Repository navigation
Add Claude Code GitHub Workflow - #29
Conversation
审查者指南介绍两个集成 Claude Code 的 GitHub Actions 工作流：一个会自动审查拉取请求并发布行内评论，另一个会使用仓库的 OAuth 密钥和限定范围的 GitHub 权限，响应 issues 和拉取请求讨论中看似经过授权的 @claude 提及。 @claude 提及处理流程图sequenceDiagram
actor User
participant GitHub
participant Workflow as claude.yml
participant Action as ClaudeCodeAction
participant Repository
User->>GitHub: 创建包含 @claude 的 issue 或拉取请求讨论评论
GitHub->>Workflow: issue_comment / pull_request_review_comment / pull_request_review / issues
Workflow->>Workflow: contains(event text, @claude)
Workflow->>Action: 运行 Claude Code
Action->>Repository: 读取仓库和讨论上下文
Action-->>GitHub: 响应请求
自动拉取请求审查流程图sequenceDiagram
participant GitHub
participant Workflow as claude-code-review.yml
participant Action as ClaudeCodeAction
participant PullRequest
GitHub->>Workflow: pull_request opened / synchronize / ready_for_review / reopened
Workflow->>Action: 运行 /code-review:code-review
Action->>PullRequest: 读取拉取请求上下文
Action->>PullRequest: create_inline_comment
文件级变更
提示和命令与 Sourcery 交互
自定义你的使用体验访问你的控制面板：
获取帮助Original review guide in EnglishReviewer's GuideIntroduces two GitHub Actions workflows that integrate Claude Code: one automatically reviews pull requests and posts inline comments, while the other responds to authorized-looking @claude mentions across issues and pull request discussions using the repository’s OAuth secret and scoped GitHub permissions. Sequence diagram for @claude mention handlingsequenceDiagram
actor User
participant GitHub
participant Workflow as claude.yml
participant Action as ClaudeCodeAction
participant Repository
User->>GitHub: Create issue or pull request discussion comment containing @claude
GitHub->>Workflow: issue_comment / pull_request_review_comment / pull_request_review / issues
Workflow->>Workflow: contains(event text, @claude)
Workflow->>Action: Run Claude Code
Action->>Repository: Read repository and discussion context
Action-->>GitHub: Respond to the request
Sequence diagram for automated pull request reviewsequenceDiagram
participant GitHub
participant Workflow as claude-code-review.yml
participant Action as ClaudeCodeAction
participant PullRequest
GitHub->>Workflow: pull_request opened / synchronize / ready_for_review / reopened
Workflow->>Action: Run /code-review:code-review
Action->>PullRequest: Read pull request context
Action->>PullRequest: create_inline_comment
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
Deploying ipe-plugin-registry with
|
| Latest commit: |
bdaac8a
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://808058de.plugin-registry.pages.dev |
| Branch Preview URL: | https://add-claude-github-actions-17.plugin-registry.pages.dev |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
您好——我发现了 8 个问题
面向 AI Agent 的提示词
请处理本次代码审查中的评论：
## 单条评论
### 评论 1
<location path=".github/workflows/claude.yml" line_range="16" />
<code_context>
+jobs:
+ claude:
+ if: |
+ (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+ (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+ (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
</code_context>
<issue_to_address>
**未经授权的用户可以启动 Claude 运行**
当没有仓库写入权限的用户在 issue、拉取请求评论、审查评论或新 issue 中提及 `@claude` 时，`claude` job 的条件只检查是否包含该提及，却没有检查发送者的权限。因此，外部用户可以使用 `CLAUDE_CODE_OAUTH_TOKEN` 启动一次运行，并提交 Agent 请求，消耗仓库的 Claude 使用量。
