Add Claude Code GitHub Workflow by GilbN · Pull Request #3 · GilbN/nsf-timer

GilbN · 2026-04-09T17:11:18Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

vercel · 2026-04-09T17:11:39Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
opk-timer	Ready	Preview, Comment	Apr 9, 2026 5:11pm

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate the Claude Code GitHub App into the repo, enabling automated agent execution from mentions and automated PR reviews.

Changes:

Add a workflow that runs Claude Code when @claude is mentioned in issues, issue comments, PR review comments, or PR reviews.
Add a workflow that runs an automated Claude-based code review on PR events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
`.github/workflows/claude.yml`	New “mention-driven” Claude workflow for issues/comments/reviews.
`.github/workflows/claude-code-review.yml`	New PR-triggered workflow to run the Claude code review plugin.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-09T17:13:36Z

+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]


Security: this workflow can be triggered by anyone who can open an issue or comment (including external users) by including @claude, but it passes the CLAUDE_CODE_OAUTH_TOKEN secret to the action. This creates a risk of secret exposure / unauthorized agent runs. Add an explicit authorization gate (e.g., check github.event.sender/author_association and/or query collaborator permission) and/or remove the issues trigger so only trusted actors can trigger it; this also aligns with the PR description claim that only write-access users can trigger.

@copilot apply changes based on this feedback

Copilot · 2026-04-09T17:13:37Z

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The job-level if: only checks for the @claude substring and does not verify the commenter/issue author has write permissions. Please add a permissions/role check (or a separate pre-step that validates github.event.sender has at least write access) before running the action so untrusted users can't trigger it.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) ||

(github.event_name == 'issues' &&

(contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&

contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association))

@claude you clanker, fix this

Claude finished @GilbN's task in 27s —— View job

Fixing claude.yml permission check

Gather context

Understand the request

Execute changes

Unfortunately, I'm unable to modify files in the .github/workflows/ directory — the GitHub App permissions do not allow workflow file modifications. You can find more information in the FAQ.

Here's the fix you need to apply manually to .github/workflows/claude.yml. Replace the if: block (lines 15–19) with:

if: | (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) || (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association))

This adds author_association checks so that only OWNER, MEMBER, or COLLABORATOR users can trigger Claude — preventing untrusted external users from running the agent.

Copilot · 2026-04-09T17:13:37Z

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This workflow will run on pull_request events for forked PRs too, but secrets (like CLAUDE_CODE_OAUTH_TOKEN) are not provided to forked workflows; the action is likely to fail and create noisy red checks. Consider gating the job/step (e.g., if: github.event.pull_request.head.repo.fork == false or checking that the token is present) so it only runs when it can authenticate.

@copilot apply changes based on this feedback

GilbN added 2 commits April 9, 2026 19:10

"Claude PR Assistant workflow"

db262d9

"Claude Code Review workflow"

230749e

Copilot AI review requested due to automatic review settings April 9, 2026 17:11

vercel Bot deployed to Preview April 9, 2026 17:11 View deployment

GilbN merged commit 54551c2 into main Apr 9, 2026
5 checks passed

Copilot started reviewing on behalf of GilbN April 9, 2026 17:11 View session

Copilot AI reviewed Apr 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Claude Code GitHub Workflow#3

Add Claude Code GitHub Workflow#3
GilbN merged 2 commits into
mainfrom
add-claude-github-actions-1775754608603

GilbN commented Apr 9, 2026

Uh oh!

vercel Bot commented Apr 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

GilbN Apr 9, 2026

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

GilbN Apr 9, 2026

Uh oh!

claude Bot Apr 9, 2026 •

edited

Loading

Uh oh!

Copilot AI Apr 9, 2026

Uh oh!

GilbN Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

GilbN commented Apr 9, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

vercel Bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

GilbN Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

GilbN Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

claude Bot Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Fixing claude.yml permission check

Uh oh!

Copilot AI Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

GilbN Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Apr 9, 2026 •

edited

Loading

claude Bot Apr 9, 2026 •

edited

Loading

Fixing `claude.yml` permission check