Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
99 changes: 99 additions & 0 deletions .github/workflows/claude.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,99 @@
name: Claude Code

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@claude review


on:
workflow_dispatch:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Provide a prompt for manual dispatches

When this workflow is started with workflow_dispatch, the event has no comment/review payload containing @claude, and this step does not pass a prompt input to anthropics/claude-code-action@v1. I checked the action's v1 trigger validation: without an explicit prompt it only proceeds when a supported GitHub event payload contains the trigger phrase, so manually running the workflow will pass the membership gate but Claude will have no trigger/PR instruction to review. Add dispatch inputs and pass a prompt that includes the target PR, or remove the manual trigger.

Useful? React with 👍 / 👎.

issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
pull_request_review:
types: [submitted]
Comment on lines +3 to +10

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add the missing PR comment trigger

The workflow condition handles github.event_name == 'issue_comment', which is the event fired for normal PR conversation comments such as @claude please review, but issue_comment is not listed under on:. As a result, those comments never start this workflow; only inline review comments or submitted reviews do. Add issue_comment: { types: [created] } here if PR comment mentions are meant to invoke Claude.

Useful? React with 👍 / 👎.


jobs:
check-membership:
if: |
(github.event_name == 'workflow_dispatch') ||
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude'))
runs-on: ubuntu-latest
permissions:
contents: read
outputs:
is-member: ${{ steps.check.outputs.is-member }}
steps:
- name: Validate GitHub App private key
env:
CLAUDE_APP_PRIVATE_KEY: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }}
run: |
if [ -z "$CLAUDE_APP_PRIVATE_KEY" ]; then
echo "::error::Repository secret CLAUDE_APP_PRIVATE_KEY is empty or missing."
exit 1
fi

- name: Create GitHub App token
id: app-token
uses: actions/create-github-app-token@v3
with:

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@claude review

app-id: 4019885
private-key: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }}
owner: ${{ github.repository_owner }}

- name: Check if user is organization member
id: check
uses: actions/github-script@v9
with:
github-token: ${{ steps.app-token.outputs.token }}
script: |
try {
await github.rest.orgs.checkMembershipForUser({
org: context.repo.owner,
username: context.actor
});
Comment on lines +49 to +52

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Use a token that can read org membership

This membership gate calls orgs.checkMembershipForUser with the default GITHUB_TOKEN, but this job only grants contents: read. GitHub's org-membership endpoint requires the token to have the organization Members read permission to reliably check private org memberships; otherwise valid org members whose membership is private are reported as not found/unauthorized and Claude is skipped. Use a PAT/GitHub App token with org member read access, or switch to a repository-permission check that the workflow token can perform.

Useful? React with 👍 / 👎.

core.setOutput('is-member', 'true');
} catch (error) {
core.setOutput('is-member', 'false');
core.setFailed(`User ${context.actor} is not a member of ${context.repo.owner}`);
}

claude:
needs: check-membership

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@claude review

if: needs.check-membership.outputs.is-member == 'true'
runs-on: ubuntu-latest
permissions:
contents: read # Read-only access to code
Comment thread
CassNot marked this conversation as resolved.
pull-requests: write # Can post comments/reviews on PRs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Grant issues write for issue-comment triggers

When this workflow is triggered from an issue_comment on a plain issue, the Claude job runs but its GITHUB_TOKEN has no Issues scope because GitHub sets any omitted permission to none, and GitHub documents issues: write as the scope that permits adding issue comments. The new trigger is not limited to PR comments (github.event.issue.pull_request), so @claude on an issue will pass the membership gate and then be unable to read/update/comment on the issue unless you add issues: write or filter out non-PR issue comments.

Useful? React with 👍 / 👎.

id-token: write # Required for authentication
actions: read # Required for Claude to read CI results on PRs

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Pass actions access to Claude

Granting actions: read on the job does not by itself enable Claude Code's CI tools; the v1 action also requires additional_permissions: | actions: read in its with: inputs. In this configuration, requests like @claude why did CI fail? will run with the token scope but Claude won't receive the Actions MCP permission the workflow comments claim to provide.

Useful? React with 👍 / 👎.

steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 1

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
Comment on lines +76 to +78

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Align the action gate with org membership

The workflow now allows any org member through this custom membership gate, but anthropics/claude-code-action@v1 still enforces its own default trigger policy that only permits users with repository write access unless allowed_non_write_users is configured with a github_token. For org members who do not have write access to this repo, the membership job succeeds but the Claude step rejects the request, so the advertised org-member access does not work for that case.

Useful? React with 👍 / 👎.


# Optional: Customize the trigger phrase (default: @claude)
# trigger_phrase: "/claude"

# Optional: Trigger when specific user is assigned to an issue
# assignee_trigger: "claude-bot"

# Optional: Configure Claude's behavior with CLI arguments
# claude_args: |
# --model claude-opus-4-1-20250805
# --max-turns 10
# --allowedTools "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"
# --system-prompt "Follow our coding standards. Ensure all new code has tests. Use TypeScript for new files."

# Optional: Advanced settings configuration
# settings: |
# {
# "env": {
# "NODE_ENV": "test"
# }
# }
2 changes: 1 addition & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ classifiers=[

dependencies = [
"torch>=2.0.0,<=2.10.0",
"perceval-quandela>=0.13.1",
"perceval-quandela>=0.13.1,<=1.1",
"numpy>=2.2.6",
"pandas",
"scikit-learn>=1.7.2",
Expand Down
Loading