Conversation
There was a problem hiding this comment.
Pull request overview
Adds configuration to introduce a Claude-based PR review/mention responder workflow, plus agent ignore/settings files to avoid reading .env secrets.
Changes:
- Added a GitHub Actions workflow to auto-review PRs and respond to
@claudementions. - Added
.copilotignoreand.codexignoreentries to exclude.envfiles. - Added
.claude/settings.jsonto configure Claude permissions and deny reading.envfiles.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
.github/workflows/claude.yml |
Introduces Claude Code automation for PR reviews and @claude mention responses. |
.copilotignore |
Prevents Copilot tooling from ingesting .env files. |
.codexignore |
Prevents Codex tooling from ingesting .env files. |
.claude/settings.json |
Configures Claude permissions and explicitly denies reading .env files. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
.github/workflows/claude.yml
Outdated
| # Auto-review PRs to master | ||
| pull_request: | ||
| types: [opened, synchronize, ready_for_review, reopened] | ||
| branches: | ||
| - master | ||
|
|
There was a problem hiding this comment.
The workflow only runs for PRs targeting master (and comments say “to master”), but this repository appears to use main as the primary branch (e.g., PR diff base shows main). If the default branch is main, this workflow will never trigger. Consider switching the branch filter to main, or include both main and master if you need to support both.
.github/workflows/claude.yml
Outdated
| - uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} | ||
| track_progress: true |
There was a problem hiding this comment.
anthropic_api_key is sourced from secrets.ANTHROPIC_API_KEY while this job runs on the pull_request event. For PRs opened from forks, GitHub does not provide repository secrets to pull_request workflows, so this step will fail and the check may go red. If forked PRs are expected, add a guard to skip when github.event.pull_request.head.repo.fork is true (or when the secret is unavailable), or switch to a safer pull_request_target-based design with strict permissions.
No description provided.