),Bash(find*),Bash(gh*),Bash(java*)" |