在启动 job 之前，要求事件发送者具有仓库写入权限。
另见 `.github/workflows/claude.yml:19`。
</issue_to_address>
### 评论 2
<location path=".github/workflows/claude.yml" line_range="35" />
<code_context>
+
+ - name: Run Claude Code Review
+ id: claude-review
+ uses: anthropics/claude-code-action@v1
+ with:
+ claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
</code_context>
<issue_to_address>
**Claude 拥有不受限制的 shell 访问权限**
当 Claude 处理要求其运行 shell 命令的提示词时，Claude Code 的默认工具包括 `Bash`，而此工作流没有对这些工具进行限制。因此，提示词可以在运行器上执行任意命令，这违背了仅限仓库操作的既定限制，并可能暴露 job 可用的凭据。
为此工作流配置严格的工具允许列表，并避免向 Claude 可以运行的子进程暴露凭据。
另见 `.github/workflows/claude.yml:49`。
</issue_to_address>
### 评论 3
<location path=".github/workflows/claude-code-review.yml" line_range="24" />
<code_context>
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: read
+ issues: read
+ id-token: write
</code_context>
<issue_to_address>
**审查评论永远不会出现**
当 Claude 尝试发布审查评论或回复时，`claude-code-review` 工作流授予其 GitHub token 对拉取请求和 issue 的仅读权限，因此请求的评论和回复写入操作会失败，用户看不到发布结果。
为审查工作流授予拉取请求和 issue 所需的写入权限。
另见 `.github/workflows/claude.yml:23-25`。
</issue_to_address>
### 评论 4
<location path=".github/workflows/claude-code-review.yml" line_range="4" />
<code_context>
+name: Claude Code Review
+
+on:
+ pull_request:
+ types: [opened, synchronize, ready_for_review, reopened]
+ # Optional: Only run on specific file changes
</code_context>
<issue_to_address>
**来自 fork 的审查无法启动**
当拉取请求来自 fork 时，GitHub 会阻止由 fork PR 触发的 `pull_request` 工作流访问仓库机密，导致 `CLAUDE_CODE_OAUTH_TOKEN` 为空；审查 action 无法进行身份验证，因此 fork PR 不会收到自动审查。
通过可信工作流运行 fork 审查，使其能够访问 OAuth token，同时不会将该 token 暴露给由 fork 控制的代码。
另见 `.github/workflows/claude-code-review.yml:5`、`.github/workflows/claude-code-review.yml:38`。
</issue_to_address>
### 评论 5
<location path=".github/workflows/claude.yml" line_range="23-24" />
<code_context>
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: read
+ issues: read
+ id-token: write
+
</code_context>
<issue_to_address>
**Claude 回复永远不会出现**
当 Claude 尝试发布 issue 回复或内联审查评论时，`claude` 工作流授予其 GitHub token 对 issue 和拉取请求的仅读权限，因此请求的评论写入操作会失败，用户看不到回复或内联评论。
为工作流授予 issue 和拉取请求所需的写入权限。
另见 `.github/workflows/claude-code-review.yml:23-27`。
</issue_to_address>
### 评论 6
<location path=".github/workflows/claude.yml" line_range="38" />
<code_context>
+name: Claude Code Review
+
+on:
+ pull_request:
</code_context>
<issue_to_address>
**API 密钥无法通过 OAuth 身份验证**
当配置的 secret 包含 Anthropic API 密钥而不是 Claude Code OAuth token 时，action 会通过 `claude_code_oauth_token` 输入接收该 secret。因此，按照描述存储在其中的 Anthropic API 密钥并不是预期的 OAuth 凭据，Claude 身份验证会失败。
在该 secret 中存储 Claude Code OAuth token，或使用 API 密钥配置 action 的 API 密钥输入项。
另见 `.github/workflows/claude-code-review.yml:38`。
</issue_to_address>
### 评论 7
<location path=".github/workflows/claude.yml" line_range="8-9" />
<code_context>
+ types: [created]
+ pull_request_review_comment:
+ types: [created]
+ issues:
+ types: [opened, assigned]
+ pull_request_review:
+ types: [submitted]
</code_context>
<issue_to_address>
**Issue 中的提及会触发重复运行**
当包含 `@claude` 的 issue 在打开后被分配时，`issues` 订阅会分别针对 `opened` 和 `assigned` 启动一次运行，因此未发生变化的提及会再次启动运行，并可能产生重复回复或重复操作。
除非希望分配操作启动新运行，否则请从 issue 事件类型中移除 `assigned`。
</issue_to_address>
### 评论 8
<location path=".github/workflows/claude.yml" line_range="22" />
