Add Claude Code GitHub Workflow #2839
Conversation
|
WalkthroughTwo new GitHub Actions workflows are added to the repository. The first workflow ( Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Pre-merge checks✅ Passed checks (3 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Updated claude_args to use a multi-line format and added model specification.
Review CompleteYour review story is ready! Comment !reviewfast on this PR to re-generate the story. |
Add claude_args to specify the model for Claude.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read |
There was a problem hiding this comment.
Insufficient permissions prevent Claude from commenting on PRs
High Severity
The workflow explicitly instructs Claude to use gh pr comment to leave review comments and includes Bash(gh pr comment:*) in allowed tools, but the permissions block only grants pull-requests: read. The gh CLI uses the workflow's GITHUB_TOKEN, which is constrained by these permissions. The command will fail with a 403 error because write access is required. Changing to pull-requests: write is needed for the workflow to function as designed.
| pull-requests: read | ||
| issues: read | ||
| id-token: write | ||
| actions: read # Required for Claude to read CI results on PRs |
There was a problem hiding this comment.
Read-only permissions block Claude from commenting and committing
High Severity
The PR description states Claude can "create comments, branches, and commits", but the workflow only grants read permissions for contents, pull-requests, and issues. When users mention @claude requesting actions that modify the repository or leave comments, those operations will fail because the GITHUB_TOKEN lacks write access. The permissions need to include write access for the intended operations to work.
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
Assigned event triggers Claude for stale @claude mentions
Medium Severity
The workflow triggers on issues: [opened, assigned] but the if condition on line 19 only checks if github.event.issue.body or title contains @claude. When an issue is assigned, the body/title is unchanged from when it was created. If an issue was created months ago with @claude in the body, assigning that issue today will re-trigger Claude responding to that old mention. The condition is missing a check for github.event.action == 'opened' to distinguish new mentions from stale ones, causing unintended duplicate Claude responses.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Fix all issues with AI Agents
In @.github/workflows/claude-code-review.yml:
- Around line 22-26: The workflow's permissions block grants only read access to
pull-requests, but the job uses the gh CLI to run "gh pr comment" which requires
write permission; update the permissions section by changing the pull-requests
permission from read to write (i.e., set pull-requests: write) so the "gh pr
comment" command can post comments; ensure the permissions block still includes
contents: read, issues: read, and id-token: write unchanged.
🧹 Nitpick comments (1)
.github/workflows/claude.yml (1)
39-41: Redundantadditional_permissionsforactions: read.The
actions: readpermission is already specified in the job-level permissions on line 26. Theadditional_permissionsinput here is redundant.🔎 Proposed cleanup
- # This is an optional setting that allows Claude to read CI results on PRs - additional_permissions: | - actions: read - claude_args: | --model claude-opus-4-5-20251101
📜 Review details
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml.github/workflows/claude.yml
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (19)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (1, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (5, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (6, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (8, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (5, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (2, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (7, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (1, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (3, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (4, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (4, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (3, 8)
- GitHub Check: units / webapp / 🧪 Unit Tests: Webapp (2, 8)
- GitHub Check: units / internal / 🧪 Unit Tests: Internal (7, 8)
- GitHub Check: units / packages / 🧪 Unit Tests: Packages (1, 1)
- GitHub Check: e2e / 🧪 CLI v3 tests (windows-latest - npm)
- GitHub Check: typecheck / typecheck
- GitHub Check: e2e / 🧪 CLI v3 tests (windows-latest - pnpm)
- GitHub Check: Cursor Bugbot
🔇 Additional comments (3)
.github/workflows/claude-code-review.yml (1)
34-58: Well-structured action configuration.The prompt clearly defines review criteria (code quality, bugs, performance, security, test coverage), and the
allowed-toolsrestriction limits Claude to specificghcommands, which is good for security. The explicit model specification ensures consistent behavior..github/workflows/claude.yml (2)
21-26: Consider adding write permissions for Claude to respond.Per the PR description, Claude should be able to "interact with the repository by creating comments, branches, and commits." With only read permissions for
contents,pull-requests, andissues, Claude won't be able to post responses or make changes. If Claude should respond to @claude mentions, you'll need write permissions.Please verify the intended behavior. If Claude should respond with comments:
permissions: - contents: read - pull-requests: read - issues: read + contents: write + pull-requests: write + issues: write id-token: write actions: read # Required for Claude to read CI results on PRs
15-19: Trigger conditions correctly handle @claude mentions across event types.The condition properly checks the appropriate body field for each event type (
comment.body,review.body,issue.body,issue.title).
| permissions: | ||
| contents: read | ||
| pull-requests: read | ||
| issues: read | ||
| id-token: write |
There was a problem hiding this comment.
Missing write permission for pull-requests will cause gh pr comment to fail.
The prompt instructs Claude to use gh pr comment (line 52), but the workflow only grants pull-requests: read. The gh pr comment command requires write access to post comments.
🔎 Proposed fix
permissions:
contents: read
- pull-requests: read
+ pull-requests: write
issues: read
id-token: write📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| permissions: | |
| contents: read | |
| pull-requests: read | |
| issues: read | |
| id-token: write | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| issues: read | |
| id-token: write |
🤖 Prompt for AI Agents
In @.github/workflows/claude-code-review.yml around lines 22 - 26, The
workflow's permissions block grants only read access to pull-requests, but the
job uses the gh CLI to run "gh pr comment" which requires write permission;
update the permissions section by changing the pull-requests permission from
read to write (i.e., set pull-requests: write) so the "gh pr comment" command
can post comments; ensure the permissions block still includes contents: read,
issues: read, and id-token: write unchanged.
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!