Claude Review (from upstream branch) - #239
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2282e1e1de
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} |
There was a problem hiding this comment.
When this job is triggered, this invocation does not pass a github_token, so anthropics/claude-code-action@v1 mints and uses its own Claude GitHub App token via OIDC. The action's default app-token request includes contents: write, so the job-level contents: read permission above does not enforce the advertised comments-only behavior and Claude can still push commits/branches when responding to an org member's @claude request. If this workflow is meant to be review-only, pass a token constrained to read contents and comment/review permissions or otherwise disable the action's write-capable token path.
Useful? React with 👍 / 👎.
| name: Claude Code | ||
|
|
||
| on: | ||
| workflow_dispatch: |
There was a problem hiding this comment.
For workflow_dispatch, the Claude action treats the run as automation mode and skips unless a prompt input is provided; this workflow defines no dispatch inputs and passes only the API key. As a result, using Actions → Run workflow will pass the membership check and then do no review, which contradicts the documented manual trigger path. Add inputs such as a PR number plus a prompt, or remove the manual trigger.
Useful? React with 👍 / 👎.
| contents: read # Read-only access to code | ||
| pull-requests: write # Can post comments/reviews on PRs | ||
| id-token: write # Required for authentication | ||
| actions: read # Required for Claude to read CI results on PRs |
There was a problem hiding this comment.
Granting actions: read to the job token is not enough for Claude to inspect CI results here, because the action uses its own app token and only requests extra scopes when with.additional_permissions includes them. In prompts like @claude why did CI fail?, Claude will not get the GitHub Actions MCP tools despite this permission line. Add additional_permissions: | actions: read to the action inputs.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5ad6c6256c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} |
There was a problem hiding this comment.
In the org-member-but-not-repo-writer case, this job passes the membership check but anthropics/claude-code-action@v1 still performs its own write-permission gate for issue/PR contexts before it runs. I checked the action's action.yml/run.ts: allowed_non_write_users only works when a github_token input is supplied, and the current invocation supplies neither, so many organization members will see the workflow fail with “Actor does not have write permissions” instead of getting the advertised org-member-triggered review.
Useful? React with 👍 / 👎.
|
CassNot
left a comment
CassNot
left a comment
There was a problem hiding this comment.
test 3 with no app
| pull_request_review_comment: | ||
| types: [created] | ||
| pull_request_review: | ||
| types: [submitted] |
|
@claude please review this PR |
CassNot
left a comment
CassNot
left a comment
There was a problem hiding this comment.
Test 5 with debug
|
|
||
| jobs: | ||
| claude: | ||
| runs-on: ubuntu-latest |
|
@claude Review |
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read # Read-only access to code | ||
| pull-requests: write # Can post comments/reviews on PRs |
CassNot
left a comment
CassNot
left a comment
There was a problem hiding this comment.
Test with permissions
| on: | ||
| issue_comment: | ||
| types: [created] | ||
| pull_request_review_comment: |
2 participants
Summary
This PR introduces a new GitHub Actions workflow that enables Claude to provide automated code reviews on pull requests, with security controls to restrict access to organization members.
Features
Type of change
Proposed changes
How to Use
Automatic trigger: simply comment @claude anywhere on a PR, and the workflow will automatically trigger.
Manual trigger:
Permissions
Security