Add Claude Code GitHub Workflow by RETR0-OS · Pull Request #54 · ForgeOpus/visionforge

RETR0-OS · 2026-02-17T07:18:55Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Copilot

Pull request overview

This PR adds GitHub Actions workflows to integrate Claude Code, an AI coding assistant, into the VisionForge repository. The integration enables AI-powered code assistance through @claude mentions in issues and PRs, plus automated code reviews on all pull requests.

Changes:

Added claude.yml workflow for interactive @claude mentions in comments
Added claude-code-review.yml workflow for automated PR reviews
Both workflows use the CLAUDE_CODE_OAUTH_TOKEN secret for authentication

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
.github/workflows/claude.yml	Workflow triggered by @claude mentions in issues, PR comments, and reviews; enables interactive AI assistance
.github/workflows/claude-code-review.yml	Workflow that automatically runs Claude code review on every PR open/update using plugin-based review system

Copilot · 2026-02-17T07:22:06Z

.github/workflows/claude-code-review.yml

+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read


The workflow appears to be set up for automated code review on every PR, but the permissions block only grants read access to pull-requests. If the intent is for Claude to post review comments (as suggested by the workflow name "Claude Code Review"), write permission for pull-requests would be needed.

If the workflow is intended to only analyze PRs without posting comments, this is fine. However, if Claude should post review feedback, add pull-requests: write to the permissions block. Consider clarifying the intended behavior in the workflow comments.

Suggested change

pull-requests: read

pull-requests: write # Needed so Claude can post review comments on the PR

Copilot · 2026-02-17T07:22:06Z

.github/workflows/claude.yml

+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}


The PR description states that the secret should be ANTHROPIC_API_KEY, but the workflow uses CLAUDE_CODE_OAUTH_TOKEN. This inconsistency could lead to confusion during setup.

Update the PR description to reference CLAUDE_CODE_OAUTH_TOKEN as the correct secret name, or clarify that both names are being used in the documentation to match what's actually configured in the workflow files.

Copilot · 2026-02-17T07:22:07Z

.github/workflows/claude.yml

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The PR description states "Only users with write access to the repository can trigger the workflow", but there are no explicit permission checks in the workflow conditions to enforce this. GitHub Actions do have default protections, but the workflow doesn't validate the user's permission level before running.

Consider adding an explicit check in the workflow condition to verify the commenter has write permissions, such as checking github.event.comment.author_association is OWNER, MEMBER, or COLLABORATOR. This makes the security model explicit and prevents confusion about who can trigger Claude.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(

github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

(

github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR'

)

) ||

(

github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

(

github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR'

)

) ||

(

github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

(

github.event.review.author_association == 'OWNER' ||

github.event.review.author_association == 'MEMBER' ||

github.event.review.author_association == 'COLLABORATOR'

)

) ||

(

github.event_name == 'issues' &&

(

contains(github.event.issue.body, '@claude') ||

contains(github.event.issue.title, '@claude')

) &&

(

github.event.issue.author_association == 'OWNER' ||

github.event.issue.author_association == 'MEMBER' ||

github.event.issue.author_association == 'COLLABORATOR'

)

)

Copilot · 2026-02-17T07:22:07Z

.github/workflows/claude-code-review.yml

+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read


The permissions block is missing the actions: read permission that is mentioned in the claude.yml workflow and the inline comment on line 26. This permission is needed for Claude to read CI results on PRs as mentioned in the comment.

Add actions: read to the permissions block to match the stated requirement and ensure Claude can access CI/CD results when performing code reviews.

Suggested change

issues: read

issues: read

actions: read

Copilot · 2026-02-17T07:22:07Z

.github/workflows/claude-code-review.yml

+    # paths:
+    #   - "src/**/*.ts"
+    #   - "src/**/*.tsx"
+    #   - "src/**/*.js"
+    #   - "src/**/*.jsx"


The workflow always runs on all pull requests (opened, synchronize, ready_for_review, reopened) without any filters. This could result in significant API costs and resource usage as every PR change will trigger an automated Claude review.

Consider uncommenting and configuring the path filters (lines 6-11) to only run on code files that actually need review, or add a condition to only run when specifically requested via a label or comment. The commented author filter (lines 15-19) could also be useful to limit automated reviews to certain contributors.

Suggested change

# paths:

# - "src/**/*.ts"

# - "src/**/*.tsx"

# - "src/**/*.js"

# - "src/**/*.jsx"

paths:

- "src/**/*.ts"

- "src/**/*.tsx"

- "src/**/*.js"

- "src/**/*.jsx"

Copilot · 2026-02-17T07:22:07Z

.github/workflows/claude-code-review.yml

+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'


The workflow references a GitHub repository URL and plugins that are not verified or documented in the PR. The URL https://github.com/anthropics/claude-code.git and the plugin code-review@claude-code-plugins need to be validated to exist and be trustworthy before merging.

Verify that these resources exist and are official Anthropic repositories. Consider adding documentation about what these plugins do and why they're required for the code review functionality.

Suggested change

plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'

plugins: 'code-review@claude-code-plugins'

# NOTE: Custom plugin marketplaces and plugins are intentionally not configured here.

# Only add explicit marketplaces/plugins after verifying they are official Anthropic

# resources and documenting why they are required for code review in this repo.

Copilot · 2026-02-17T07:22:08Z

.github/workflows/claude-code-review.yml

+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
+          plugins: 'code-review@claude-code-plugins'
+          prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'


The prompt hardcodes the GitHub repository reference using a dynamic variable, but there's no validation that the pull request number is valid or that the repository context is correctly formatted. If the variables are malformed, Claude could receive an invalid prompt.

Add error handling or validation to ensure the constructed prompt is valid before being passed to Claude. Consider using a more robust prompt construction method or validating that github.event.pull_request.number exists and is numeric.

RETR0-OS added 2 commits February 17, 2026 00:18

"Claude PR Assistant workflow"

e7f1f85

"Claude Code Review workflow"

ab8351b

Copilot AI review requested due to automatic review settings February 17, 2026 07:18

RETR0-OS merged commit c4844d3 into main Feb 17, 2026
5 checks passed

Copilot started reviewing on behalf of RETR0-OS February 17, 2026 07:19 View session

RETR0-OS deleted the add-claude-github-actions-1771312708117 branch February 17, 2026 07:19

Copilot AI reviewed Feb 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Claude Code GitHub Workflow#54

Add Claude Code GitHub Workflow#54
RETR0-OS merged 2 commits intomainfrom
add-claude-github-actions-1771312708117

RETR0-OS commented Feb 17, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Copilot AI Feb 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	pull-requests: read
	pull-requests: write # Needed so Claude can post review comments on the PR

-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      (
+        github.event_name == 'issue_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        (
+          github.event.comment.author_association == 'OWNER' ||
+          github.event.comment.author_association == 'MEMBER' ||
+          github.event.comment.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'pull_request_review_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        (
+          github.event.comment.author_association == 'OWNER' ||
+          github.event.comment.author_association == 'MEMBER' ||
+          github.event.comment.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'pull_request_review' &&
+        contains(github.event.review.body, '@claude') &&
+        (
+          github.event.review.author_association == 'OWNER' ||
+          github.event.review.author_association == 'MEMBER' ||
+          github.event.review.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'issues' &&
+        (
+          contains(github.event.issue.body, '@claude') ||
+          contains(github.event.issue.title, '@claude')
+        ) &&
+        (
+          github.event.issue.author_association == 'OWNER' ||
+          github.event.issue.author_association == 'MEMBER' ||
+          github.event.issue.author_association == 'COLLABORATOR'
+        )
+      )

		plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
		plugins: 'code-review@claude-code-plugins'

-          plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
-          plugins: 'code-review@claude-code-plugins'
+          # NOTE: Custom plugin marketplaces and plugins are intentionally not configured here.
+          # Only add explicit marketplaces/plugins after verifying they are official Anthropic
+          # resources and documenting why they are required for code review in this repo.

Conversation

RETR0-OS commented Feb 17, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant