Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 32 additions & 4 deletions .github/workflows/claude-code-review.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,43 @@ name: Claude Code Review

on:
pull_request:
types: [opened, synchronize]
types: [opened, synchronize, ready_for_review, reopened]

jobs:
claude-review:
uses: shakacode/.github/.github/workflows/claude-code-review.yml@main
runs-on: ubuntu-latest
permissions:
contents: read
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow is missing the 'actions: read' permission that is present in the claude.yml workflow. According to the comment in claude.yml (line 26), this permission is "Required for Claude to read CI results on PRs". Consider adding this permission if Claude should be able to read CI results during code review, which would be valuable for providing more comprehensive feedback.

Suggested change
contents: read
contents: read
actions: read

Copilot uses AI. Check for mistakes.
pull-requests: write
issues: write
id-token: write
secrets:
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

steps:
- name: Checkout repository
uses: actions/checkout@v6
with:
fetch-depth: 1

- name: Run Claude Code Review
id: claude-review
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If the 'actions: read' permission is added to the permissions block (as suggested in another comment), you should also add the 'additional_permissions' configuration to the action inputs, similar to lines 40-41 in claude.yml. This ensures Claude can properly utilize the actions permission.

Copilot uses AI. Check for mistakes.
prompt: |
REPO: ${{ github.repository }}
PR NUMBER: ${{ github.event.pull_request.number }}

Please review this pull request with a focus on:
- Code quality and best practices
- Potential bugs or issues
- Security implications
- Performance considerations

Note: The PR branch is already checked out in the current working directory.

Use `gh pr comment` for top-level feedback.
Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
Only post GitHub comments - don't submit review text as messages.

claude_args: |
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
Copy link

Copilot AI Feb 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The argument uses '--allowedTools' (camelCase) but the example in claude.yml (line 49) shows '--allowed-tools' (with hyphen). Verify which format is correct for the Claude Code Action. If the correct format is '--allowed-tools', this should be updated to match the documented format.

Suggested change
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
--allowed-tools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

Copilot uses AI. Check for mistakes.
Loading