Repository navigation
Explain how to change a server's configuration #6557
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code | |
| on: | |
| # Comment commands require current write access in the authorize job. | |
| # Maintainers must review PR code before requesting privileged Claude runs. | |
| issue_comment: # zizmor: ignore[dangerous-triggers] | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| issues: | |
| types: [opened, assigned] | |
| pull_request_review: | |
| types: [submitted] | |
| jobs: | |
| authorize: | |
| # Filter requests before checking the triggering actor's current access. | |
| if: | | |
| (github.event_name == 'issue_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || | |
| (github.event_name == 'pull_request_review_comment' && | |
| contains(github.event.comment.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || | |
| (github.event_name == 'pull_request_review' && | |
| contains(github.event.review.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) || | |
| (github.event_name == 'issues' && | |
| contains(github.event.issue.body, '@claude') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Check requester has write access | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| REQUESTER: ${{ github.actor }} | |
| run: | | |
| PERMISSION="$(gh api "repos/${{ github.repository }}/collaborators/$REQUESTER/permission" --jq '.permission')" | |
| if [[ "$PERMISSION" != "admin" && "$PERMISSION" != "write" ]]; then | |
| echo "::error::@$REQUESTER does not have write access to this repo - refusing to run." | |
| exit 1 | |
| fi | |
| claude: | |
| needs: authorize | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| # Initial checkout so GitHub Actions can resolve the local | |
| # composite action below. The composite re-checks out the | |
| # repo itself; this first checkout only needs the .github | |
| # directory. | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 1 | |
| sparse-checkout: .github | |
| persist-credentials: false | |
| # Checkout + Node + deps so Claude can run build/lint/format | |
| # scripts when asked. | |
| - name: Set up repo and dependencies | |
| uses: $/.github/actions/setup | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@374f254f5efaf968abfe15d399fd90972e8138b9 # v1.0.251 | |
| env: | |
| ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL }} | |
| with: | |
| anthropic_api_key: ${{ secrets.STACKLOK_GATEWAY_KEY_CLAUDE_TAG }} | |
| additional_permissions: | | |
| actions: read | |
| claude_args: | | |
| --allowedTools "Bash(npm run build),Bash(npm run prettier),Bash(npm run prettier:fix),Bash(npm run eslint),Bash(npm run eslint:fix)" |