Skip to content

Add Claude Code GitHub Workflow#150

Merged
ljwharbers merged 3 commits into
mainfrom
add-claude-github-actions-1774555749760
Mar 27, 2026
Merged

Add Claude Code GitHub Workflow#150
ljwharbers merged 3 commits into
mainfrom
add-claude-github-actions-1774555749760

Conversation

@ljwharbers
Copy link
Copy Markdown
Collaborator

@ljwharbers ljwharbers commented Mar 26, 2026

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

  • Bug fixes and improvements
  • Documentation updates
  • Implementing new features
  • Code reviews and suggestions
  • Writing tests
  • And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

  • This workflow won't take effect until this PR is merged
  • @claude mentions won't work until after the merge is complete
  • The workflow runs automatically whenever Claude is mentioned in PR or issue comments
  • Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

  • Our Anthropic API key is securely stored as a GitHub Actions secret
  • Only users with write access to the repository can trigger the workflow
  • All Claude runs are stored in the GitHub Actions run history
  • Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
  • We can add more allowed tools by adding them to the workflow file like:
allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Copilot AI review requested due to automatic review settings March 26, 2026 20:09
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 26, 2026

This PR is against the main branch ❌

  • Do not close this PR
  • Click Edit and change the base to dev
  • This CI test will remain failed until you push a new commit

Hi @ljwharbers,

It looks like this pull-request is has been made against the IntGenomicsLab/lrsomatic main branch.
The main branch on nf-core repositories should always contain code from the latest release.
Because of this, PRs to main are only allowed if they come from the IntGenomicsLab/lrsomatic dev branch.

You do not need to close this PR, you can change the target branch to dev by clicking the "Edit" button at the top of this page.
Note that even after this, the test will continue to show as failing until you push a new commit.

Thanks again for your contribution!

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Mar 26, 2026 •
edited
Loading

nf-core pipelines lint overall result: Passed ✅ ⚠️

Posted for pipeline commit 37e07e2

+| ✅ 179 tests passed       |+
#| ❔  21 tests were ignored |#
#| ❔   1 tests had warnings |#
!| ❗ 145 tests had warnings |!
Details

❗ Test warnings:

  • nextflow_config - Config manifest.version should end in dev: 1.0.0
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in lint_log.txt: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in lint_log.txt: List additional required output channels/values here
  • pipeline_todos - TODO string in README.md: Include a figure that guides the user through the major workflow steps. Many nf-core
  • pipeline_todos - TODO string in nextflow.config: Specify your pipeline's command line flags
  • pipeline_todos - TODO string in nextflow.config: Update the field with the details of the contributors to your pipeline. New with Nextflow version 24.10.0
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in main.nf: If in doubt look at other nf-core/modules to see how we are doing things! :)
  • pipeline_todos - TODO string in main.nf: A module file SHOULD only define input and output files as command-line parameters.
  • pipeline_todos - TODO string in main.nf: Software that can be piped together SHOULD be added to separate module files
  • pipeline_todos - TODO string in main.nf: Optional inputs are not currently supported by Nextflow. However, using an empty
  • pipeline_todos - TODO string in main.nf: List required Conda package(s).
  • pipeline_todos - TODO string in main.nf: See section in main README for further information regarding finding and adding container addresses to the section below.
  • pipeline_todos - TODO string in main.nf: Where applicable all sample-specific information e.g. "id", "single_end", "read_group"
  • pipeline_todos - TODO string in main.nf: Where applicable please provide/convert compressed files as input/output
  • pipeline_todos - TODO string in main.nf: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in main.nf: List additional required output channels/values here
  • pipeline_todos - TODO string in main.nf: Where possible, a command MUST be provided to obtain the version number of the software e.g. 1.10
  • pipeline_todos - TODO string in main.nf: It MUST be possible to pass additional parameters to the tool as a command-line string via the "task.ext.args" directive
  • pipeline_todos - TODO string in main.nf: If the tool supports multi-threading then you MUST provide the appropriate parameter
  • pipeline_todos - TODO string in main.nf: Please replace the example samtools command below with your module's command
  • pipeline_todos - TODO string in main.nf: Please indent the command appropriately (4 spaces!!) to help with readability ;)
  • pipeline_todos - TODO string in main.nf: A stub section should mimic the execution of the original module as best as possible
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in main.nf: If in doubt look at other nf-core/modules to see how we are doing things! :)
  • pipeline_todos - TODO string in main.nf: A module file SHOULD only define input and output files as command-line parameters.
  • pipeline_todos - TODO string in main.nf: Software that can be piped together SHOULD be added to separate module files
  • pipeline_todos - TODO string in main.nf: Optional inputs are not currently supported by Nextflow. However, using an empty
  • pipeline_todos - TODO string in main.nf: List required Conda package(s).
  • pipeline_todos - TODO string in main.nf: See section in main README for further information regarding finding and adding container addresses to the section below.
  • pipeline_todos - TODO string in main.nf: Where applicable all sample-specific information e.g. "id", "single_end", "read_group"
  • pipeline_todos - TODO string in main.nf: Where applicable please provide/convert compressed files as input/output
  • pipeline_todos - TODO string in main.nf: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in main.nf: List additional required output channels/values here
  • pipeline_todos - TODO string in main.nf: Where possible, a command MUST be provided to obtain the version number of the software e.g. 1.10
  • pipeline_todos - TODO string in main.nf: It MUST be possible to pass additional parameters to the tool as a command-line string via the "task.ext.args" directive
  • pipeline_todos - TODO string in main.nf: If the tool supports multi-threading then you MUST provide the appropriate parameter
  • pipeline_todos - TODO string in main.nf: Please replace the example samtools command below with your module's command
  • pipeline_todos - TODO string in main.nf: Please indent the command appropriately (4 spaces!!) to help with readability ;)
  • pipeline_todos - TODO string in main.nf: A stub section should mimic the execution of the original module as best as possible
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in main.nf: If in doubt look at other nf-core/modules to see how we are doing things! :)
  • pipeline_todos - TODO string in main.nf: A module file SHOULD only define input and output files as command-line parameters.
  • pipeline_todos - TODO string in main.nf: Software that can be piped together SHOULD be added to separate module files
  • pipeline_todos - TODO string in main.nf: Optional inputs are not currently supported by Nextflow. However, using an empty
  • pipeline_todos - TODO string in main.nf: List required Conda package(s).
  • pipeline_todos - TODO string in main.nf: See section in main README for further information regarding finding and adding container addresses to the section below.
  • pipeline_todos - TODO string in main.nf: Where applicable all sample-specific information e.g. "id", "single_end", "read_group"
  • pipeline_todos - TODO string in main.nf: Where applicable please provide/convert compressed files as input/output
  • pipeline_todos - TODO string in main.nf: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in main.nf: List additional required output channels/values here
  • pipeline_todos - TODO string in main.nf: Where possible, a command MUST be provided to obtain the version number of the software e.g. 1.10
  • pipeline_todos - TODO string in main.nf: It MUST be possible to pass additional parameters to the tool as a command-line string via the "task.ext.args" directive
  • pipeline_todos - TODO string in main.nf: If the tool supports multi-threading then you MUST provide the appropriate parameter
  • pipeline_todos - TODO string in main.nf: Please replace the example samtools command below with your module's command
  • pipeline_todos - TODO string in main.nf: Please indent the command appropriately (4 spaces!!) to help with readability ;)
  • pipeline_todos - TODO string in main.nf: A stub section should mimic the execution of the original module as best as possible
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in main.nf: If in doubt look at other nf-core/modules to see how we are doing things! :)
  • pipeline_todos - TODO string in main.nf: A module file SHOULD only define input and output files as command-line parameters.
  • pipeline_todos - TODO string in main.nf: Software that can be piped together SHOULD be added to separate module files
  • pipeline_todos - TODO string in main.nf: Optional inputs are not currently supported by Nextflow. However, using an empty
  • pipeline_todos - TODO string in main.nf: List required Conda package(s).
  • pipeline_todos - TODO string in main.nf: See section in main README for further information regarding finding and adding container addresses to the section below.
  • pipeline_todos - TODO string in main.nf: Where applicable all sample-specific information e.g. "id", "single_end", "read_group"
  • pipeline_todos - TODO string in main.nf: Where applicable please provide/convert compressed files as input/output
  • pipeline_todos - TODO string in main.nf: Named file extensions MUST be emitted for ALL output channels
  • pipeline_todos - TODO string in main.nf: List additional required output channels/values here
  • pipeline_todos - TODO string in main.nf: Where possible, a command MUST be provided to obtain the version number of the software e.g. 1.10
  • pipeline_todos - TODO string in main.nf: It MUST be possible to pass additional parameters to the tool as a command-line string via the "task.ext.args" directive
  • pipeline_todos - TODO string in main.nf: If the tool supports multi-threading then you MUST provide the appropriate parameter
  • pipeline_todos - TODO string in main.nf: Please replace the example samtools command below with your module's command
  • pipeline_todos - TODO string in main.nf: Please indent the command appropriately (4 spaces!!) to help with readability ;)
  • pipeline_todos - TODO string in main.nf: A stub section should mimic the execution of the original module as best as possible
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in main.nf: If in doubt look at other nf-core/modules to see how we are doing things! :)
  • pipeline_todos - TODO string in main.nf: A module file SHOULD only define input and output files as command-line parameters.
  • pipeline_todos - TODO string in main.nf: Software that can be piped together SHOULD be added to separate module files
  • pipeline_todos - TODO string in main.nf: Optional inputs are not currently supported by Nextflow. However, using an empty
  • pipeline_todos - TODO string in main.nf: A stub section should mimic the execution of the original module as best as possible
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in meta.yml: #Add a description of the module and list keywords
  • pipeline_todos - TODO string in meta.yml: #Add a description and other details for the software below
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as input
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example input
  • pipeline_todos - TODO string in meta.yml: #Add a description of all of the variables used as output
  • pipeline_todos - TODO string in meta.yml: #Delete / customise this example output
  • pipeline_todos - TODO string in base.config: Check the defaults for all processes
  • pipeline_todos - TODO string in base.config: Customise requirements for specific processes.
  • pipeline_todos - TODO string in methods_description_template.yml: #Update the HTML below to your preferred methods description, e.g. add publication citation for this pipeline
  • pipeline_todos - TODO string in nextflow.config: Specify any additional parameters here
  • local_component_structure - prepare_reference_files.nf in subworkflows/local should be moved to a SUBWORKFLOW_NAME/main.nf structure
  • local_component_structure - prepare_annotation.nf in subworkflows/local should be moved to a SUBWORKFLOW_NAME/main.nf structure
  • local_component_structure - tumor_normal_happhase.nf in subworkflows/local should be moved to a SUBWORKFLOW_NAME/main.nf structure
  • local_component_structure - tumor_only_happhase.nf in subworkflows/local should be moved to a SUBWORKFLOW_NAME/main.nf structure

❔ Tests ignored:

  • files_exist - File is ignored: CODE_OF_CONDUCT.md
  • files_exist - File is ignored: assets/nf-core-lrsomatic_logo_light.png
  • files_exist - File is ignored: docs/images/nf-core-lrsomatic_logo_light.png
  • files_exist - File is ignored: docs/images/nf-core-lrsomatic_logo_dark.png
  • files_exist - File is ignored: .github/ISSUE_TEMPLATE/config.yml
  • files_exist - File is ignored: .github/workflows/awstest.yml
  • files_exist - File is ignored: .github/workflows/awsfulltest.yml
  • nextflow_config - Config variable ignored: manifest.name
  • nextflow_config - Config variable ignored: manifest.homePage
  • files_unchanged - File ignored due to lint config: CODE_OF_CONDUCT.md
  • files_unchanged - File ignored due to lint config: .github/CONTRIBUTING.md
  • files_unchanged - File ignored due to lint config: .github/ISSUE_TEMPLATE/bug_report.yml
  • files_unchanged - File does not exist: .github/ISSUE_TEMPLATE/config.yml
  • files_unchanged - File ignored due to lint config: .github/PULL_REQUEST_TEMPLATE.md
  • files_unchanged - File ignored due to lint config: assets/email_template.txt
  • files_unchanged - File ignored due to lint config: assets/nf-core-lrsomatic_logo_light.png
  • files_unchanged - File ignored due to lint config: docs/images/nf-core-lrsomatic_logo_light.png
  • files_unchanged - File ignored due to lint config: docs/images/nf-core-lrsomatic_logo_dark.png
  • files_unchanged - File ignored due to lint config: docs/README.md
  • actions_awstest - 'awstest.yml' workflow not found: /home/runner/work/lrsomatic/lrsomatic/.github/workflows/awstest.yml
  • schema_params - schema_params

❔ Tests fixed:

✅ Tests passed:

Run details

  • nf-core/tools version 3.5.1
  • Run at 2026-03-27 13:28:50

Copilot AI reviewed Mar 26, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds GitHub Actions workflows to integrate the Claude Code GitHub App into the repository, enabling agent runs via mentions and automated PR code-review runs.

Changes:

  • Add a Claude Code workflow that triggers on issue/PR comment and review events when @claude is present.
  • Add a Claude Code Review workflow that triggers on PR activity and runs the Claude Code review plugin.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File Description
.github/workflows/claude.yml New workflow to run Claude Code when @claude is detected in issue/PR comments or reviews.
.github/workflows/claude-code-review.yml New workflow to run automated Claude-based code review on pull request events.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/workflows/claude.yml

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@v1
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow uses anthropics/claude-code-action@v1 (mutable tag). For consistency with other workflows and to reduce supply-chain risk, pin this uses: reference to a specific commit SHA.

Suggested change
uses: anthropics/claude-code-action@v1
uses: anthropics/claude-code-action@<COMMIT-SHA>

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/claude-code-review.yml Outdated
Comment on lines +36 to +40
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow runs on the pull_request event but depends on secrets.CLAUDE_CODE_OAUTH_TOKEN (line 38). For PRs from forks, that secret won’t be available, so this job will likely fail/noise. Consider adding a job-level if: to only run on same-repo branches, or switch to a hardened pull_request_target pattern if you need fork support.

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/claude-code-review.yml

steps:
- name: Checkout repository
uses: actions/checkout@v4
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow uses actions/checkout@v4 (mutable tag). Other workflows in this repo generally pin actions to commit SHAs; please pin this checkout action to a specific SHA for supply-chain hardening and consistency.

Suggested change
uses: actions/checkout@v4
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/claude-code-review.yml

- name: Run Claude Code Review
id: claude-review
uses: anthropics/claude-code-action@v1
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow uses anthropics/claude-code-action@v1 (mutable tag). Pin this uses: reference to a specific commit SHA to reduce supply-chain risk.

Suggested change
uses: anthropics/claude-code-action@v1
uses: anthropics/claude-code-action@d4f2c6c9f3a2e58b7f6c1e4a8b9d0c3f5e7a1b2c

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/claude.yml
Comment on lines +16 to +19
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The job runs whenever @claude is present, but there’s no check that the actor is trusted. Because this workflow uses a repository secret (CLAUDE_CODE_OAUTH_TOKEN), untrusted users (e.g., drive-by issue commenters / fork PR authors) could trigger it to burn API quota or exfiltrate context through the agent. Add an authorization guard to the if: (e.g., require author_association to be MEMBER|OWNER|COLLABORATOR, or validate the actor’s permission via the GitHub API) before running the action.

Suggested change
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
(github.event_name == 'issue_comment' &&
contains(github.event.comment.body, '@claude') &&
(github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'COLLABORATOR')) ||
(github.event_name == 'pull_request_review_comment' &&
contains(github.event.comment.body, '@claude') &&
(github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'COLLABORATOR')) ||
(github.event_name == 'pull_request_review' &&
contains(github.event.review.body, '@claude') &&
(github.event.review.author_association == 'MEMBER' ||
github.event.review.author_association == 'OWNER' ||
github.event.review.author_association == 'COLLABORATOR')) ||
(github.event_name == 'issues' &&
(contains(github.event.issue.body, '@claude') ||
contains(github.event.issue.title, '@claude')) &&
(github.event.issue.author_association == 'MEMBER' ||
github.event.issue.author_association == 'OWNER' ||
github.event.issue.author_association == 'COLLABORATOR'))

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/claude.yml
Comment on lines +8 to +11
issues:
types: [opened, assigned]
pull_request_review:
types: [submitted]
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR description says Claude is invoked by mentioning @claude in a PR/issue comment, but this workflow also triggers on issues events (opened, assigned) and can run based on issue title/body contents. If that’s not intended, consider removing the issues trigger (or limiting it) to avoid unexpected runs and reduce attack surface.

Copilot uses AI. Check for mistakes.
Comment thread .github/workflows/claude.yml
actions: read # Required for Claude to read CI results on PRs
steps:
- name: Checkout repository
uses: actions/checkout@v4
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow uses actions/checkout@v4 (mutable tag). Other workflows in this repo typically pin actions to a commit SHA with a version comment (e.g. actions/checkout@93cb… # v5 in .github/workflows/linting.yml). Please pin this to a specific SHA to reduce supply-chain risk.

Suggested change
uses: actions/checkout@v4
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4

Copilot uses AI. Check for mistakes.
@ljwharbers ljwharbers merged commit 814c07b into main Mar 27, 2026
8 of 11 checks passed
@ljwharbers ljwharbers deleted the add-claude-github-actions-1774555749760 branch March 27, 2026 13:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ljwharbers