Add Claude Workflows by strawgate · Pull Request #48594 · elastic/beats

strawgate · 2026-01-29T04:23:49Z

Add Claude workflows for @claude in issues, pull requests, and automated pull request reviews.

Restricted to: strawgate,AlexanderWert,perk,graphaelli,cmacknz,axw,theletterf,jlind23,nimarezainia,pierrehilbert,bturquet

botelastic · 2026-01-29T04:23:57Z

This pull request doesn't have a Team:<team> label.

github-actions · 2026-01-29T04:24:00Z

🤖 GitHub comments

Just comment with:

run docs-build : Re-trigger the docs validation. (use unformatted text in the comment!)

mergify · 2026-01-29T04:24:28Z

This pull request does not have a backport label.
If this is a bug or security fix, could you label this PR @strawgate? 🙏.
For such, you'll need to label your PR with:

The upcoming major version of the Elastic Stack
The upcoming minor version of the Elastic Stack (if you're not pushing a breaking change)

To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

backport-8./d is the label to automatically backport to the 8./d branch. /d is the digit
backport-active-all is the label that automatically backports to all active branches.
backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

v1v

I left a fw comments:

update versions
git depth 0
checkout PR
configure tools for running Claude
github secret onboarding

One last thing, if it helps, we have all logs/traces for the GitHub actions running at Elastic in ECH. I wonder whether the Build Failure analysis could be performed outside this GitHub workflow and in an agnostic manner using Elastic, so that when we ingest logs for Buildkite builds, we can work in both scenarios.

v1v · 2026-01-29T08:03:15Z

.github/workflows/claude-build-failure.yml

+      - name: Check if all required workflows have completed
+        id: check-workflows
+        if: github.event.workflow_run.event == 'pull_request'
+        uses: actions/github-script@v7


https://github.com/actions/github-script/releases/tag/v8

Suggested change

uses: actions/github-script@v7

uses: actions/github-script@v8

v1v · 2026-01-29T08:04:48Z

.github/workflows/claude-build-failure.yml

+      - name: Checkout
+        if: steps.check-workflows.outputs.should_run != 'false'
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Setup Go
+        if: steps.check-workflows.outputs.should_run != 'false'
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: .go-version
+
+      - name: Setup Python
+        if: steps.check-workflows.outputs.should_run != 'false'
+        uses: actions/setup-python@v6
+        with:
+          python-version-file: .python-version
+
+      - name: Install system dependencies
+        if: steps.check-workflows.outputs.should_run != 'false'
+        run: sudo apt-get update && sudo apt-get install -y libpcap-dev librpm-dev python3-venv
+
+      - name: Install Mage
+        if: steps.check-workflows.outputs.should_run != 'false'
+        run: make mage


What's the reason the build failure analyser requires the golang and python context?

v1v · 2026-01-29T08:05:10Z

.github/workflows/claude-build-failure.yml

+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0


What's the reason for checking out the whole git history?

v1v · 2026-01-29T08:06:14Z

.github/workflows/claude-build-failure.yml

+        if: steps.check-workflows.outputs.should_run != 'false'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}


we have a process to onboard GitHub secrets, so we track who created and how to rotated, this is not a blocker, we can work on this together

v1v · 2026-01-29T08:07:09Z

.github/workflows/claude-build-failure.yml

+
+      - name: Checkout
+        if: steps.check-workflows.outputs.should_run != 'false'
+        uses: actions/checkout@v6


This will checkout the main branch always, is that expected? or checking out the PR that failed instead?

v1v · 2026-01-29T08:08:19Z

.github/workflows/claude-issue-triage.yml

@@ -0,0 +1,46 @@
+name: Claude Issue Triage


What's the reason for installing the go/python tools for running the issue triage process?

v1v · 2026-01-29T08:09:02Z

.github/workflows/claude-issue-triage.yml

+        with:
+          fetch-depth: 0


What's the reason for using depth 0?

v1v · 2026-01-29T08:11:15Z

.github/workflows/claude-mention-pr.yml

+          GITHUB_TOKEN: ${{ github.token }}
+        run: gh pr checkout ${{ github.event.issue.number }}
+
+      - uses: actions/setup-go@v5


Suggested change

- uses: actions/setup-go@v5

- uses: actions/setup-go@v6

v1v · 2026-01-29T08:11:31Z

.github/workflows/claude-mention-pr.yml

+        with:
+          fetch-depth: 0


why depth 0?

v1v · 2026-01-29T08:11:52Z

.github/workflows/claude-mention-pr.yml

+  contents: write
+  pull-requests: write
+  issues: write
+  id-token: write


what's the reason for using id-token: write?

v1v · 2026-01-29T08:25:27Z

.github/workflows/claude-build-failure.yml

+  actions: read
+  issues: write
+  pull-requests: write
+  id-token: write


what's the reason for this permission?

v1v · 2026-01-29T08:26:45Z

.github/workflows/claude-build-failure.yml

+permissions:
+  contents: read
+  actions: read
+  issues: write
+  pull-requests: write
+  id-token: write


nit:

We follow the least-permissive access:

top permissions (contents: read)

job permissions (the required ones)

This framework allows us to handle multiple jobs within the same workflow while enforcing the least-permissive access.

v1v

Approved as I don't see any blockers, just some minor and nit comments we can walk through together in a follow-up.

v1v · 2026-01-29T12:54:38Z

.github/workflows/claude-mention-issue.yml

+    types: [created]
+
+permissions:
+  contents: write


What's the reason to enable contents: write permissions here?

There is one caveat when using GITHUB_TOKEN and push a commit, it will not trigger any GitHub workflows (to avoid recurrency), see https://docs.github.com/en/actions/concepts/security/github_token#when-github_token-triggers-workflow-runs

For example, if a workflow run pushes code using the repository's GITHUB_TOKEN, a new workflow will not run even when the repository contains a workflow configured to run when push events occur.

strawgate · 2026-02-03T15:25:11Z

this is wip and the current version is in the integrations repo

Add Claude Workflows to repository

cd86d90

strawgate requested a review from a team as a code owner January 29, 2026 04:23

botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Jan 29, 2026

mergify bot assigned strawgate Jan 29, 2026

Add additional users

98b1615

strawgate changed the title ~~Add Claude Workflows to repository~~ Add Claude Workflows Jan 29, 2026

jlind23 added the skip-changelog label Jan 29, 2026

jlind23 approved these changes Jan 29, 2026

View reviewed changes

v1v reviewed Jan 29, 2026

View reviewed changes

v1v approved these changes Jan 29, 2026

View reviewed changes

v1v reviewed Jan 29, 2026

View reviewed changes

	uses: actions/github-script@v7
	uses: actions/github-script@v8

Conversation

strawgate commented Jan 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

botelastic bot commented Jan 29, 2026

Uh oh!

github-actions bot commented Jan 29, 2026

🤖 GitHub comments

Uh oh!

mergify bot commented Jan 29, 2026

Uh oh!

v1v left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

v1v left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

strawgate commented Feb 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

strawgate commented Jan 29, 2026 •

edited

Loading