Add Claude Code GitHub Workflow

[AnnatarHe]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[claude]

Claude Code Review - PR #4

Thank you for adding Claude Code integration to the repository! I've reviewed the changes and have the following feedback:

✅ Positive Aspects

1. Modern Action Version: Correctly updated from @beta to @v1 for stable production use
2. Security Improvement: Changed from anthropic_api_key to claude_code_oauth_token, which is more secure and follows OAuth best practices
3. Runner Update: Changed from custom jp-arm-oracle to standard ubuntu-latest for better portability and maintenance
4. Proper Permissions: Correctly scoped permissions (read-only for contents, PRs, and issues)
5. Trigger Pattern Change: Updated from /claude command to @claude mention pattern, which is more intuitive

🔍 Issues & Concerns

1. Missing pull-requests: write Permission (Critical)

Location: .github/workflows/claude-code-review.yml:22-26

Issue: Claude Code needs write permission to comment on PRs, but only has read permission.

Current:

permissions:
  contents: read
  pull-requests: read  # ❌ This should be write
  issues: read
  id-token: write

Recommended:

permissions:
  contents: read
  pull-requests: write  # ✅ Required for gh pr comment
  issues: read
  id-token: write

Impact: The review workflow will fail when trying to post comments using gh pr comment.

---

2. Inconsistent Permissions Between Workflows

Location: Both workflow files

Issue: The claude-code-review.yml workflow lacks write permissions that claude.yml has.

Recommendation: Consider whether code reviews should have the same capabilities as interactive Claude sessions. If reviews should post comments directly, they need pull-requests: write permission.

---

3. Missing reopened Trigger

Location: .github/workflows/claude-code-review.yml:4

Issue: Removed the reopened trigger, which means PRs that are closed and reopened won't be reviewed.

Current: types: [opened, synchronize]
Previous: types: [opened, synchronize, reopened]

Recommendation: Consider re-adding reopened if you want reviews on reopened PRs.

---

4. Reduced Checkout Depth May Cause Issues

Location: .github/workflows/claude-code-review.yml:32

Issue: Changed fetch-depth from 0 (full history) to 1 (shallow clone).

Current: fetch-depth: 1
Previous: fetch-depth: 0

Impact:

• Claude won't have access to git history for context
• Can't analyze previous commits or run git log commands effectively
• May affect understanding of code evolution

Recommendation: Consider using fetch-depth: 0 or at least fetch-depth: 10 for better context, especially for code reviews.

---

5. Removed Custom Review Instructions

Location: .github/workflows/claude-code-review.yml:39-52

Issue: The new prompt is more generic and doesn't mention Kotlin, JetBrains, or IntelliJ Platform specifics.

Previous:

Please review this PR for:
1. Code quality and Kotlin best practices
2. Potential bugs or logic errors
3. Security vulnerabilities
4. Performance issues
5. Test coverage
6. Documentation

Focus on JetBrains plugin development patterns and IntelliJ Platform API usage.

Current:

Please review this pull request and provide feedback on:
- Code quality and best practices
- Potential bugs or issues
- Performance considerations
- Security concerns
- Test coverage

Use the repository's CLAUDE.md for guidance on style and conventions.

Recommendation: The new version relies on CLAUDE.md for context, which is good. However, you might want to explicitly mention "Focus on Kotlin and JetBrains plugin development patterns" if that's important.

---

6. Tool Restrictions May Be Too Limiting

Location: .github/workflows/claude-code-review.yml:56

Issue: The claude_args limits Claude to only gh commands. This prevents using other bash commands that might be useful for reviews (like gradle commands mentioned in CLAUDE.md).

Current:

claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'

Recommendation: Consider whether Claude should be able to run build/test commands:

claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(./gradlew test),Bash(./gradlew verifyPlugin)"'

---

🤔 Questions

1. Secret Migration: Have you created the CLAUDE_CODE_OAUTH_TOKEN secret in the repository settings? The old ANTHROPIC_API_KEY will no longer work.

2. Cost Consideration: Automatic reviews on every PR update (synchronize) can get expensive. Have you considered limiting this to specific conditions (e.g., only external contributors)?

3. File Path Filters: The commented-out path filters reference TypeScript/JavaScript files, but this is a Kotlin project. Consider updating to:

   paths:
     - "src/**/*.kt"
     - "src/**/*.kts"
     - "build.gradle.kts"

---

📝 Minor Suggestions

1. Workflow Names: Consider more descriptive names:

   • Claude Code Review → Claude Automated PR Review
   • Claude Code → Claude Interactive Assistant

2. Documentation: Update the PR description to mention the required secret name change from ANTHROPIC_API_KEY to CLAUDE_CODE_OAUTH_TOKEN.

---

🎯 Summary

Must Fix Before Merge:

• ❌ Add pull-requests: write permission to claude-code-review.yml

Strongly Recommended:

• ⚠️ Create CLAUDE_CODE_OAUTH_TOKEN secret before merging
• ⚠️ Consider increasing fetch-depth for better git context
• ⚠️ Update file path filters to match Kotlin files

Nice to Have:

• Re-add reopened trigger
• Consider allowing gradle commands for testing
• Update workflow names for clarity

Overall, this is a solid update to modernize the Claude Code integration. The main blocker is the missing write permission for PR comments. Once that's addressed, this should work well! 🚀

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

❌ Your project status has failed because the head coverage (14.49%) is below the target coverage (60.00%). You can increase the head coverage or adjust the target coverage.

@@           Coverage Diff           @@
##             main       #4   +/-   ##
=======================================
  Coverage   14.49%   14.49%           
=======================================
  Files          19       19           
  Lines         690      690           
  Branches      160      160           
=======================================
  Hits          100      100           
  Misses        558      558           
  Partials       32       32           

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0d91139...15d300b. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.