Conversation
📝 WalkthroughWalkthroughTwo GitHub Actions workflows are introduced to automate code review using the Anthropic Claude Code action. One workflow runs on pull request events (opened, synchronized, ready for review, reopened), while the other activates when comments or review comments contain the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Adds GitHub Actions workflows to integrate Anthropic’s Claude Code into the repo for (1) responding to @claude mentions in issues/PR comments and (2) running an automated Claude-based PR review job.
Changes:
- Added a
Claude Codeworkflow that triggers on issue/PR comment and review events when@claudeis detected. - Added a
Claude Code Reviewworkflow that runs an automated code review plugin on PR open/update-related events.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 8 comments.
| File | Description |
|---|---|
.github/workflows/claude.yml |
Introduces an @claude-mention-triggered workflow for issues/PR comments/reviews. |
.github/workflows/claude-code-review.yml |
Introduces an automatic PR code-review workflow using Claude Code plugins. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
.github/workflows/claude.yml (1)
15-20: Gate@claudeexecution by trusted author association at workflow level.Current condition only checks mention text. Adding an
author_associationgate avoids unnecessary runner starts from external users and reduces abuse/cost surface before the action is invoked.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/claude.yml around lines 15 - 20, Update the workflow `if` condition to require that the mention comes from a trusted author_association in addition to containing '@claude': for the issue_comment and pull_request_review_comment branches check github.event.comment.author_association is one of trusted values (e.g., OWNER, MEMBER, COLLABORATOR, CONTRIBUTOR) before allowing the runner to start; for pull_request_review check github.event.review.author_association similarly; and for issues check github.event.issue.author_association. Keep the existing contains(...) mention checks but add the author_association guards to each event clause in the `if` block to gate execution by trusted authors.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Line 30: Replace the mutable action tags with immutable commit SHAs: locate
the workflow entries that reference uses: actions/checkout@v4 and uses:
anthropics/claude-code-action@v1 and update each to the corresponding full
commit SHA for that release (e.g., uses: actions/checkout@<full-commit-sha> and
uses: anthropics/claude-code-action@<full-commit-sha>) so the workflow pins to
exact commits and prevents supply-chain drift.
- Around line 4-5: The workflow triggers on pull_request but references the
secret CLAUDE_CODE_OAUTH_TOKEN, which is inaccessible for forked PRs; add a
fork-PR guard by adding a job-level condition that only runs when the PR head
repo equals the base repo (e.g. if:
github.event.pull_request.head.repo.full_name == github.repository) around the
job that uses CLAUDE_CODE_OAUTH_TOKEN so external fork PRs are skipped and don't
attempt to access the secret.
In @.github/workflows/claude.yml:
- Line 29: Replace floating action tags with exact commit SHAs: change usages of
actions/checkout@v4 and anthropics/claude-code-action@v1 to their corresponding
commit SHAs (e.g., actions/checkout@<commit-sha>,
anthropics/claude-code-action@<commit-sha>) so the workflow pins the exact
commits; update the two occurrences (the actions/checkout and
anthropics/claude-code-action entries) to use verified commit SHAs instead of
the v4/v1 tags.
---
Nitpick comments:
In @.github/workflows/claude.yml:
- Around line 15-20: Update the workflow `if` condition to require that the
mention comes from a trusted author_association in addition to containing
'@claude': for the issue_comment and pull_request_review_comment branches check
github.event.comment.author_association is one of trusted values (e.g., OWNER,
MEMBER, COLLABORATOR, CONTRIBUTOR) before allowing the runner to start; for
pull_request_review check github.event.review.author_association similarly; and
for issues check github.event.issue.author_association. Keep the existing
contains(...) mention checks but add the author_association guards to each event
clause in the `if` block to gate execution by trusted authors.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: b1a615be-2aa2-43e3-a7fd-89c03f1f84ac
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml.github/workflows/claude.yml
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/claude-code-review.ymlRepository: roadrunner-server/http
Length of output: 1806
Add fork PR guard to prevent secret access failures on external PRs.
The workflow triggers on all PRs (line 4) but line 38 requires CLAUDE_CODE_OAUTH_TOKEN secret, which is inaccessible during fork PR runs. This causes predictable failures and blocks the external contribution flow. Add the fork guard to skip the job on fork PRs:
jobs:
claude-review:
+ if: ${{ github.event.pull_request.head.repo.fork == false }}
runs-on: ubuntu-latest🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-review.yml around lines 4 - 5, The workflow
triggers on pull_request but references the secret CLAUDE_CODE_OAUTH_TOKEN,
which is inaccessible for forked PRs; add a fork-PR guard by adding a job-level
condition that only runs when the PR head repo equals the base repo (e.g. if:
github.event.pull_request.head.repo.full_name == github.repository) around the
job that uses CLAUDE_CODE_OAUTH_TOKEN so external fork PRs are skipped and don't
attempt to access the secret.
|
|
||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/claude-code-review.yml | sed -n '25,40p'Repository: roadrunner-server/http
Length of output: 668
Pin Actions to immutable commit SHAs instead of floating tags.
Both actions/checkout@v4 (line 30) and anthropics/claude-code-action@v1 (line 36) use mutable version tags. Pin to full commit SHAs to prevent supply chain drift—floating tags can be retargeted by upstream maintainers without your knowledge, potentially executing unintended code in workflows with elevated permissions.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-review.yml at line 30, Replace the mutable
action tags with immutable commit SHAs: locate the workflow entries that
reference uses: actions/checkout@v4 and uses: anthropics/claude-code-action@v1
and update each to the corresponding full commit SHA for that release (e.g.,
uses: actions/checkout@<full-commit-sha> and uses:
anthropics/claude-code-action@<full-commit-sha>) so the workflow pins to exact
commits and prevents supply-chain drift.
| actions: read # Required for Claude to read CI results on PRs | ||
| steps: | ||
| - name: Checkout repository | ||
| uses: actions/checkout@v4 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
cat -n .github/workflows/claude.ymlRepository: roadrunner-server/http
Length of output: 2301
Pin workflow actions to commit SHAs instead of floating tags.
Line 29 uses actions/checkout@v4 and line 35 uses anthropics/claude-code-action@v1. Floating tags can be force-pushed or compromised. Pin these to exact commit SHAs (e.g., actions/checkout@a5ac7e51b41094c5405359c97429f3dd38146b4a) for stronger CI supply-chain security guarantees.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude.yml at line 29, Replace floating action tags with
exact commit SHAs: change usages of actions/checkout@v4 and
anthropics/claude-code-action@v1 to their corresponding commit SHAs (e.g.,
actions/checkout@<commit-sha>, anthropics/claude-code-action@<commit-sha>) so
the workflow pins the exact commits; update the two occurrences (the
actions/checkout and anthropics/claude-code-action entries) to use verified
commit SHAs instead of the v4/v1 tags.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #224 +/- ##
=============================
=============================
☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit