Add Claude Code GitHub Workflow

[cbenge509]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[claude]

Code Review: Claude Code GitHub Workflow Integration

I've reviewed PR #1 that adds Claude Code integration via GitHub Actions workflows. Overall, this is a well-structured and secure implementation with excellent documentation.

Critical Issues Found:

1. Missing Permission (CRITICAL)
File: .github/workflows/claude-code-review.yml:26

The workflow needs pull-requests: write permission to post review comments. Without this, gh pr comment will fail with a permissions error.

Fix: Change pull-requests: read to pull-requests: write

2. Security: Overly Permissive Allowed Tools (HIGH)
File: .github/workflows/claude-code-review.yml:56

The workflow allows Bash(gh search:*) which could be triggered by external contributors on every PR open/update. This could lead to excessive API calls.

Recommendation: Remove gh search from allowed tools and only keep: Bash(gh pr view:),Bash(gh pr diff:),Bash(gh pr comment:*)

3. Missing Concurrency Control (HIGH)
Both workflow files lack concurrency groups that your deploy.yml uses. This could cause race conditions if Claude is mentioned multiple times rapidly.

4. Redundant Checkout (MEDIUM)
The anthropics/claude-code-action@v1 action internally checks out the repository, making the explicit checkout step unnecessary.

5. Path Filters Too Restrictive (LOW)
The commented path filters exclude .astro and .css files which are critical to this Astro project per CLAUDE.md.

Strengths:

• Excellent security practices with proper secret management
• Well-designed workflow triggers with smart conditional logic
• Clear documentation in PR description
• Proper integration with CLAUDE.md for style guidance

Testing Checklist:

• Verify CLAUDE_CODE_OAUTH_TOKEN secret is set
• Test @claude mentions after merge
• Test automated review on new PRs
• Validate with external contributor PRs for security boundaries

Reviewed by: Claude Code Agent (Sonnet 4.5)