Add Claude dispatcher for cross-repo PRs

[JaviChulvi]

Generate claude code token for subscription billing: claude setup-token (expires in 1 year)
gh secret set CLAUDE_CODE_OAUTH_TOKEN --repo ultralytics/actions

create a separate PAT for Claude Code (?)

Initial version, future plan:

• Do we need skills to perform usual tasks more efficiently? issue study, bug fixes and verifications before creating the PR?
• Token rotation if we exceed subscription limits
• What if claude exceeds max_turns or max timeout-minutes? What if we want it to investigate and create a branch for us then we take over from that point? Improve hand over process based on use cases.

🛠️ PR Summary

_{Made with ❤️ by Ultralytics Actions}

🌟 Summary

Adds a new GitHub Actions workflow that centrally dispatches Claude Code tasks to target repositories and automatically opens PRs with generated changes. 🤖

📊 Key Changes

• Introduces .github/workflows/claude-dispatcher.yml with manual workflow_dispatch inputs for target repo, prompt, Claude model, and max turns.
• Checks out the selected target repository using a PAT, installs Claude Code, and runs Claude with authenticated gh CLI access for issue/PR context gathering.
• Captures Claude run metadata in the workflow summary, continues on non-zero Claude exits to preserve partial work, and opens a PR when file changes are produced.
• Generates branch names, commit titles, and PR bodies automatically from the provided prompt and Claude JSON output.

🎯 Purpose & Impact

• Enables centralized automation for cross-repo implementation tasks, reducing manual setup for AI-assisted maintenance. ⚙️
• Improves traceability by opening PRs directly in the target repository with Claude’s result summary as the PR body.
• Adds safeguards to avoid opening empty PRs and to surface Claude execution status for easier debugging. ✅

[github-actions]

All Contributors have signed the CLA. ✅
_{Posted by the CLA Assistant Lite bot.}

[UltralyticsAssistant]

👋 Hello @JaviChulvi, thank you for submitting a ultralytics/actions 🚀 PR! This automated comment is here to help with the review process, and an Ultralytics engineer will assist you soon. To ensure a seamless integration of your Claude dispatcher workflow, please review the following checklist:

• ✅ Define a Purpose: Clearly explain the purpose of your fix or feature in your PR description, and link to any relevant issues. Ensure your commit messages are clear, concise, and adhere to the project's conventions.
• ✅ Synchronize with Source: Confirm your PR is synchronized with the ultralytics/actions main branch. If it's behind, update it by clicking the 'Update branch' button or by running git pull and git merge main locally.
• ✅ Ensure CI Checks Pass: Verify all Ultralytics Continuous Integration (CI) checks are passing. If any checks fail, please address the issues.
• ✅ Update Documentation: Update the relevant documentation for any new or modified features.
• ✅ Add Tests: If applicable, include or update tests to cover your changes, and confirm that all tests are passing.
• ✅ Sign the CLA: Please ensure you have signed our Contributor License Agreement if this is your first Ultralytics PR by writing "I have read the CLA Document and I sign the CLA" in a new message.
• ✅ Minimize Changes: Limit your changes to the minimum necessary for your bug fix or feature addition. "It is not daily increase but daily decrease, hack away the unessential. The closer to the source, the less wastage there is." — Bruce Lee

For more guidance, please refer to our Contributing Guide. Don't hesitate to leave a comment if you have any questions. Thank you for contributing to Ultralytics! 🚀

[UltralyticsAssistant]

🔍 PR Review

_{Made with ❤️ by Ultralytics Actions}

Found two issues: the workflow gives Claude an org-wide write token in an untrusted prompt context, and PR creation can still fail when Claude leaves partial changes but invalid/missing JSON output. Otherwise the dispatcher flow is straightforward.

💬 Posted 2 inline comments

[UltralyticsAssistant]

⚠️ HIGH: This exposes an org read/write PAT to Claude while also instructing it to ingest issue/PR comments. A malicious prompt or referenced issue comment can ask Claude to run shell commands that read GH_TOKEN and exfiltrate or use it across the org. Please avoid giving the agent an org-wide write token; use a fine-grained GitHub App/PAT scoped only to the selected target repo and required permissions, and keep any broader token out of the Claude execution environment.

[UltralyticsAssistant]

💡 MEDIUM: If Claude exits after producing file changes but writes empty/malformed/no JSON, this jq command fails under set -e and prevents the PR from being opened, which defeats the earlier logic to preserve partial work after non-zero Claude exits. Add a fallback around jq so partial changes still get pushed and opened.

Suggested change:

Suggested change

	BODY="$(jq -r '.result // "Automated change via the Claude dispatcher."' "$RUNNER_TEMP/result.json")"
	BODY="$(jq -r '.result // "Automated change via the Claude dispatcher."' "$RUNNER_TEMP/result.json" 2>/dev/null || echo "Automated change via the Claude dispatcher.")"

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[JaviChulvi]

I have read the CLA Document and I sign the CLA