Add Claude Code GitHub Workflow

[warmwind]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

---

Summary by cubic

Adds two GitHub Actions to enable Claude Code: one triggers on @claude mentions in issues and PRs, and another runs automated code reviews on PR updates. This brings on-demand help and consistent review feedback into the repo.

• New Features

  • Adds .github/workflows/claude.yml to run Claude Code when @claude is mentioned in issue comments, PR review comments, PR reviews, or issue bodies/titles; includes actions:read to read CI results.
  • Adds .github/workflows/claude-code-review.yml to run a code-review plugin automatically on PR events (opened, synchronized, ready_for_review, reopened).

• Migration

  • Set the repository secret CLAUDE_CODE_OAUTH_TOKEN.
  • Merge this PR; then @claude mentions will start working.

^{Written for commit c9ffd50. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 2 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name=".github/workflows/claude.yml">

<violation number="1" location=".github/workflows/claude.yml:15">
P1: Restrict triggers to trusted users (e.g., MEMBER/OWNER/COLLABORATOR). As written, any external user can open an issue or comment `@claude` and run a workflow that uses the `CLAUDE_CODE_OAUTH_TOKEN` secret.</violation>
</file>

<file name=".github/workflows/claude-code-review.yml">

<violation number="1" location=".github/workflows/claude-code-review.yml:23">
P2: Claude Code action needs write permissions for contents/issues/pull-requests to post review comments or PR updates; read-only permissions will cause the workflow to fail.</violation>
</file>

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Add one-off context when rerunning by tagging @cubic-dev-ai with guidance or docs links (including llms.txt)
• Ask questions if you need clarification on any suggestion

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Restrict triggers to trusted users (e.g., MEMBER/OWNER/COLLABORATOR). As written, any external user can open an issue or comment @claude and run a workflow that uses the CLAUDE_CODE_OAUTH_TOKEN secret.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/claude.yml, line 15:

<comment>Restrict triggers to trusted users (e.g., MEMBER/OWNER/COLLABORATOR). As written, any external user can open an issue or comment `@claude` and run a workflow that uses the `CLAUDE_CODE_OAUTH_TOKEN` secret.</comment>

<file context>
@@ -0,0 +1,50 @@
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
</file context>

[cubic-dev-ai]

P2: Claude Code action needs write permissions for contents/issues/pull-requests to post review comments or PR updates; read-only permissions will cause the workflow to fail.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/claude-code-review.yml, line 23:

<comment>Claude Code action needs write permissions for contents/issues/pull-requests to post review comments or PR updates; read-only permissions will cause the workflow to fail.</comment>

<file context>
@@ -0,0 +1,44 @@
+
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
</file context>