Conversation
Uses anthropics/claude-code-action with Max plan OAuth token to automatically review PRs for critical bugs, potential issues, and design concerns. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow to automatically run Anthropic’s Claude Code review action on pull requests, posting review feedback back to the PR.
Changes:
- Introduces a new
Claude Code Reviewworkflow triggered on PR open/synchronize events. - Grants the workflow
pull-requests: writepermission to publish review feedback. - Configures the Claude prompt to focus on critical bugs, potential bugs, and design concerns.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| anthropic_api_key: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
| prompt: | | ||
| Review this PR. Focus only on: |
There was a problem hiding this comment.
This workflow will run on all pull_request events, but secrets.CLAUDE_CODE_OAUTH_TOKEN will be unavailable for PRs coming from forks. That typically causes the job to fail (or the action to error), potentially blocking external contributions. Consider gating the job/step to only run when the secret is present and/or when github.event.pull_request.head.repo.full_name == github.repository (and otherwise skip cleanly).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
anthropics/claude-code-action@v1 is a third-party action referenced by a mutable tag. Pin it to a specific commit SHA (optionally with a comment indicating the corresponding version) to mitigate supply-chain risk.
| - uses: anthropics/claude-code-action@v1 | |
| - uses: anthropics/claude-code-action@<PINNED_COMMIT_SHA> # v1 |
| on: | ||
| pull_request: | ||
| types: [opened, synchronize] | ||
|
|
There was a problem hiding this comment.
This job uses a repository secret and pull-requests: write on the pull_request event. For PRs from forks, secrets.* won’t be provided and GITHUB_TOKEN is read-only, so the action will fail or be unable to post a review. Consider either (a) explicitly skipping forked PRs with an if: guard, or (b) switching to pull_request_target with a safe checkout strategy if you intend to support forks.
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| id-token: write |
There was a problem hiding this comment.
id-token: write grants OIDC token minting. Unless anthropics/claude-code-action explicitly requires OIDC, drop this permission to reduce the workflow’s privilege/attack surface.
| id-token: write |
Summary of Changes
Uses anthropics/claude-code-action with Max plan OAuth token to automatically review PRs for critical bugs, potential issues, and design concerns.
Checklist
Screenshots / Video