Add Claude Code GitHub Workflow - #16
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughWalkthroughTwo GitHub Actions workflows were added to invoke the Claude Code Action: one runs automated code reviews on PR lifecycle events, the other runs Claude in response to Changes
Sequence Diagram(s)sequenceDiagram
participant User as User (author/commenter)
participant GitHub as GitHub Events
participant Runner as Actions Runner
participant Repo as Repository (checkout)
participant Claude as Claude Service
User->>GitHub: open PR / add comment with `@claude`
GitHub->>Runner: trigger workflow (claude-code-review / claude)
Runner->>Repo: actions/checkout (fetch-depth:1)
Runner->>Claude: anthropics/claude-code-action@v1 (with token & plugins)
Claude-->>Runner: review result / response
Runner->>GitHub: post comment or PR review with Claude output
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip Migrating from UI to YAML configuration.Use the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Line 26: Remove the unnecessary OIDC permission by deleting the "id-token:
write" entry when using the claude_code_oauth_token OAuth flow; update the
workflow permissions block so it does not request id-token and instead only
declares the specific repository permissions required (e.g., contents, issues,
pull-requests) to follow least-privilege—ensure references to "id-token: write"
are removed and that the workflow still authenticates via
"claude_code_oauth_token".
- Line 30: Replace the mutable action tags with immutable SHAs: locate the
workflow step that references actions/checkout@v4 and change it to the full
commit SHA for that actions/checkout release, and similarly locate the step
using anthropics/claude-code-action@v1 and replace it with that action's full
commit SHA; ensure you pin both uses to their respective full commit SHAs (not
tags) in the .github/workflows/claude-code-review.yml file so the workflow
references an immutable commit.
In @.github/workflows/claude.yml:
- Line 29: Replace mutable GitHub Action tags with immutable commit SHAs: change
the uses entry that currently has "actions/checkout@v4" to
"actions/checkout@<commit-sha>" and similarly replace
"anthropics/claude-code-action@v1" with
"anthropics/claude-code-action@<commit-sha>" (use the specific commit SHAs from
each repository's release/commit you want to pin), updating the two uses lines
in the workflow so they reference the exact commit SHAs instead of version tags.
- Around line 15-20: Current trigger condition only checks for the '@claude'
token and allows any commenter to run the workflow; add an authorization gate by
requiring a trusted actor association or explicit allowlist. Update the if
expression to also check github.event.comment.author_association (and
github.event.review.author_association / github.event.issue.author_association
as applicable) is in a set like ['OWNER','MEMBER','COLLABORATOR'] or that
github.actor is in an explicit allowlist variable, so only trusted actors can
trigger the workflow when '@claude' is present.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 2c4538f2-6236-478f-a5f3-f89947216abf
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml.github/workflows/claude.yml
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
For anthropics/claude-code-action, when using claude_code_oauth_token, is permissions: id-token: write required? Please cite the official docs and minimum recommended permissions.
💡 Result:
No, permissions: id-token: write is not required when using claude_code_oauth_token in anthropics/claude-code-action. This permission is specifically needed for OIDC authentication with the default GitHub App (Claude app) or cloud providers like Bedrock/Vertex, where the action requests an OIDC token to exchange for a GitHub app token. The claude_code_oauth_token is an alternative authentication method for Anthropic/Claude (for Pro/Max users, generated via claude setup-token), which bypasses the need for API keys and OIDC flows entirely. It passes the OAuth token directly to Claude Code execution via environment variable CLAUDE_CODE_OAUTH_TOKEN, handling only Claude API auth, not GitHub token generation. Minimum recommended permissions (from official docs/setup.md and examples): For repository access (contents, issues, PRs), use: permissions: contents: write issues: write pull-requests: write actions: read # Optional, for viewing workflow results via additional_permissions input No id-token: write needed. If using a custom GitHub App token via github_token input, generate it separately with actions/create-github-app-token and omit OIDC perms. Official sources confirming: - action.yml lists claude_code_oauth_token separately from OIDC flags (use_bedrock, use_vertex). - FAQ explicitly ties id-token: write to "default GitHub App authentication" (OIDC), with workaround to provide github_token instead. - Setup docs recommend repo perms for Contents/Issues/PRs when using custom apps, no OIDC mention for direct auth. - OAuth added via PR #236 as API key alternative, no GitHub auth changes.
Citations:
- 1: https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
- 2: https://github.com/anthropics/claude-code-action/blob/main/docs/setup.md
- 3: https://github.com/anthropics/claude-code-action
- 4: https://github.com/anthropics/claude-code-action/blob/main/docs/faq.md
- 5: Generated workflows missing id-token:write permission and trigger on bot's own comments anthropics/claude-code-action#625
- 6: feat: add OAuth token authentication support anthropics/claude-code-action#236
- 7: https://git.homeinfra.org/actions/claude-code-action/src/commit/3ba9f7c8c2d3f122d3465c267a87b26a1f4783a6/base-action/action.yml
Remove id-token: write permission when using claude_code_oauth_token.
The id-token: write permission is only required for OIDC authentication with the default GitHub App. When using claude_code_oauth_token (OAuth alternative), the OIDC flow is bypassed entirely. According to the official documentation and action configuration, this permission should be removed to follow the principle of least privilege. If repository access (contents, issues, PRs) is needed, include only those permissions instead.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-review.yml at line 26, Remove the unnecessary
OIDC permission by deleting the "id-token: write" entry when using the
claude_code_oauth_token OAuth flow; update the workflow permissions block so it
does not request id-token and instead only declares the specific repository
permissions required (e.g., contents, issues, pull-requests) to follow
least-privilege—ensure references to "id-token: write" are removed and that the
workflow still authenticates via "claude_code_oauth_token".
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify all workflows use immutable SHAs instead of tags.
rg -n --type=yaml 'uses:\s*[^@]+@v?[0-9]+(\.[0-9]+)?$' .github/workflowsRepository: rosh2004/portfolio
Length of output: 375
Pin third-party actions to immutable SHAs to reduce supply-chain risk.
Lines 30 and 36 use mutable version tags (@v4 and @v1 respectively). Replace these with full commit SHAs:
- Line 30:
actions/checkout@v4→actions/checkout@<full-commit-sha> - Line 36:
anthropics/claude-code-action@v1→anthropics/claude-code-action@<full-commit-sha>
Mutable tags can be changed without notice, allowing attackers to inject malicious code through action updates.
Suggested fix
- - name: Checkout repository
- uses: actions/checkout@v4
+ - name: Checkout repository
+ uses: actions/checkout@<full-commit-sha>
@@
- - name: Run Claude Code Review
- id: claude-review
- uses: anthropics/claude-code-action@v1
+ - name: Run Claude Code Review
+ id: claude-review
+ uses: anthropics/claude-code-action@<full-commit-sha>🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-review.yml at line 30, Replace the mutable
action tags with immutable SHAs: locate the workflow step that references
actions/checkout@v4 and change it to the full commit SHA for that
actions/checkout release, and similarly locate the step using
anthropics/claude-code-action@v1 and replace it with that action's full commit
SHA; ensure you pin both uses to their respective full commit SHAs (not tags) in
the .github/workflows/claude-code-review.yml file so the workflow references an
immutable commit.
| actions: read # Required for Claude to read CI results on PRs | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Locate all unpinned GitHub Action references.
rg -n --type=yaml 'uses:\s*[^@]+@v?[0-9]+(\.[0-9]+)?$' .github/workflowsRepository: rosh2004/portfolio
Length of output: 375
Pin GitHub Actions to immutable commit SHAs.
Lines 29 and 35 use mutable version tags (v4 and v1). Replace with specific commit SHAs:
actions/checkout@v4→actions/checkout@<commit-sha>anthropics/claude-code-action@v1→anthropics/claude-code-action@<commit-sha>
This prevents unexpected behavior from tag mutations and improves supply chain security.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude.yml at line 29, Replace mutable GitHub Action tags
with immutable commit SHAs: change the uses entry that currently has
"actions/checkout@v4" to "actions/checkout@<commit-sha>" and similarly replace
"anthropics/claude-code-action@v1" with
"anthropics/claude-code-action@<commit-sha>" (use the specific commit SHAs from
each repository's release/commit you want to pin), updating the two uses lines
in the workflow so they reference the exact commit SHAs instead of version tags.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| # - "src/**/*.ts" | ||
| # - "src/**/*.tsx" | ||
| # - "src/**/*.js" | ||
| # - "src/**/*.jsx" |
There was a problem hiding this comment.
Missing concurrency group causes duplicate code reviews
Medium Severity
The workflow triggers on synchronize (every push to a PR) but has no concurrency group with cancel-in-progress: true. When a developer pushes multiple commits in quick succession, multiple code review runs will execute simultaneously for the same PR, producing duplicate review comments and wasting API credits. This is a known issue with claude-code-action on synchronize events. A concurrency group keyed on the PR number would cancel stale runs.
Additional Locations (1)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Note
Medium Risk
Adds new GitHub Actions that run third-party automation with
id-token: writeand a repository secret, so misconfiguration could impact repo security or leak credentials despite the actor/author gating.Overview
Adds two new GitHub Actions workflows to integrate
anthropics/claude-code-action@v1.claude.ymlruns Claude on-demand when comments/reviews/issues contain@claude(gated togithub.actor == 'rosh2004') and grants read access plusactions: readandid-token: write.claude-code-review.ymltriggers automated PR reviews on PR events (also gated to PRs opened byrosh2004) using thecode-reviewplugin and a fixed review prompt, authenticated viaCLAUDE_CODE_OAUTH_TOKEN.Written by Cursor Bugbot for commit b8599c2. This will update automatically on new commits. Configure here.
Summary by CodeRabbit