Repository navigation
perf(scan): merge narrow splits at boundaries only some fields of a struct have #5817
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code (Write) | |
| # Setup | |
| # 1. Create a dedicated GitHub App and install it only on this repository. | |
| # 2. Grant the App only: | |
| # - Contents: Read & write | |
| # - Issues: Read & write | |
| # - Pull requests: Read & write | |
| # 3. Create a GitHub Actions environment named `claude-automation`. | |
| # 4. Store these environment secrets in `claude-automation`: | |
| # - APP_ID | |
| # - APP_PRIVATE_KEY | |
| # 5. Create repository or organization Actions variables: | |
| # - CLAUDE_APP_LOGIN | |
| # Set this to the bot login for the GitHub App, usually `<app-slug>[bot]`. | |
| # - ANTHROPIC_ORGANIZATION_ID, ANTHROPIC_SERVICE_ACCOUNT_ID, ANTHROPIC_FEDERATION_RULE_WRITE | |
| # Identifiers, not credentials. The write rule matches only this workflow. | |
| # | |
| # Why this workflow exists separately | |
| # - This is the only workflow that can read the GitHub App private key. | |
| # - It is primarily issue-driven. The only PR path it allows is a follow-up comment | |
| # on a same-repo PR that was already opened by the Claude GitHub App. | |
| # - Claude uses a short-lived GitHub App installation token, not GITHUB_TOKEN, so | |
| # PRs opened by Claude trigger normal `pull_request` workflows. | |
| # - A gate job runs before the environment is attached so untrusted events are | |
| # rejected before the private key is exposed. | |
| # - GitHub exposes the author of an app-created PR as the app's bot login rather | |
| # than the numeric App ID in the PR payload, so the gate checks `CLAUDE_APP_LOGIN` | |
| # instead of comparing directly to `APP_ID`. | |
| on: | |
| issues: | |
| types: [opened, assigned] | |
| issue_comment: | |
| types: [created] | |
| jobs: | |
| gate: | |
| name: Gate Issue Trigger | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: read | |
| pull-requests: read | |
| outputs: | |
| should_run: ${{ steps.gate.outputs.should_run }} | |
| reason: ${{ steps.gate.outputs.reason }} | |
| checkout_ref: ${{ steps.gate.outputs.checkout_ref }} | |
| steps: | |
| - name: Check whether this event is allowed to reach Claude | |
| id: gate | |
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9 | |
| with: | |
| github-token: ${{ github.token }} | |
| script: | | |
| const sender = context.payload.sender?.login ?? ''; | |
| const senderType = context.payload.sender?.type ?? ''; | |
| const trustedClaudeLogin = process.env.CLAUDE_APP_LOGIN ?? ''; | |
| async function getPermission(username) { | |
| try { | |
| const { data } = await github.rest.repos.getCollaboratorPermissionLevel({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| username, | |
| }); | |
| return data.permission; | |
| } catch (error) { | |
| if (error.status === 404) { | |
| return 'none'; | |
| } | |
| throw error; | |
| } | |
| } | |
| let mentioned = false; | |
| let reason = ''; | |
| let checkoutRef = context.payload.repository?.default_branch ?? ''; | |
| if (context.eventName === 'issues') { | |
| const title = context.payload.issue?.title ?? ''; | |
| const body = context.payload.issue?.body ?? ''; | |
| mentioned = title.includes('@claude') || body.includes('@claude'); | |
| } else if (context.eventName === 'issue_comment') { | |
| const body = context.payload.comment?.body ?? ''; | |
| mentioned = body.includes('@claude'); | |
| if (context.payload.issue?.pull_request) { | |
| const response = await github.rest.pulls.get({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.payload.issue.number, | |
| }); | |
| const pr = response.data; | |
| checkoutRef = pr.head.sha; | |
| const headRepo = pr.head.repo; | |
| const isFork = !headRepo || headRepo.fork || headRepo.full_name !== `${context.repo.owner}/${context.repo.repo}`; | |
| if (isFork) { | |
| reason = 'fork_pr_refused'; | |
| } else if (!trustedClaudeLogin) { | |
| reason = 'missing_claude_app_login'; | |
| } else if ((pr.user?.login ?? '') !== trustedClaudeLogin) { | |
| reason = 'pr_not_owned_by_claude_app'; | |
| } | |
| if (!reason) { | |
| const files = await github.paginate(github.rest.pulls.listFiles, { | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| pull_number: context.payload.issue.number, | |
| per_page: 100, | |
| }); | |
| // Refuse workflow changes so write-capable automation never acts on | |
| // `.github/` modifications from the same pull request. | |
| if (files.some(f => f.filename.startsWith('.github/'))) { | |
| reason = 'modifies_github_dir'; | |
| } | |
| } | |
| } | |
| } | |
| if (!reason && !mentioned) { | |
| reason = 'not_mentioned'; | |
| } | |
| if (!reason && senderType === 'Bot') { | |
| reason = 'bot_sender_refused'; | |
| } | |
| if (!reason) { | |
| const permission = await getPermission(sender); | |
| core.setOutput('actor_permission', permission); | |
| if (!['admin', 'maintain', 'write'].includes(permission)) { | |
| reason = 'actor_lacks_write'; | |
| } | |
| } | |
| core.setOutput('checkout_ref', checkoutRef); | |
| core.setOutput('should_run', !reason ? 'true' : 'false'); | |
| core.setOutput('reason', reason || 'allowed'); | |
| env: | |
| CLAUDE_APP_LOGIN: ${{ vars.CLAUDE_APP_LOGIN }} | |
| claude: | |
| name: Run Claude Code | |
| needs: gate | |
| if: needs.gate.outputs.should_run == 'true' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.issue.number || github.run_id }} | |
| cancel-in-progress: true | |
| environment: | |
| # The App private key lives only in this environment so only this single job | |
| # can mint a GitHub App installation token. | |
| name: claude-automation | |
| deployment: false | |
| permissions: | |
| contents: read | |
| issues: read | |
| pull-requests: read | |
| actions: read | |
| id-token: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| ref: ${{ needs.gate.outputs.checkout_ref }} | |
| fetch-depth: 0 | |
| # Do not leave the built-in GITHUB_TOKEN in git config. Claude should use | |
| # only the GitHub App token generated below so its PRs trigger CI normally. | |
| persist-credentials: false | |
| - name: Generate short-lived GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 | |
| with: | |
| app-id: ${{ secrets.APP_ID }} | |
| private-key: ${{ secrets.APP_PRIVATE_KEY }} | |
| permission-contents: write | |
| permission-issues: write | |
| permission-pull-requests: write | |
| - name: Setup Rust toolchain | |
| uses: ./.github/actions/setup-rust | |
| - name: Install uv | |
| uses: spiraldb/actions/.github/actions/setup-uv@a746510eafaa926484c354541cfc49b2ec06cc63 # 0.18.6 | |
| with: | |
| sync: false | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@2dca132ff0e0c4094ce6048b422c6915a071210b # v1.0.247 | |
| with: | |
| # The environment puts `environment:claude-automation` in the OIDC subject, | |
| # which is all the `vortex-claude-write` rule matches. Unreachable elsewhere. | |
| anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_WRITE }} | |
| anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} | |
| anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} | |
| github_token: ${{ steps.app-token.outputs.token }} | |
| # Claude may inspect CI state on related PRs, but this workflow is otherwise | |
| # issue-driven and is the only place with write-capable GitHub credentials. | |
| additional_permissions: | | |
| actions: read | |
| claude_args: | | |
| --model claude-opus-5-5 | |
| --allowedTools "Bash(cargo nextest:*),Bash(cargo check:*),Bash(cargo clippy:*),Bash(cargo fmt:*),Bash(uv run:*)" | |
| --system-prompt "You implement changes for this repository from trusted issues, and from trusted comments on same-repository pull requests that the repository's Claude GitHub App opened. Create or update branches and pull requests with the provided GitHub App token." | |
| - name: Open pull request for issue branch | |
| if: ${{ steps.claude.outputs.branch_name != '' && !github.event.issue.pull_request }} | |
| env: | |
| GH_TOKEN: ${{ steps.app-token.outputs.token }} | |
| REPO: ${{ github.repository }} | |
| BASE_BRANCH: ${{ github.event.repository.default_branch }} | |
| BRANCH_NAME: ${{ steps.claude.outputs.branch_name }} | |
| PR_TITLE: ${{ github.event.issue.title }} | |
| PR_BODY: | | |
| Fixes #${{ github.event.issue.number }} | |
| Generated with Claude Code. | |
| [View Claude run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) | |
| run: | | |
| commits_ahead="$( | |
| gh api \ | |
| "repos/$REPO/compare/$BASE_BRANCH...$BRANCH_NAME" \ | |
| --jq .ahead_by 2>/dev/null || echo 0 | |
| )" | |
| if [[ "$commits_ahead" == "0" ]]; then | |
| echo "Branch has no commits ahead of $BASE_BRANCH; skipping PR creation." | |
| exit 0 | |
| fi | |
| existing_pr="$( | |
| gh pr list \ | |
| --repo "$REPO" \ | |
| --head "$BRANCH_NAME" \ | |
| --state all \ | |
| --json url \ | |
| --jq '.[0].url // ""' | |
| )" | |
| if [[ -n "$existing_pr" ]]; then | |
| echo "Pull request already exists: $existing_pr" | |
| exit 0 | |
| fi | |
| pr_url="$( | |
| gh pr create \ | |
| --repo "$REPO" \ | |
| --base "$BASE_BRANCH" \ | |
| --head "$BRANCH_NAME" \ | |
| --title "$PR_TITLE" \ | |
| --body "$PR_BODY" | |
| )" | |
| echo "Created pull request: $pr_url" |