Add Claude Code GitHub Workflow by jorgesg82 · Pull Request #83 · Hyperloop-UPV/template-project

jorgesg82 · 2026-03-26T18:06:44Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate the Anthropic Claude Code action into this repository, enabling automated Claude runs based on mentions and (optionally) automated PR reviews.

Changes:

Introduces a workflow that triggers Claude Code runs when @claude appears in issue/PR comments, issue bodies/titles, or PR reviews.
Introduces a workflow that runs a Claude-based “code review” plugin automatically on PR lifecycle events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
`.github/workflows/claude.yml`	Adds an `@claude`-mention-triggered workflow invoking `anthropics/claude-code-action@v1`.
`.github/workflows/claude-code-review.yml`	Adds an automatic PR review workflow invoking the Claude Code Review plugin via `anthropics/claude-code-action@v1`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-26T18:09:55Z

.github/workflows/claude-code-review.yml

+    # Optional: Only run on specific file changes
+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"


This workflow runs on every PR open/synchronize/reopen event with no gating, which can create significant operational cost/noise if it invokes Claude on every push. Consider adding a filter (paths, author association, label, or a manual trigger) so the review only runs when intended.

Suggested change

# Optional: Only run on specific file changes

# paths:

# - "src/**/*.ts"

# - "src/**/*.tsx"

# - "src/**/*.js"

# - "src/**/*.jsx"

# Only run on specific file changes to avoid unnecessary cost/noise

paths:

- "src/**/*.ts"

- "src/**/*.tsx"

- "src/**/*.js"

- "src/**/*.jsx"

Copilot · 2026-03-26T18:09:56Z

.github/workflows/claude-code-review.yml

+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'


Because this runs on the pull_request event, it will also run for PRs from forks, but repository secrets (like CLAUDE_CODE_OAUTH_TOKEN) are not provided to forked PR workflows. Add a job-level if: guard to skip fork PRs (e.g., check the PR head repo matches github.repository) to avoid failing runs and wasted CI capacity.

Copilot · 2026-03-26T18:09:56Z

.github/workflows/claude-code-review.yml

+    #   github.event.pull_request.user.login == 'new-developer' ||
+    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
+
+    runs-on: ubuntu-latest


This repository’s other workflows pin runners to ubuntu-24.04. Consider switching from ubuntu-latest to ubuntu-24.04 here as well to avoid unexpected behavior changes when GitHub updates the default runner image.

Suggested change

runs-on: ubuntu-latest

runs-on: ubuntu-24.04

Copilot · 2026-03-26T18:09:56Z

.github/workflows/claude.yml

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The job can currently be triggered by anyone who can create an issue/comment containing "@claude" (including external users). This contradicts the PR description (“Only users with write access … can trigger”) and is a security risk because the workflow passes a secret (CLAUDE_CODE_OAUTH_TOKEN) to the action. Add an explicit authorization gate in the job if: (e.g., check github.event.comment.author_association / github.event.issue.author_association is OWNER/MEMBER/COLLABORATOR, or restrict to an allowlist of actors) before running the action.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

(github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR')) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

(github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR')) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

(github.event.review.author_association == 'OWNER' ||

github.event.review.author_association == 'MEMBER' ||

github.event.review.author_association == 'COLLABORATOR')) ||

(github.event_name == 'issues' &&

(contains(github.event.issue.body, '@claude') ||

contains(github.event.issue.title, '@claude')) &&

(github.event.issue.author_association == 'OWNER' ||

github.event.issue.author_association == 'MEMBER' ||

github.event.issue.author_association == 'COLLABORATOR'))

Copilot · 2026-03-26T18:09:57Z

.github/workflows/claude.yml

+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+    runs-on: ubuntu-latest


This repository’s other workflows consistently pin the runner to ubuntu-24.04 (e.g., .github/workflows/tests.yml, build.yml). Using ubuntu-latest can introduce breaking changes when GitHub updates the default image; consider pinning to ubuntu-24.04 here for stability and consistency.

Suggested change

runs-on: ubuntu-latest

runs-on: ubuntu-24.04

jorgesg82 added 2 commits March 26, 2026 19:04

"Claude PR Assistant workflow"

3acdc75

"Claude Code Review workflow"

13e8992

jorgesg82 requested a review from Copilot March 26, 2026 18:07

jorgesg82 merged commit a1ba351 into main Mar 26, 2026
4 checks passed

Copilot started reviewing on behalf of jorgesg82 March 26, 2026 18:07 View session

Copilot AI reviewed Mar 26, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Claude Code GitHub Workflow#83

Add Claude Code GitHub Workflow#83
jorgesg82 merged 2 commits intomainfrom
add-claude-github-actions-1774548249679

jorgesg82 commented Mar 26, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      (github.event_name == 'issue_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        (github.event.comment.author_association == 'OWNER' ||
+         github.event.comment.author_association == 'MEMBER' ||
+         github.event.comment.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        (github.event.comment.author_association == 'OWNER' ||
+         github.event.comment.author_association == 'MEMBER' ||
+         github.event.comment.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'pull_request_review' &&
+        contains(github.event.review.body, '@claude') &&
+        (github.event.review.author_association == 'OWNER' ||
+         github.event.review.author_association == 'MEMBER' ||
+         github.event.review.author_association == 'COLLABORATOR')) ||
+      (github.event_name == 'issues' &&
+        (contains(github.event.issue.body, '@claude') ||
+         contains(github.event.issue.title, '@claude')) &&
+        (github.event.issue.author_association == 'OWNER' ||
+         github.event.issue.author_association == 'MEMBER' ||
+         github.event.issue.author_association == 'COLLABORATOR'))

Conversation

jorgesg82 commented Mar 26, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants