Add Claude Code GitHub Workflow

[michaelmagan]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code documentation.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
showcase	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	May 23, 2025 5:53pm

[charliecreates]

Workflow works, but 1) write permissions are missing, 2) action version is not pinned, and 3) adding a manual trigger would ease testing. Addressing these will prevent runtime failures and mitigate supply-chain risk.

Additional notes (1)

• Maintainability | .github/workflows/claude.yml:3-12
  This workflow lacks workflow_dispatch (or workflow_call) in the on: block, which means it can’t be triggered manually for testing or ad-hoc runs. While not strictly required, having a manual trigger is a common best-practice for new workflows so you can validate changes without spamming production events.

Summary of changes

Added Claude Code GitHub Actions workflow (.github/workflows/claude.yml)

• Declares a new workflow named Claude Code.
• Listens to several comment-related events (issue_comment, pull_request_review_comment, pull_request_review, and selected issues events).
• Uses an if: guard to run only when a @claude mention is present.
• Checks out the repository with actions/checkout@v4.
• Executes anthropics/claude-code-action@beta, passing secrets.ANTHROPIC_API_KEY.
• Grants minimal explicit permissions (contents, pull-requests, issues all read, plus id-token: write).

[charliecreates]

The action that powers Claude will need to write to the repository (e.g. opening PRs, committing changes, or posting comments). Granting only read permissions to contents and pull-requests is likely to cause authorization failures at runtime and defeats the purpose of the integration. Granting the minimal required write scopes keeps the principle of least privilege while still allowing Claude to function.

Suggestion

Update the permission block:

permissions:
  contents: write         # allow committing / pushing branches
  pull-requests: write    # allow creating / updating PRs
  issues: write           # allow commenting on issues/PRs
  id-token: write         # required for OIDC

Reply with "@CharlieHelps yes please" if you'd like me to add a commit with this suggestion.

[charliecreates]

Pinning an action to a floating tag (@beta) introduces supply-chain risk because the referenced code can change unexpectedly. GitHub’s security guidance recommends pinning to a commit SHA or at least a versioned tag to guarantee immutability.

Suggestion

Replace anthropics/claude-code-action@beta with a specific version or SHA, e.g.:

uses: anthropics/claude-code-action@<commit-sha>

Reply with "@CharlieHelps yes please" if you'd like me to add a commit with this suggestion.