Add Claude Code GitHub Workflow by hathach · Pull Request #3523 · hathach/tinyusb

hathach · 2026-03-04T11:08:46Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8479c08679

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-04T11:10:34Z

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


Restrict Claude invocation to trusted users

In repositories where non-members can open issues or comments, this condition only checks for @claude and does not verify actor trust (author_association/write access), so any external user can trigger paid Claude runs by posting a mention. Add an explicit permission gate (for example OWNER/MEMBER/COLLABORATOR) before calling the action to prevent untrusted triggering.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-04T11:10:34Z

+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}


Guard review workflow when OAuth secret is absent

This job unconditionally uses secrets.CLAUDE_CODE_OAUTH_TOKEN on pull_request events, but fork-origin PR runs do not receive repository secrets, so external-contributor PRs will fail on open/synchronize/reopen due to a missing token. Add a same-repo PR guard (or redesign with a safe pull_request_target flow) so fork PRs don't produce persistent failing checks.

Useful? React with 👍 / 👎.

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate the Anthropic “Claude Code” agent into the repo, enabling automated responses to @claude mentions and an optional automated PR code review run.

Changes:

Added a Claude Code workflow that triggers on issue/PR comment/review events when @claude is present.
Added a Claude Code Review workflow that runs a code-review plugin automatically on PR events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/claude.yml	New workflow to run Claude Code based on `@claude` mentions in issues/comments/reviews.
.github/workflows/claude-code-review.yml	New workflow to run Claude Code Review plugin automatically on PR lifecycle events.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-04T11:12:02Z

+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write


The workflow permissions are read-only for pull-requests and issues. If the intent is for Claude to reply with comments / reviews (as described in the PR), it will likely be blocked by token permissions. Either adjust the workflow permissions to allow the intended write operations (principle of least privilege, e.g. issues/pull-requests write only if needed) or update the PR description to match a read-only integration.

Copilot · 2026-03-04T11:12:03Z

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This workflow runs on pull_request events. For PRs from forks, secrets.CLAUDE_CODE_OAUTH_TOKEN will not be provided, so the job will still start and then fail inside the action (noisy CI). Add a job-level guard to skip forked PRs (e.g. check github.event.pull_request.head.repo.fork == false) or otherwise short-circuit when the secret is missing.

Copilot · 2026-03-04T11:12:03Z

+      pull-requests: read
+      issues: read
+      id-token: write


pull-requests and issues permissions are set to read. If the code-review plugin is expected to leave review comments or PR feedback, it will likely need pull-requests: write (and possibly issues: write for issue comments). Please confirm the required permissions for anthropics/claude-code-action in this mode and tighten to the minimum set that still allows it to post results.

Suggested change

pull-requests: read

issues: read

id-token: write

pull-requests: write

Copilot · 2026-03-04T11:12:03Z

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The job can be triggered by any issue/PR commenter who types "@claude". Because this workflow uses a repository secret (CLAUDE_CODE_OAUTH_TOKEN) and requests an OIDC token (id-token: write), an untrusted external user could trigger the job and potentially prompt the agent to exfiltrate secrets. Add an explicit trust gate (e.g., allow only OWNER/MEMBER/COLLABORATOR author_association, or restrict to specific usernames/teams) before running the Claude step, and consider removing the issues trigger if you only want comment-driven runs.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(

github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

contains('OWNER,MEMBER,COLLABORATOR', github.event.comment.author_association)

) ||

(

github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

contains('OWNER,MEMBER,COLLABORATOR', github.event.comment.author_association)

) ||

(

github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

contains('OWNER,MEMBER,COLLABORATOR', github.event.review.author_association)

) ||

(

github.event_name == 'issues' &&

(

contains(github.event.issue.body, '@claude') ||

contains(github.event.issue.title, '@claude')

) &&

contains('OWNER,MEMBER,COLLABORATOR', github.event.issue.author_association)

)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hathach added 2 commits March 4, 2026 18:08

"Claude PR Assistant workflow"

80a05cf

"Claude Code Review workflow"

8479c08

Copilot AI review requested due to automatic review settings March 4, 2026 11:08

github-actions Bot added the Prio Urgent label Mar 4, 2026

Copilot started reviewing on behalf of hathach March 4, 2026 11:09 View session

chatgpt-codex-connector Bot reviewed Mar 4, 2026

View reviewed changes

Copilot AI reviewed Mar 4, 2026

View reviewed changes

fix trailing newline in workflow files to pass pre-commit

f021d5c

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

hathach merged commit 6aeb3df into master Mar 5, 2026
276 checks passed

hathach deleted the add-claude-github-actions-1772622485004 branch March 5, 2026 03:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Add Claude Code GitHub Workflow#3523

Add Claude Code GitHub Workflow#3523
hathach merged 3 commits into
masterfrom
add-claude-github-actions-1772622485004

hathach commented Mar 4, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Mar 4, 2026

Uh oh!

chatgpt-codex-connector Bot Mar 4, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Copilot AI Mar 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

hathach commented Mar 4, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants