Add Claude Code GitHub Workflow#3
Merged
Merged
Conversation
Review Summary by QodoAdd Claude Code GitHub Actions workflows for automated reviews
WalkthroughsDescription• Adds two GitHub Actions workflows for Claude Code integration • First workflow enables automated code reviews on pull requests • Second workflow allows Claude to respond to @claude mentions • Provides flexible configuration options for filtering and permissions Diagramflowchart LR
PR["Pull Request Events"]
Comments["Issue/PR Comments"]
PR -- "triggers" --> CodeReview["Claude Code Review Workflow"]
Comments -- "triggers on @claude" --> Claude["Claude Code Workflow"]
CodeReview -- "runs" --> Review["Automated Code Review"]
Claude -- "executes" --> Action["Claude Actions"]
Review --> Feedback["Review Feedback"]
Action --> Response["Claude Response"]
File Changes1. .github/workflows/claude-code-review.yml
|
Code Review by Qodo
1. Unrestricted @claude triggers
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+15
to
+19
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | ||
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | ||
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) |
There was a problem hiding this comment.
1. Unrestricted @claude triggers 🐞 Bug ⛨ Security
In .github/workflows/claude.yml, the job runs whenever any comment/review/issue text contains @claude without checking the sender’s repo permission/association, yet it passes secrets.CLAUDE_CODE_OAUTH_TOKEN into a third-party action. This allows any external commenter to trigger secret-bearing runs (cost/abuse risk and increased secret exposure surface).
Agent Prompt
### Issue description
`claude` job triggers on any `@claude` text from any commenter, but the job also passes `secrets.CLAUDE_CODE_OAUTH_TOKEN` to a third-party action. Add an authorization gate so only trusted actors (e.g., OWNER/MEMBER/COLLABORATOR, or an explicit allowlist) can trigger the workflow.
### Issue Context
Current job-level `if:` only checks for the substring `@claude` and does not validate `author_association`/permissions.
### Fix Focus Areas
- .github/workflows/claude.yml[15-19]
- .github/workflows/claude.yml[33-38]
### Suggested change
- Extend the job `if:` to also require trusted actors for each event type, e.g. check `github.event.comment.author_association` / `github.event.issue.author_association` / `github.event.review.author_association` is in `{OWNER, MEMBER, COLLABORATOR}` (and optionally exclude bots).
- If you need broader access, use an explicit allowlist of `github.actor` values.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Comment on lines
+36
to
+40
| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' | ||
| plugins: 'code-review@claude-code-plugins' |
There was a problem hiding this comment.
2. Unpinned action and plugins 🐞 Bug ⛨ Security
Both workflows execute anthropics/claude-code-action pinned only to the mutable v1 tag, and the review workflow loads plugins from a remote marketplace without an immutable version/commit pin. If the tag/plugin changes (or is compromised), different code can run in CI with access to CLAUDE_CODE_OAUTH_TOKEN.
Agent Prompt
### Issue description
The workflows execute third-party code (`anthropics/claude-code-action@v1`) and remote plugins without immutable pinning. This increases supply-chain risk, especially since the job passes `CLAUDE_CODE_OAUTH_TOKEN`.
### Issue Context
Tags like `v1` can move; remote plugin references can change over time.
### Fix Focus Areas
- .github/workflows/claude.yml[34-37]
- .github/workflows/claude-code-review.yml[36-40]
### Suggested change
- Replace `anthropics/claude-code-action@v1` with a specific commit SHA (and use Dependabot/GitHub tools to keep it updated safely).
- If plugins must be used, pin them to immutable versions/SHAs (if the action supports it) or vendor/lock the plugin source rather than pulling mutable remote code at runtime.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!