Conversation
WalkthroughAdds two GitHub Actions workflows to enable Claude AI-powered code review automation. The first workflow triggers on pull request events and posts code quality feedback via pull request comments. The second workflow listens for issue and pull request events and runs Claude Code integration when mentioned, with configurable permissions and action parameters. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes
Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/claude.yml (2)
20-26: Consider addingactions: readto the code-review workflow for consistency.This workflow includes
actions: readpermission (line 26) to allow Claude to read CI results on PRs. Theclaude-code-review.ymlworkflow might also benefit from this permission to provide more comprehensive code reviews that consider CI status.🔎 Suggested addition to claude-code-review.yml
Add to the permissions block in
.github/workflows/claude-code-review.yml:permissions: contents: read pull-requests: read issues: read id-token: write + actions: read # Required for Claude to read CI results on PRs
46-49: Consider adding tool restrictions for security.Unlike the
claude-code-review.ymlworkflow (which specifiesallowed-tools), this workflow has no explicit tool restrictions. This means Claude has broader access when invoked via @mentions.While this flexibility may be intentional for interactive use, consider whether to:
- Add similar tool restrictions for consistency and security
- Document why this workflow has fewer restrictions than the automated code-review workflow
If unrestricted access is intentional, consider uncommenting line 49 and adding a permissive but still bounded configuration.
🔎 Example tool restriction configuration
# Option 1: Match code-review workflow restrictions claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"' # Option 2: More permissive for interactive use (but still bounded) claude_args: '--allowed-tools "Bash(gh *)"'
📜 Review details
Configuration used: defaults
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude-code-review.yml(1 hunks).github/workflows/claude.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: test (3.10)
- GitHub Check: test (3.12)
- GitHub Check: test-with-coverage
- GitHub Check: test (3.11)
🔇 Additional comments (7)
.github/workflows/claude-code-review.yml (4)
1-12: Workflow trigger configuration looks good.The
pull_requesttrigger withopenedandsynchronizetypes is appropriate for automated code reviews. The optional path filters (currently commented) are useful for limiting reviews to specific file types if needed in the future.Note:
pull_requestevents from forks run with read-only permissions and secrets are not exposed to the fork's workflow, which provides good security isolation.
28-32: LGTM!The checkout configuration with
fetch-depth: 1is appropriate for this workflow, as it only needs the current state of the code without full history.
54-56: Well-configured tool restrictions for security.The
allowed-toolsconfiguration follows the principle of least privilege by:
- Limiting to specific
ghCLI commands- Allowing only read operations (view, list, diff, search) plus
gh pr commentfor posting feedback- Using wildcard patterns for flexibility while maintaining control
This is a good security practice for workflows that interact with external AI services.
21-26: Clarify authentication model and permissions strategy.The Claude Code GitHub app officially requires read & write permissions for Contents, Issues, and Pull requests, but official workflow examples use read-only GitHub permissions when paired with oauth_token authentication. If this workflow uses
claude_code_oauth_tokeninstead of the default GitHub app token, the read-only permissions are correct because Claude updates its initial comment rather than posting multiple new comments. Otherwise, addpull-requests: writeandissues: writeto the permissions block. Document which authentication model this workflow uses for clarity..github/workflows/claude.yml (3)
14-19: LGTM! Conditional logic correctly filters for @claude mentions.The conditional expression properly handles all four event types and checks the appropriate fields (
comment.body,review.body,issue.body,issue.title) for @claude mentions. This prevents the workflow from running unnecessarily.
27-31: LGTM!Standard checkout configuration appropriate for this workflow.
39-41: Theadditional_permissionssetting is necessary—it's not redundant with job-level permissions.The
additional_permissions: actions: readis an action-level input that configures the Claude action's internal behavior, distinct from the job-levelpermissionskey which controls the GITHUB_TOKEN scope. The action documentation indicates thatadditional_permissionsenables specific permissions, currently supporting 'actions: read' for viewing workflow results. These operate at different levels and serve different purposes, so the setting should be retained.
| prompt: | | ||
| REPO: ${{ github.repository }} | ||
| PR NUMBER: ${{ github.event.pull_request.number }} | ||
|
|
||
| Please review this pull request and provide feedback on: | ||
| - Code quality and best practices | ||
| - Potential bugs or issues | ||
| - Performance considerations | ||
| - Security concerns | ||
| - Test coverage | ||
|
|
||
| Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback. |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check if CLAUDE.md exists in the repository
if [ -f "CLAUDE.md" ]; then
echo "✓ CLAUDE.md exists"
echo "Preview of contents:"
head -n 20 CLAUDE.md
else
echo "✗ CLAUDE.md not found in repository root"
echo "Searching for similar files:"
fd -i claude.md 2>/dev/null || echo "No similar files found"
fiRepository: bharatr21/mcp-nvidia
Length of output: 133
Create CLAUDE.md or remove the reference from the prompt.
The workflow prompt references the repository's CLAUDE.md file for style and convention guidance, but this file does not exist. Either create CLAUDE.md with project-specific guidance for Claude, or remove the reference from the prompt.
🤖 Prompt for AI Agents
In .github/workflows/claude-code-review.yml around lines 39 to 50, the workflow
prompt references a non-existent CLAUDE.md file; either create that file with
repository-specific style/convention guidance for Claude or remove the reference
from the prompt. Fix option A: add a top-level CLAUDE.md containing the
project's coding style, review rules, expected tone, and any repository-specific
checks so the workflow can reference it. Fix option B: edit the workflow prompt
to remove the "Use the repository's CLAUDE.md for guidance on style and
conventions." line (or replace it with an inline summary of the guidance) so the
prompt no longer points to a missing file.
| on: | ||
| issue_comment: | ||
| types: [created] | ||
| pull_request_review_comment: | ||
| types: [created] | ||
| issues: | ||
| types: [opened, assigned] | ||
| pull_request_review: | ||
| types: [submitted] |
There was a problem hiding this comment.
Add permission filtering to restrict Claude workflow triggers to authorized users.
The current triggers (issue_comment, pull_request_review_comment, issues, pull_request_review) allow any user to initiate the workflow, which bypasses GitHub's approval requirements for external contributors. This could enable unauthorized API quota consumption or analysis runs.
Implement a job-level condition to restrict execution to repository members:
if: |
github.event.sender.type != 'Bot' &&
(github.event_name == 'issues' ||
github.event.comment.author_association == 'OWNER' ||
github.event.comment.author_association == 'MEMBER' ||
github.event.comment.author_association == 'COLLABORATOR')🤖 Prompt for AI Agents
.github/workflows/claude.yml lines 3-11: the workflow currently triggers on
issue_comment, pull_request_review_comment, issues, and pull_request_review
without any permission filtering; add a job-level if condition on the workflow
jobs that prevents runs from bots and only allows repository
members/owners/collaborators for comment-triggered events (and allow the issues
event) by checking github.event.sender.type != 'Bot' and author_association
values (OWNER, MEMBER, COLLABORATOR) for comment events, and include
github.event_name == 'issues' as an allowed event; apply this if expression to
the top-level jobs that perform the Claude actions so unauthorized external
users cannot trigger the workflow.
1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.