Add Claude Code GitHub Workflow

[rameerez]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[claude]

Code Review: Claude Code GitHub Workflow Integration

I've reviewed PR #5 which adds Claude Code GitHub Actions workflows to the repository. Here's my feedback:

✅ Positive Changes

1. Version Update (Critical)

• Updated from @beta to @v1 - this is an important stability improvement
• Using stable releases ensures more predictable behavior and better support

2. Improved Configuration Structure

• Consolidated workflow configuration is cleaner and more maintainable
• The claude-code-review.yml workflow now uses the prompt parameter instead of direct_prompt, which aligns with the v1 API
• Better use of claude_args for tool permissions instead of inline configuration

3. Clear Documentation

• Helpful comments with links to official documentation
• The PR description provides clear context about what Claude Code is and how it works

🔍 Code Quality & Best Practices

General Structure: Good

• YAML syntax is correct and well-formatted
• Proper use of GitHub Actions permissions (principle of least privilege)
• Conditional logic in claude.yml is comprehensive and handles multiple event types correctly

Permissions: Appropriate

• Both workflows use minimal necessary permissions
• id-token: write is required for OAuth
• actions: read is correctly set for reading CI results

⚠️ Observations & Recommendations

1. Whitespace Changes

• Lines 20 and 27 in claude-code-review.yml: Trailing whitespace was removed (good cleanup)
• This is a minor improvement for code cleanliness

2. Allowed Tools Configuration
The claude_args in claude-code-review.yml:56 grants specific gh command permissions

Security Consideration: This is appropriately restrictive - Claude can only read and comment on PRs/issues but cannot merge PRs, close issues, push code, or modify repository settings. This follows security best practices. ✅

3. Missing Configuration
The claude.yml workflow doesn't specify allowed_tools (line 49 is commented out). Consider whether the interactive @claude mentions should also have restricted tool access for consistency.

4. Prompt References CLAUDE.md
Line 50 in claude-code-review.yml references a CLAUDE.md file that doesn't exist in the repository.

Recommendation: Either remove this line from the prompt, or create a CLAUDE.md file with coding standards specific to this Rails gem (Ruby style guide, testing requirements, etc.)

🐛 Potential Issues

None identified - The workflows are well-structured and should function correctly.

⚡ Performance Considerations

• fetch-depth: 1 is correctly used in both workflows for shallow clones (good for performance)
• Workflows are triggered appropriately (not over-triggering)
• No performance concerns

🔒 Security Assessment

Strong Security Posture:

1. OAuth token is properly stored in secrets
2. Tool permissions are restrictive and appropriate
3. Only users with write access can trigger workflows
4. No hardcoded credentials or sensitive data
5. Uses official Anthropic action from verified publisher

No security concerns identified. ✅

🧪 Test Coverage

Not applicable - These are workflow configuration files. However, after merging:

Post-Merge Testing Recommendations:

1. Test the auto-review workflow by creating a test PR
2. Test the @claude mention workflow by commenting on an issue
3. Verify that the gh pr comment command works correctly
4. Check that Claude can access the PR context as expected

✨ Summary

This is a well-implemented PR that adds valuable AI-assisted code review capabilities to the repository. The changes:

• ✅ Update to stable version (@v1)
• ✅ Follow security best practices
• ✅ Have appropriate permissions
• ✅ Are well-documented
• ⚠️ Reference a non-existent CLAUDE.md file (minor issue)
• ⚠️ Could benefit from tool restrictions in claude.yml

Recommendation: Approve with minor suggestions

The non-existent CLAUDE.md reference won't break functionality (Claude will simply note the file doesn't exist), but addressing it would improve the setup. Otherwise, this PR is ready to merge.

---

Review performed by Claude Code