Add Claude Code GitHub Workflow

[mertkaradayi]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Review	Updated (UTC)
redflag	Building	Preview, Comment	Dec 13, 2025 6:03pm

[claude]

Code Review: Claude Code Review Workflow

Thank you for adding the Claude Code Review workflow! This is a great addition to automate code reviews. I have reviewed the changes and have some feedback across different areas:

---

✅ Strengths

1. Well-structured workflow: The YAML syntax is correct and follows GitHub Actions best practices
2. Clear documentation: The PR description effectively explains what Claude Code is and how it works
3. Appropriate permissions: The workflow correctly specifies required permissions (contents: read, pull-requests: read, etc.)
4. Helpful comments: The commented-out sections provide useful guidance for future customization

---

🔍 Issues & Recommendations

1. Trigger Configuration - Performance & Cost Concern

Issue: The workflow runs on every push to a PR (synchronize event), which could lead to:

• High API costs (Claude API calls on every commit)
• Spam comments if reviews are posted multiple times
• Workflow queue congestion on active PRs

Recommendations:

• Consider using a label-based trigger or ready_for_review event instead
• Alternatively, use workflow_dispatch for manual triggering when reviews are needed

2. Duplicate Workflow - Redundancy

You already have .github/workflows/claude.yml which handles @claude mentions. This new workflow creates potential confusion:

• claude.yml: Responds to @claude mentions (comment-driven)
• claude-code-review.yml: Runs automatically on PR events

Recommendation: Consider consolidating or clearly documenting when each should be used. The comment-driven approach gives better control over when reviews happen.

3. Missing Error Handling

The workflow does not handle cases where:

• The CLAUDE_CODE_OAUTH_TOKEN secret is missing
• Claude fails to post a review
• The PR is a draft (might want to skip review)

Recommendation: Add conditional check: if: github.event.pull_request.draft == false

4. Security - Token Permissions

The workflow requests id-token: write permission but it is unclear why this is needed. This permission allows generating OIDC tokens for cloud provider authentication.

Recommendation: Remove unnecessary permissions to follow the principle of least privilege unless specifically needed.

5. Shallow Checkout Limitation

With fetch-depth: 1, Claude cannot:

• Review historical context
• Compare against base branch effectively
• Analyze multi-commit changes

Recommendation: Use fetch-depth: 0 or at least fetch-depth: 2 for meaningful diff analysis.

6. Prompt Could Reference AGENTS.md

The prompt mentions "Use the repositorys CLAUDE.md" but this file does not exist. However, you do have AGENTS.md.

Recommendation: Update the prompt to reference the correct file: AGENTS.md and README.md

7. Missing Test Coverage Guidance

The prompt asks Claude to review "Test coverage" but the AGENTS.md file states: "No automated suite is checked in yet."

Recommendation: Either remove test coverage from the review criteria until tests exist, or update the prompt to ask Claude to suggest tests rather than review existing coverage.

---

🛡️ Security Assessment

✅ Good:

• Secrets are properly referenced
• Read-only permissions for repo content
• Scoped allowed-tools limiting Claude capabilities to GitHub CLI commands

⚠️ Concerns:

• Running on every PR push could be abused by malicious actors opening spam PRs
• No branch protection - this will run even on PRs from forks if you allow that

Recommendation: Add repository protection to only run for repository members.

---

📊 Overall Assessment

Code Quality: ✅ Good (valid YAML, follows conventions)
Best Practices: ⚠️ Needs improvement (trigger strategy, permissions)
Bugs/Issues: ⚠️ Minor (incorrect file reference, potential cost issues)
Security: ✅ Mostly good (proper secret handling, scoped permissions)
Performance: ⚠️ Could be expensive (runs on every push)

---

🎯 Recommended Next Steps

1. High Priority: Change trigger to avoid running on every push (use labels or manual dispatch)
2. Medium Priority: Fix the CLAUDE.md to AGENTS.md reference
3. Medium Priority: Increase fetch-depth for better diffs
4. Low Priority: Remove unused id-token: write permission
5. Consider: Document the relationship between the two Claude workflows

---

Great work overall! The workflow is functional and well-documented. The main concern is the automatic triggering on every push, which could get expensive. Consider using the existing @claude mention workflow as the primary mechanism, or add label-based gating to this one.

Let me know if you would like help implementing any of these suggestions!