Add Claude Code GitHub Workflow #247
Conversation
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughTwo new GitHub Actions workflows are introduced to integrate Claude AI for code review and analysis. The first workflow automatically reviews pull requests on PR events. The second workflow responds to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~12 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/claude-code-review.yml (2)
22-26: Simplify permissions—issues:readmay be unnecessary.The
issues:readpermission is not required for reviewing pull requests. This workflow only needs to read PR context and write tokens. Consider removing it to follow the principle of least privilege.permissions: contents: read pull-requests: read - issues: read id-token: write
37-56: Consider adding an early validation step forCLAUDE_CODE_OAUTH_TOKENfor faster feedback, though the action includes built-in error handling.The
anthropics/claude-code-actionperforms validation and reports errors with structured messages when secrets are missing. However, adding explicit validation before invoking the action provides earlier failure detection and clearer error messaging at the workflow level, rather than within the action execution.You can add the validation step for better user experience:
- name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 0 + - name: Validate Claude Code OAuth token + run: | + if [ -z "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}" ]; then + echo "❌ Error: CLAUDE_CODE_OAUTH_TOKEN secret is not configured" + exit 1 + fi - name: Run Claude Code ReviewAlternatively, documenting the requirement in CONTRIBUTING.md or README is sufficient since the action will catch missing secrets.
.github/workflows/claude.yml (1)
28-31: Consider increasingfetch-depthfor more complete context in Claude analysis.A shallow clone with
fetch-depth: 1limits Claude's access to repository history, which may impact its ability to analyze code context, understand changes, and provide comprehensive responses. While Anthropic's documented examples usefetch-depth: 1, general best practices for AI-powered code analysis recommendfetch-depth: 0to provide full Git history for better context awareness.- name: Checkout repository uses: actions/checkout@v4 with: - fetch-depth: 1 + fetch-depth: 0Note: This increases clone time and storage but provides Claude with full repository context for analysis.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml(1 hunks).github/workflows/claude.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build
🔇 Additional comments (3)
.github/workflows/claude.yml (2)
15-19: Verify trigger and conditional coverage for all @claude mention scenarios.The conditional logic comprehensively covers all event types and checks for @claude mentions in the relevant fields (comment bodies, review bodies, issue body, and title). This is well-structured.
One minor clarification: ensure that the
issuestrigger withtypes: [opened, assigned]is intentional. If the goal is only to trigger on new issues mentioning @claude,openedis sufficient;assignedmay trigger even if the issue body/title doesn't mention @claude (the condition will filter it, but consider whether this is the intended trigger scope).
40-41: Theadditional_permissionsfield is a documented feature ofanthropics/claude-code-actiondesigned to specify which GitHub token permissions the action requires. It is not redundant with the workflow-levelpermissionsblock—rather, it works alongside it. Thepermissionsblock grants the token access, whileadditional_permissionstells the action which permissions to utilize (e.g., to read CI results on PRs). Removing this field would break the intended functionality. No changes needed.Likely an incorrect or invalid review comment.
.github/workflows/claude-code-review.yml (1)
29-32: Increasefetch-depthto enable proper PR diff analysis.A shallow clone with
fetch-depth: 1only retrieves the current commit and cannot compute diffs or merge-base information needed for code review. Claude's analysis requires access to the changes between the base and head branches. Usefetch-depth: 0to fetch full git history:- name: Checkout repository uses: actions/checkout@v4 with: - fetch-depth: 1 + fetch-depth: 0
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.