<code_context>
+
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: read
+ issues: read
</code_context>
<issue_to_address>
**无法推送代码变更**
当请求要求 Claude 提交或推送代码变更时，Claude 编码 job 获得的 GitHub token 仅具有 `contents: read` 权限，因此无法向仓库推送分支或提交变更。代码编辑请求因此不会留下调用者可使用的变更。
如果需要写入仓库，请授予 job `contents: write` 权限；或者将工作流限制为不需要持久化代码变更的请求。
</issue_to_address>Sourcery 评估
需要人工审查。 请先处理 8 个发现的问题。此外，此变更引入了一个使用 OAuth secret 和 id-token: write 权限的外部 GitHub Action，并允许来自 issue 或审查评论的提示词调用它；任何错误都可能暴露仓库上下文或凭据，或消耗工作流的信任边界。回滚可以阻止后续运行，但已经触发的运行所造成的 token 使用或数据暴露无法撤销。
阻塞性问题：.github/workflows/claude.yml:16、.github/workflows/claude.yml:35、.github/workflows/claude-code-review.yml:24、.github/workflows/claude-code-review.yml:4、.github/workflows/claude.yml:24，以及另外 3 个问题
Original comment in English
Hey - I've found 8 issues
Prompt for AI Agents
Please address the comments from this code review:
## Individual Comments
### Comment 1
<location path=".github/workflows/claude.yml" line_range="16" />
<code_context>
+jobs:
+ claude:
+ if: |
+ (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+ (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+ (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
</code_context>
<issue_to_address>
**Unauthorized users start Claude runs**
When a user without repository write access mentions `@claude` in an issue or pull request comment, review, or new issue, the `claude` job condition checks for the mention but not the sender’s permissions, so an outsider starts a run with `CLAUDE_CODE_OAUTH_TOKEN` and can submit agent requests that consume the repository’s Claude usage.
Require the event’s sender to have repository write access before starting the job.
Also at `.github/workflows/claude.yml:19`.
</issue_to_address>
### Comment 2
<location path=".github/workflows/claude.yml" line_range="35" />
<code_context>
+
+ - name: Run Claude Code Review
+ id: claude-review
+ uses: anthropics/claude-code-action@v1
+ with:
+ claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
</code_context>
<issue_to_address>
**Claude has unrestricted shell access**
When claude processes a prompt that asks it to run shell commands, claude Code’s default tools include `Bash`, and this workflow does not restrict them; a prompt can therefore run arbitrary commands on the runner, contrary to the stated limitation to repository operations, and expose credentials available to the job.
Configure a restrictive tool allowlist for this workflow and avoid exposing credentials to subprocesses Claude can run.
Also at `.github/workflows/claude.yml:49`.
</issue_to_address>
### Comment 3
<location path=".github/workflows/claude-code-review.yml" line_range="24" />
<code_context>
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: read
+ issues: read
+ id-token: write
</code_context>
<issue_to_address>
**Review comments never appear**
When claude attempts to publish a review comment or reply, the `claude-code-review` workflow gives its GitHub token only read access to pull requests and issues, so the requested comment and reply writes fail and users see no posted result.
Grant the review workflow the required write permissions for pull requests and issues.
Also at `.github/workflows/claude.yml:23-25`.
