Add Claude Code GitHub Workflow - #7411
Conversation
Greptile SummaryThis PR introduces two GitHub Actions workflows:
Confidence Score: 3/5Not safe to merge — both workflows will fail to perform any write operations due to missing permissions, making the Claude integration non-functional after merge. Two P1 findings: both workflows lack the write permissions required for Claude to post comments, create commits, or create branches. The PR description explicitly calls these out as core features, but they will all fail silently or with 403 errors until permissions are corrected. Both .github/workflows/claude.yml and .github/workflows/claude-code-review.yml need their permissions blocks updated before merging.
|
| Filename | Overview |
|---|---|
| .github/workflows/claude.yml | Adds Claude Code on-demand workflow triggered by @claude mentions; missing write permissions on contents/pull-requests/issues will prevent Claude from creating comments, commits, or branches |
| .github/workflows/claude-code-review.yml | Adds automated Claude Code Review on every PR open/sync event; missing pull-requests: write will prevent the action from posting any review output |
Sequence Diagram
sequenceDiagram
participant User
participant GitHub
participant claude_yml as claude.yml workflow
participant review_yml as claude-code-review.yml workflow
participant ClaudeAction as anthropics/claude-code-action@v1
participant AnthropicAPI as Anthropic API
User->>GitHub: Comment with @claude on issue/PR
GitHub->>claude_yml: Trigger (issue_comment / pr_review_comment)
claude_yml->>ClaudeAction: Run with CLAUDE_CODE_OAUTH_TOKEN
ClaudeAction->>AnthropicAPI: Authenticate and send context
AnthropicAPI-->>ClaudeAction: Response + actions
ClaudeAction->>GitHub: Create comment / commit / branch (needs write perms ⚠️)
User->>GitHub: Open or update PR
GitHub->>review_yml: Trigger (pull_request opened/synchronize)
review_yml->>ClaudeAction: Run with plugin code-review
ClaudeAction->>AnthropicAPI: Authenticate and send PR diff
AnthropicAPI-->>ClaudeAction: Review output
ClaudeAction->>GitHub: Post PR review comment (needs pull-requests: write ⚠️)
Reviews (1): Last reviewed commit: ""Claude Code Review workflow"" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs |
There was a problem hiding this comment.
The PR description states Claude will create comments, branches, and commits, but the permissions block grants only read on contents, pull-requests, and issues. GitHub Actions' GITHUB_TOKEN will be used by the action, and without write grants it cannot post issue/PR comments, push commits, or create branches — the primary use cases described. The action will either silently fail or throw a 403 when attempting any write operation.
Required additions:
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs |
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write |
There was a problem hiding this comment.
pull-requests: write prevents posting review comments
The review workflow needs to post comments on PRs but pull-requests is set to read. Without write access the action cannot publish any review output and will silently produce no visible result.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: read | |
| id-token: write |
| # This is an optional setting that allows Claude to read CI results on PRs | ||
| additional_permissions: | | ||
| actions: read |
There was a problem hiding this comment.
actions: read in additional_permissions
actions: read is already declared in the job-level permissions block on line 26, so specifying it again as an action input is redundant. The additional_permissions input is interpreted by the action itself and may have no effect at the workflow level — the job-level declaration is what GitHub enforces.
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 1 | ||
|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
Both actions/checkout@v4 and anthropics/claude-code-action@v1 use mutable version tags. If a tag is moved (intentionally or via a supply chain compromise), the workflow will silently pick up different code. Pin to a full commit SHA for security, e.g.:
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
uses: anthropics/claude-code-action@<full-sha> # v1
This applies to the same two uses: lines in claude-code-review.yml as well.
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!