Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions .github/workflows/claude-code-review.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
name: Claude Code Review

on:
pull_request:

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · 来自 fork 的审查无法启动

当拉取请求来自 fork 时,GitHub 会阻止由 fork PR 触发的 pull_request 工作流访问仓库机密,导致 CLAUDE_CODE_OAUTH_TOKEN 为空;审查 action 无法进行身份验证,因此 fork PR 不会收到自动审查。

通过可信工作流运行 fork 审查,使其能够访问 OAuth token,同时不会将该 token 暴露给由 fork 控制的代码。

另见 .github/workflows/claude-code-review.yml:5、.github/workflows/claude-code-review.yml:38。

面向 AI Agent 的提示词
在 `.github/workflows/claude-code-review.yml` 第 4 行:

**来自 fork 的审查无法启动**

当拉取请求来自 fork 时,GitHub 会阻止由 fork PR 触发的 `pull_request` 工作流访问仓库机密,导致 `CLAUDE_CODE_OAUTH_TOKEN` 为空;审查 action 无法进行身份验证,因此 fork PR 不会收到自动审查。

通过可信工作流运行 fork 审查,使其能够访问 OAuth token,同时不会将该 token 暴露给由 fork 控制的代码。

另见 `.github/workflows/claude-code-review.yml:5`、`.github/workflows/claude-code-review.yml:38`。
Original comment in English

🟠 High · Fork reviews fail to start

When the pull request comes from a fork, gitHub withholds repository secrets from pull_request workflows triggered by fork PRs, leaving CLAUDE_CODE_OAUTH_TOKEN empty; the review action cannot authenticate, so fork PRs receive no automated review.

Run fork reviews through a trusted workflow that can access the OAuth token without exposing it to fork-controlled code.

Also at .github/workflows/claude-code-review.yml:5, .github/workflows/claude-code-review.yml:38.

Prompt for AI agents
In `.github/workflows/claude-code-review.yml` at line 4:

**Fork reviews fail to start**

When the pull request comes from a fork, gitHub withholds repository secrets from `pull_request` workflows triggered by fork PRs, leaving `CLAUDE_CODE_OAUTH_TOKEN` empty; the review action cannot authenticate, so fork PRs receive no automated review.

Run fork reviews through a trusted workflow that can access the OAuth token without exposing it to fork-controlled code.

Also at `.github/workflows/claude-code-review.yml:5`, `.github/workflows/claude-code-review.yml:38`.

types: [opened, synchronize, ready_for_review, reopened]
# Optional: Only run on specific file changes
# paths:
# - "src/**/*.ts"
# - "src/**/*.tsx"
# - "src/**/*.js"
# - "src/**/*.jsx"

jobs:
claude-review:
# Optional: Filter by PR author
# if: |
# github.event.pull_request.user.login == 'external-contributor' ||
# github.event.pull_request.user.login == 'new-developer' ||
# github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'

runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · 审查评论永远不会出现

当 Claude 尝试发布审查评论或回复时,claude-code-review 工作流授予其 GitHub token 对拉取请求和 issue 的仅读权限,因此请求的评论和回复写入操作会失败,用户看不到发布结果。

为审查工作流授予拉取请求和 issue 所需的写入权限。

另见 .github/workflows/claude.yml:23-25。

面向 AI Agent 的提示词
在 `.github/workflows/claude-code-review.yml` 第 24 行:

**审查评论永远不会出现**

当 Claude 尝试发布审查评论或回复时,`claude-code-review` 工作流授予其 GitHub token 对拉取请求和 issue 的仅读权限,因此请求的评论和回复写入操作会失败,用户看不到发布结果。

为审查工作流授予拉取请求和 issue 所需的写入权限。

另见 `.github/workflows/claude.yml:23-25`。
Original comment in English

🟠 High · Review comments never appear

When claude attempts to publish a review comment or reply, the claude-code-review workflow gives its GitHub token only read access to pull requests and issues, so the requested comment and reply writes fail and users see no posted result.

Grant the review workflow the required write permissions for pull requests and issues.