</issue_to_address>
### Comment 4
<location path=".github/workflows/claude-code-review.yml" line_range="4" />
<code_context>
+name: Claude Code Review
+
+on:
+ pull_request:
+ types: [opened, synchronize, ready_for_review, reopened]
+ # Optional: Only run on specific file changes
</code_context>
<issue_to_address>
**Fork reviews fail to start**
When the pull request comes from a fork, gitHub withholds repository secrets from `pull_request` workflows triggered by fork PRs, leaving `CLAUDE_CODE_OAUTH_TOKEN` empty; the review action cannot authenticate, so fork PRs receive no automated review.
Run fork reviews through a trusted workflow that can access the OAuth token without exposing it to fork-controlled code.
Also at `.github/workflows/claude-code-review.yml:5`, `.github/workflows/claude-code-review.yml:38`.
</issue_to_address>
### Comment 5
<location path=".github/workflows/claude.yml" line_range="23-24" />
<code_context>
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: read
+ issues: read
+ id-token: write
+
</code_context>
<issue_to_address>
**Claude replies never appear**
When claude tries to post an issue reply or inline review comment, the `claude` workflow gives its GitHub token only read access to issues and pull requests, so the requested comment writes fail and users see no replies or inline comments.
Grant the workflow the required write permissions for issues and pull requests.
Also at `.github/workflows/claude-code-review.yml:23-27`.
</issue_to_address>
### Comment 6
<location path=".github/workflows/claude.yml" line_range="38" />
<code_context>
+name: Claude Code Review
+
+on:
+ pull_request:
</code_context>
<issue_to_address>
**API key fails OAuth authentication**
When the configured secret contains an Anthropic API key rather than a Claude Code OAuth token, the action receives the secret through its `claude_code_oauth_token` input, so an Anthropic API key stored there as described is not the expected OAuth credential and Claude authentication fails.
Store a Claude Code OAuth token in that secret or configure the action’s API-key input with an API key.
Also at `.github/workflows/claude-code-review.yml:38`.
</issue_to_address>
### Comment 7
<location path=".github/workflows/claude.yml" line_range="8-9" />
<code_context>
+ types: [created]
+ pull_request_review_comment:
+ types: [created]
+ issues:
+ types: [opened, assigned]
+ pull_request_review:
+ types: [submitted]
</code_context>
<issue_to_address>
**Issue mentions trigger duplicate runs**
When an issue containing `@claude` is assigned after it is opened, the `issues` subscription starts a run for both `opened` and `assigned`, so the unchanged mention starts another run and can produce duplicate responses or repeated actions.
Remove `assigned` from the issue event types unless assignment is intended to start a new run.
</issue_to_address>
### Comment 8
<location path=".github/workflows/claude.yml" line_range="22" />
<code_context>
+
+ runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ pull-requests: read
+ issues: read
</code_context>
<issue_to_address>
**Code changes cannot be pushed**
When a request requires Claude to commit or push code changes, the Claude coding job receives a GitHub token with `contents: read`, so it cannot push a branch or commit changes to the repository. Code-editing requests therefore leave no changes for the caller to use.
Grant the job `contents: write` when repository writes are intended, or constrain the workflow to requests that do not require persisted code changes.
</issue_to_address>Sourcery assessment
Needs a human reviewer. 8 findings to address first, and this adds an externally supplied GitHub Action with an OAuth secret and id-token: write permission, and allows prompts from issue or review comments to invoke it; a mistake could expose repository context or credentials or consume the workflow's trust boundary. Reverting stops future runs, but any token use or data exposure from an already-triggered run cannot be undone.
Blocking findings: .github/workflows/claude.yml:16, .github/workflows/claude.yml:35, .github/workflows/claude-code-review.yml:24, .github/workflows/claude-code-review.yml:4, .github/workflows/claude.yml:24, and 3 more
| jobs: | ||
| claude: | ||
| if: | | ||
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || |
There was a problem hiding this comment.
🟠 高 · 未经授权的用户可以启动 Claude 运行
当没有仓库写入权限的用户在 issue、拉取请求评论、审查评论或新 issue 中提及 @claude 时，claude job 的条件只检查是否包含该提及，却没有检查发送者的权限。因此，外部用户可以使用 CLAUDE_CODE_OAUTH_TOKEN 启动一次运行，并提交 Agent 请求，消耗仓库的 Claude 使用量。
在启动 job 之前，要求事件发送者具有仓库写入权限。
另见 .github/workflows/claude.yml:19。
面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 16 行：
**未经授权的用户可以启动 Claude 运行**
当没有仓库写入权限的用户在 issue、拉取请求评论、审查评论或新 issue 中提及 `@claude` 时，`claude` job 的条件只检查是否包含该提及，却没有检查发送者的权限。因此，外部用户可以使用 `CLAUDE_CODE_OAUTH_TOKEN` 启动一次运行，并提交 Agent 请求，消耗仓库的 Claude 使用量。
在启动 job 之前，要求事件发送者具有仓库写入权限。
另见 `.github/workflows/claude.yml:19`。Original comment in English
🟠 High · Unauthorized users start Claude runs
When a user without repository write access mentions @claude in an issue or pull request comment, review, or new issue, the claude job condition checks for the mention but not the sender’s permissions, so an outsider starts a run with CLAUDE_CODE_OAUTH_TOKEN and can submit agent requests that consume the repository’s Claude usage.
Require the event’s sender to have repository write access before starting the job.
Also at .github/workflows/claude.yml:19.
Prompt for AI agents
In `.github/workflows/claude.yml` at line 16:
**Unauthorized users start Claude runs**
When a user without repository write access mentions `@claude` in an issue or pull request comment, review, or new issue, the `claude` job condition checks for the mention but not the sender’s permissions, so an outsider starts a run with `CLAUDE_CODE_OAUTH_TOKEN` and can submit agent requests that consume the repository’s Claude usage.
Require the event’s sender to have repository write access before starting the job.
Also at `.github/workflows/claude.yml:19`.|
|
||
| - name: Run Claude Code | ||
| id: claude | ||
| uses: anthropics/claude-code-action@v1 |
There was a problem hiding this comment.
🟠 高 · Claude 拥有不受限制的 shell 访问权限
当 Claude 处理要求其运行 shell 命令的提示词时，Claude Code 的默认工具包括 Bash，而此工作流没有对这些工具进行限制。因此，提示词可以在运行器上执行任意命令，这违背了仅限仓库操作的既定限制，并可能暴露 job 可用的凭据。
为此工作流配置严格的工具允许列表，并避免向 Claude 可以运行的子进程暴露凭据。
另见 .github/workflows/claude.yml:49。
面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 35 行：
**Claude 拥有不受限制的 shell 访问权限**
当 Claude 处理要求其运行 shell 命令的提示词时，Claude Code 的默认工具包括 `Bash`，而此工作流没有对这些工具进行限制。因此，提示词可以在运行器上执行任意命令，这违背了仅限仓库操作的既定限制，并可能暴露 job 可用的凭据。
为此工作流配置严格的工具允许列表，并避免向 Claude 可以运行的子进程暴露凭据。
另见 `.github/workflows/claude.yml:49`。Original comment in English
🟠 High · Claude has unrestricted shell access
When claude processes a prompt that asks it to run shell commands, claude Code’s default tools include Bash, and this workflow does not restrict them; a prompt can therefore run arbitrary commands on the runner, contrary to the stated limitation to repository operations, and expose credentials available to the job.
Configure a restrictive tool allowlist for this workflow and avoid exposing credentials to subprocesses Claude can run.
Also at .github/workflows/claude.yml:49.
Prompt for AI agents
In `.github/workflows/claude.yml` at line 35:
**Claude has unrestricted shell access**
When claude processes a prompt that asks it to run shell commands, claude Code’s default tools include `Bash`, and this workflow does not restrict them; a prompt can therefore run arbitrary commands on the runner, contrary to the stated limitation to repository operations, and expose credentials available to the job.
Configure a restrictive tool allowlist for this workflow and avoid exposing credentials to subprocesses Claude can run.
Also at `.github/workflows/claude.yml:49`.| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: read |
There was a problem hiding this comment.
🟠 高 · 审查评论永远不会出现
当 Claude 尝试发布审查评论或回复时，claude-code-review 工作流授予其 GitHub token 对拉取请求和 issue 的仅读权限，因此请求的评论和回复写入操作会失败，用户看不到发布结果。
为审查工作流授予拉取请求和 issue 所需的写入权限。
另见 .github/workflows/claude.yml:23-25。
面向 AI Agent 的提示词
在 `.github/workflows/claude-code-review.yml` 第 24 行：
**审查评论永远不会出现**
当 Claude 尝试发布审查评论或回复时，`claude-code-review` 工作流授予其 GitHub token 对拉取请求和 issue 的仅读权限，因此请求的评论和回复写入操作会失败，用户看不到发布结果。
为审查工作流授予拉取请求和 issue 所需的写入权限。
另见 `.github/workflows/claude.yml:23-25`。Original comment in English
🟠 High · Review comments never appear
When claude attempts to publish a review comment or reply, the claude-code-review workflow gives its GitHub token only read access to pull requests and issues, so the requested comment and reply writes fail and users see no posted result.
Grant the review workflow the required write permissions for pull requests and issues.
Also at .github/workflows/claude.yml:23-25.
Prompt for AI agents
In `.github/workflows/claude-code-review.yml` at line 24:
**Review comments never appear**
When claude attempts to publish a review comment or reply, the `claude-code-review` workflow gives its GitHub token only read access to pull requests and issues, so the requested comment and reply writes fail and users see no posted result.
Grant the review workflow the required write permissions for pull requests and issues.
Also at `.github/workflows/claude.yml:23-25`.| name: Claude Code Review | ||
|
|
||
| on: | ||
| pull_request: |
There was a problem hiding this comment.
🟠 高 · 来自 fork 的审查无法启动
当拉取请求来自 fork 时，GitHub 会阻止由 fork PR 触发的 pull_request 工作流访问仓库机密，导致 CLAUDE_CODE_OAUTH_TOKEN 为空；审查 action 无法进行身份验证，因此 fork PR 不会收到自动审查。
通过可信工作流运行 fork 审查，使其能够访问 OAuth token，同时不会将该 token 暴露给由 fork 控制的代码。
另见 .github/workflows/claude-code-review.yml:5、.github/workflows/claude-code-review.yml:38。
面向 AI Agent 的提示词
在 `.github/workflows/claude-code-review.yml` 第 4 行：
**来自 fork 的审查无法启动**
当拉取请求来自 fork 时，GitHub 会阻止由 fork PR 触发的 `pull_request` 工作流访问仓库机密，导致 `CLAUDE_CODE_OAUTH_TOKEN` 为空；审查 action 无法进行身份验证，因此 fork PR 不会收到自动审查。
通过可信工作流运行 fork 审查，使其能够访问 OAuth token，同时不会将该 token 暴露给由 fork 控制的代码。
另见 `.github/workflows/claude-code-review.yml:5`、`.github/workflows/claude-code-review.yml:38`。Original comment in English
🟠 High · Fork reviews fail to start
When the pull request comes from a fork, gitHub withholds repository secrets from pull_request workflows triggered by fork PRs, leaving CLAUDE_CODE_OAUTH_TOKEN empty; the review action cannot authenticate, so fork PRs receive no automated review.
Run fork reviews through a trusted workflow that can access the OAuth token without exposing it to fork-controlled code.
Also at .github/workflows/claude-code-review.yml:5, .github/workflows/claude-code-review.yml:38.
Prompt for AI agents
In `.github/workflows/claude-code-review.yml` at line 4:
**Fork reviews fail to start**
When the pull request comes from a fork, gitHub withholds repository secrets from `pull_request` workflows triggered by fork PRs, leaving `CLAUDE_CODE_OAUTH_TOKEN` empty; the review action cannot authenticate, so fork PRs receive no automated review.
Run fork reviews through a trusted workflow that can access the OAuth token without exposing it to fork-controlled code.
Also at `.github/workflows/claude-code-review.yml:5`, `.github/workflows/claude-code-review.yml:38`.| pull-requests: read | ||
| issues: read |
There was a problem hiding this comment.
🟠 高 · Claude 回复永远不会出现
当 Claude 尝试发布 issue 回复或内联审查评论时，claude 工作流授予其 GitHub token 对 issue 和拉取请求的仅读权限，因此请求的评论写入操作会失败，用户看不到回复或内联评论。
为工作流授予 issue 和拉取请求所需的写入权限。
另见 .github/workflows/claude-code-review.yml:23-27。
面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 23-24 行：
**Claude 回复永远不会出现**
当 Claude 尝试发布 issue 回复或内联审查评论时，`claude` 工作流授予其 GitHub token 对 issue 和拉取请求的仅读权限，因此请求的评论写入操作会失败，用户看不到回复或内联评论。
为工作流授予 issue 和拉取请求所需的写入权限。
另见 `.github/workflows/claude-code-review.yml:23-27`。Original comment in English
🟠 High · Claude replies never appear
When claude tries to post an issue reply or inline review comment, the claude workflow gives its GitHub token only read access to issues and pull requests, so the requested comment writes fail and users see no replies or inline comments.
Grant the workflow the required write permissions for issues and pull requests.
Also at .github/workflows/claude-code-review.yml:23-27.
Prompt for AI agents
In `.github/workflows/claude.yml` at lines 23-24:
**Claude replies never appear**
When claude tries to post an issue reply or inline review comment, the `claude` workflow gives its GitHub token only read access to issues and pull requests, so the requested comment writes fail and users see no replies or inline comments.
Grant the workflow the required write permissions for issues and pull requests.
Also at `.github/workflows/claude-code-review.yml:23-27`.| uses: anthropics/claude-code-action@v1 | ||
| with: | ||
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | ||
|
|
There was a problem hiding this comment.
🟠 高 · API 密钥无法通过 OAuth 身份验证
当配置的 secret 包含 Anthropic API 密钥而不是 Claude Code OAuth token 时，action 会通过 claude_code_oauth_token 输入接收该 secret。因此，按照描述存储在其中的 Anthropic API 密钥并不是预期的 OAuth 凭据，Claude 身份验证会失败。
在该 secret 中存储 Claude Code OAuth token，或使用 API 密钥配置 action 的 API 密钥输入项。
另见 .github/workflows/claude-code-review.yml:38。
面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 38 行：
**API 密钥无法通过 OAuth 身份验证**
当配置的 secret 包含 Anthropic API 密钥而不是 Claude Code OAuth token 时，action 会通过 `claude_code_oauth_token` 输入接收该 secret。因此，按照描述存储在其中的 Anthropic API 密钥并不是预期的 OAuth 凭据，Claude 身份验证会失败。
在该 secret 中存储 Claude Code OAuth token，或使用 API 密钥配置 action 的 API 密钥输入项。
另见 `.github/workflows/claude-code-review.yml:38`。Original comment in English
🟠 High · API key fails OAuth authentication
When the configured secret contains an Anthropic API key rather than a Claude Code OAuth token, the action receives the secret through its claude_code_oauth_token input, so an Anthropic API key stored there as described is not the expected OAuth credential and Claude authentication fails.
Store a Claude Code OAuth token in that secret or configure the action’s API-key input with an API key.
Also at .github/workflows/claude-code-review.yml:38.
Prompt for AI agents
In `.github/workflows/claude.yml` at line 38:
**API key fails OAuth authentication**
When the configured secret contains an Anthropic API key rather than a Claude Code OAuth token, the action receives the secret through its `claude_code_oauth_token` input, so an Anthropic API key stored there as described is not the expected OAuth credential and Claude authentication fails.