Also at .github/workflows/claude.yml:23-25.

Prompt for AI agents
In `.github/workflows/claude-code-review.yml` at line 24:

**Review comments never appear**

When claude attempts to publish a review comment or reply, the `claude-code-review` workflow gives its GitHub token only read access to pull requests and issues, so the requested comment and reply writes fail and users see no posted result.

Grant the review workflow the required write permissions for pull requests and issues.

Also at `.github/workflows/claude.yml:23-25`.

issues: read
id-token: write

steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 1

- name: Run Claude Code Review
id: claude-review
uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
prompt: '/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
claude_args: '--allowedTools "mcp__github_inline_comment__create_inline_comment"'
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options

50 changes: 50 additions & 0 deletions .github/workflows/claude.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,50 @@
name: Claude Code

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened, assigned]
Comment on lines +8 to +9

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 中 · Issue 中的提及会触发重复运行

当包含 @claude 的 issue 在打开后被分配时,issues 订阅会分别针对 opened 和 assigned 启动一次运行,因此未发生变化的提及会再次启动运行,并可能产生重复回复或重复操作。

除非希望分配操作启动新运行,否则请从 issue 事件类型中移除 assigned。

面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 8-9 行:

**Issue 中的提及会触发重复运行**

当包含 `@claude` 的 issue 在打开后被分配时,`issues` 订阅会分别针对 `opened` 和 `assigned` 启动一次运行,因此未发生变化的提及会再次启动运行,并可能产生重复回复或重复操作。

除非希望分配操作启动新运行,否则请从 issue 事件类型中移除 `assigned`。
Original comment in English

🟡 Medium · Issue mentions trigger duplicate runs

When an issue containing @claude is assigned after it is opened, the issues subscription starts a run for both opened and assigned, so the unchanged mention starts another run and can produce duplicate responses or repeated actions.

Remove assigned from the issue event types unless assignment is intended to start a new run.

Prompt for AI agents
In `.github/workflows/claude.yml` at lines 8-9:

**Issue mentions trigger duplicate runs**

When an issue containing `@claude` is assigned after it is opened, the `issues` subscription starts a run for both `opened` and `assigned`, so the unchanged mention starts another run and can produce duplicate responses or repeated actions.

Remove `assigned` from the issue event types unless assignment is intended to start a new run.

pull_request_review:
types: [submitted]

jobs:
claude:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · 未经授权的用户可以启动 Claude 运行

当没有仓库写入权限的用户在 issue、拉取请求评论、审查评论或新 issue 中提及 @claude 时,claude job 的条件只检查是否包含该提及,却没有检查发送者的权限。因此,外部用户可以使用 CLAUDE_CODE_OAUTH_TOKEN 启动一次运行,并提交 Agent 请求,消耗仓库的 Claude 使用量。

在启动 job 之前,要求事件发送者具有仓库写入权限。

另见 .github/workflows/claude.yml:19。

面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 16 行:

**未经授权的用户可以启动 Claude 运行**

当没有仓库写入权限的用户在 issue、拉取请求评论、审查评论或新 issue 中提及 `@claude` 时,`claude` job 的条件只检查是否包含该提及,却没有检查发送者的权限。因此,外部用户可以使用 `CLAUDE_CODE_OAUTH_TOKEN` 启动一次运行,并提交 Agent 请求,消耗仓库的 Claude 使用量。

在启动 job 之前,要求事件发送者具有仓库写入权限。

另见 `.github/workflows/claude.yml:19`。
Original comment in English

🟠 High · Unauthorized users start Claude runs

When a user without repository write access mentions @claude in an issue or pull request comment, review, or new issue, the claude job condition checks for the mention but not the sender’s permissions, so an outsider starts a run with CLAUDE_CODE_OAUTH_TOKEN and can submit agent requests that consume the repository’s Claude usage.

Require the event’s sender to have repository write access before starting the job.

Also at .github/workflows/claude.yml:19.

Prompt for AI agents
In `.github/workflows/claude.yml` at line 16:

**Unauthorized users start Claude runs**

When a user without repository write access mentions `@claude` in an issue or pull request comment, review, or new issue, the `claude` job condition checks for the mention but not the sender’s permissions, so an outsider starts a run with `CLAUDE_CODE_OAUTH_TOKEN` and can submit agent requests that consume the repository’s Claude usage.

Require the event’s sender to have repository write access before starting the job.

Also at `.github/workflows/claude.yml:19`.

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
permissions:
contents: read

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · 无法推送代码变更

当请求要求 Claude 提交或推送代码变更时,Claude 编码 job 获得的 GitHub token 仅具有 contents: read 权限,因此无法向仓库推送分支或提交变更。代码编辑请求因此不会留下调用者可使用的变更。

如果需要写入仓库,请授予 job contents: write 权限;或者将工作流限制为不需要持久化代码变更的请求。

面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 22 行:

**无法推送代码变更**

当请求要求 Claude 提交或推送代码变更时,Claude 编码 job 获得的 GitHub token 仅具有 `contents: read` 权限,因此无法向仓库推送分支或提交变更。代码编辑请求因此不会留下调用者可使用的变更。

如果需要写入仓库,请授予 job `contents: write` 权限;或者将工作流限制为不需要持久化代码变更的请求。
Original comment in English

🟠 High · Code changes cannot be pushed

When a request requires Claude to commit or push code changes, the Claude coding job receives a GitHub token with contents: read, so it cannot push a branch or commit changes to the repository. Code-editing requests therefore leave no changes for the caller to use.

Grant the job contents: write when repository writes are intended, or constrain the workflow to requests that do not require persisted code changes.

Prompt for AI agents
In `.github/workflows/claude.yml` at line 22:

**Code changes cannot be pushed**

When a request requires Claude to commit or push code changes, the Claude coding job receives a GitHub token with `contents: read`, so it cannot push a branch or commit changes to the repository. Code-editing requests therefore leave no changes for the caller to use.

Grant the job `contents: write` when repository writes are intended, or constrain the workflow to requests that do not require persisted code changes.

pull-requests: read
issues: read
Comment on lines +23 to +24

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · Claude 回复永远不会出现

当 Claude 尝试发布 issue 回复或内联审查评论时,claude 工作流授予其 GitHub token 对 issue 和拉取请求的仅读权限,因此请求的评论写入操作会失败,用户看不到回复或内联评论。

为工作流授予 issue 和拉取请求所需的写入权限。

另见 .github/workflows/claude-code-review.yml:23-27。

面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 23-24 行:

**Claude 回复永远不会出现**

当 Claude 尝试发布 issue 回复或内联审查评论时,`claude` 工作流授予其 GitHub token 对 issue 和拉取请求的仅读权限,因此请求的评论写入操作会失败,用户看不到回复或内联评论。

为工作流授予 issue 和拉取请求所需的写入权限。

另见 `.github/workflows/claude-code-review.yml:23-27`。
Original comment in English

🟠 High · Claude replies never appear

When claude tries to post an issue reply or inline review comment, the claude workflow gives its GitHub token only read access to issues and pull requests, so the requested comment writes fail and users see no replies or inline comments.

Grant the workflow the required write permissions for issues and pull requests.

Also at .github/workflows/claude-code-review.yml:23-27.

Prompt for AI agents
In `.github/workflows/claude.yml` at lines 23-24:

**Claude replies never appear**

When claude tries to post an issue reply or inline review comment, the `claude` workflow gives its GitHub token only read access to issues and pull requests, so the requested comment writes fail and users see no replies or inline comments.

Grant the workflow the required write permissions for issues and pull requests.

Also at `.github/workflows/claude-code-review.yml:23-27`.

id-token: write
actions: read # Required for Claude to read CI results on PRs
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 1

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@v1

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · Claude 拥有不受限制的 shell 访问权限

当 Claude 处理要求其运行 shell 命令的提示词时,Claude Code 的默认工具包括 Bash,而此工作流没有对这些工具进行限制。因此,提示词可以在运行器上执行任意命令,这违背了仅限仓库操作的既定限制,并可能暴露 job 可用的凭据。

为此工作流配置严格的工具允许列表,并避免向 Claude 可以运行的子进程暴露凭据。

另见 .github/workflows/claude.yml:49。

面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 35 行:

**Claude 拥有不受限制的 shell 访问权限**

当 Claude 处理要求其运行 shell 命令的提示词时,Claude Code 的默认工具包括 `Bash`,而此工作流没有对这些工具进行限制。因此,提示词可以在运行器上执行任意命令,这违背了仅限仓库操作的既定限制,并可能暴露 job 可用的凭据。

为此工作流配置严格的工具允许列表,并避免向 Claude 可以运行的子进程暴露凭据。

另见 `.github/workflows/claude.yml:49`。
Original comment in English

🟠 High · Claude has unrestricted shell access

When claude processes a prompt that asks it to run shell commands, claude Code’s default tools include Bash, and this workflow does not restrict them; a prompt can therefore run arbitrary commands on the runner, contrary to the stated limitation to repository operations, and expose credentials available to the job.

Configure a restrictive tool allowlist for this workflow and avoid exposing credentials to subprocesses Claude can run.

Also at .github/workflows/claude.yml:49.

Prompt for AI agents
In `.github/workflows/claude.yml` at line 35:

**Claude has unrestricted shell access**

When claude processes a prompt that asks it to run shell commands, claude Code’s default tools include `Bash`, and this workflow does not restrict them; a prompt can therefore run arbitrary commands on the runner, contrary to the stated limitation to repository operations, and expose credentials available to the job.

Configure a restrictive tool allowlist for this workflow and avoid exposing credentials to subprocesses Claude can run.

Also at `.github/workflows/claude.yml:49`.

with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 高 · API 密钥无法通过 OAuth 身份验证

当配置的 secret 包含 Anthropic API 密钥而不是 Claude Code OAuth token 时,action 会通过 claude_code_oauth_token 输入接收该 secret。因此,按照描述存储在其中的 Anthropic API 密钥并不是预期的 OAuth 凭据,Claude 身份验证会失败。

在该 secret 中存储 Claude Code OAuth token,或使用 API 密钥配置 action 的 API 密钥输入项。

另见 .github/workflows/claude-code-review.yml:38。

面向 AI Agent 的提示词
在 `.github/workflows/claude.yml` 第 38 行:

**API 密钥无法通过 OAuth 身份验证**

当配置的 secret 包含 Anthropic API 密钥而不是 Claude Code OAuth token 时,action 会通过 `claude_code_oauth_token` 输入接收该 secret。因此,按照描述存储在其中的 Anthropic API 密钥并不是预期的 OAuth 凭据,Claude 身份验证会失败。

在该 secret 中存储 Claude Code OAuth token,或使用 API 密钥配置 action 的 API 密钥输入项。

另见 `.github/workflows/claude-code-review.yml:38`。
Original comment in English

🟠 High · API key fails OAuth authentication

When the configured secret contains an Anthropic API key rather than a Claude Code OAuth token, the action receives the secret through its claude_code_oauth_token input, so an Anthropic API key stored there as described is not the expected OAuth credential and Claude authentication fails.

Store a Claude Code OAuth token in that secret or configure the action’s API-key input with an API key.

Also at .github/workflows/claude-code-review.yml:38.

Prompt for AI agents
In `.github/workflows/claude.yml` at line 38:

**API key fails OAuth authentication**

When the configured secret contains an Anthropic API key rather than a Claude Code OAuth token, the action receives the secret through its `claude_code_oauth_token` input, so an Anthropic API key stored there as described is not the expected OAuth credential and Claude authentication fails.

Store a Claude Code OAuth token in that secret or configure the action’s API-key input with an API key.

Also at `.github/workflows/claude-code-review.yml:38`.

# This is an optional setting that allows Claude to read CI results on PRs
additional_permissions: |
actions: read
# Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
# prompt: 'Update the pull request description to include a summary of changes.'

# Optional: Add claude_args to customize behavior and configuration
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options
# claude_args: '--allowed-tools Bash(gh pr *)'

Loading