Store a Claude Code OAuth token in that secret or configure the action’s API-key input with an API key.
Also at `.github/workflows/claude-code-review.yml:38`.| issues: | ||
| types: [opened, assigned] |
There was a problem hiding this comment.
🟡 中 · Issue 中的提及会触发重复运行
当包含 @claude 的 issue 在打开后被分配时，issues 订阅会分别针对 opened 和 assigned 启动一次运行，因此未发生变化的提及会再次启动运行，并可能产生重复回复或重复操作。
除非希望分配操作启动新运行，否则请从 issue 事件类型中移除 assigned。
面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 8-9 行：
**Issue 中的提及会触发重复运行**
当包含 `@claude` 的 issue 在打开后被分配时，`issues` 订阅会分别针对 `opened` 和 `assigned` 启动一次运行，因此未发生变化的提及会再次启动运行，并可能产生重复回复或重复操作。
除非希望分配操作启动新运行，否则请从 issue 事件类型中移除 `assigned`。Original comment in English
🟡 Medium · Issue mentions trigger duplicate runs
When an issue containing @claude is assigned after it is opened, the issues subscription starts a run for both opened and assigned, so the unchanged mention starts another run and can produce duplicate responses or repeated actions.
Remove assigned from the issue event types unless assignment is intended to start a new run.
Prompt for AI agents
In `.github/workflows/claude.yml` at lines 8-9:
**Issue mentions trigger duplicate runs**
When an issue containing `@claude` is assigned after it is opened, the `issues` subscription starts a run for both `opened` and `assigned`, so the unchanged mention starts another run and can produce duplicate responses or repeated actions.
Remove `assigned` from the issue event types unless assignment is intended to start a new run.| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read |
There was a problem hiding this comment.
🟠 高 · 无法推送代码变更
当请求要求 Claude 提交或推送代码变更时，Claude 编码 job 获得的 GitHub token 仅具有 contents: read 权限，因此无法向仓库推送分支或提交变更。代码编辑请求因此不会留下调用者可使用的变更。
如果需要写入仓库，请授予 job contents: write 权限；或者将工作流限制为不需要持久化代码变更的请求。
面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 22 行：
**无法推送代码变更**
当请求要求 Claude 提交或推送代码变更时，Claude 编码 job 获得的 GitHub token 仅具有 `contents: read` 权限，因此无法向仓库推送分支或提交变更。代码编辑请求因此不会留下调用者可使用的变更。
如果需要写入仓库，请授予 job `contents: write` 权限；或者将工作流限制为不需要持久化代码变更的请求。Original comment in English
🟠 High · Code changes cannot be pushed
When a request requires Claude to commit or push code changes, the Claude coding job receives a GitHub token with contents: read, so it cannot push a branch or commit changes to the repository. Code-editing requests therefore leave no changes for the caller to use.
Grant the job contents: write when repository writes are intended, or constrain the workflow to requests that do not require persisted code changes.
Prompt for AI agents
In `.github/workflows/claude.yml` at line 22:
**Code changes cannot be pushed**
When a request requires Claude to commit or push code changes, the Claude coding job receives a GitHub token with `contents: read`, so it cannot push a branch or commit changes to the repository. Code-editing requests therefore leave no changes for the caller to use.
Grant the job `contents: write` when repository writes are intended, or constrain the workflow to requests that do not require persisted code changes.1 participant
🤖 Installing Claude Code GitHub App
This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.
What is Claude Code?
Claude Code is an AI coding agent that can help with:
How it works
Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.
Important Notes
Security
There's more information in the Claude Code action repo.
After merging this PR, let's try mentioning @claude in a comment on any PR to get started!
Sourcery 摘要
添加 GitHub Actions 工作流，用于自动执行 Claude Code 拉取请求审查以及按需提供代码库协助。
新功能：
CI：
Original summary in English
Summary by Sourcery
Add GitHub Actions workflows for automated Claude Code pull request reviews and on-demand repository assistance.
New Features:
CI: