Skip to content

Use reusable Claude Code workflow from test-infra #18525

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
JacobSzwejbka merged 1 commit into from
Mar 26, 2026
Merged

Use reusable Claude Code workflow from test-infra #18525

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 7 additions & 55 deletions .github/workflows/claude-code.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,68 +3,20 @@ name: Claude Code
on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened]

jobs:
claude-code:
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The previous job set environment: bedrock. That environment context is now removed in the caller. If that environment was relied on for protection rules (required reviewers) or for environment-scoped secrets/vars used by the Claude/BEDROCK setup, this change could either break the workflow or weaken the intended access controls.

If the reusable workflow supports specifying an environment, consider passing/setting it explicitly (or document why it’s no longer needed).

Suggested change
claude-code:
claude-code:
environment: bedrock

Copilot uses AI. Check for mistakes.
# Early exit conditions (fast gate — avoids spinning up a runner for unauthorized users):
# 1. Must be pytorch org
# 2. Must mention @claude
# 3. Must be org member/collaborator OR an allowed bot
# Note: issue_comment and pull_request_review_comment share the same payload paths
if: |
github.repository_owner == 'pytorch' &&
(
(github.event_name != 'issues' &&
contains(github.event.comment.body, '@claude') &&
contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
(github.event_name == 'issues' &&
contains(github.event.issue.body, '@claude') &&
contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association))
)
runs-on: ubuntu-latest
timeout-minutes: 60
environment: bedrock
uses: pytorch/test-infra/.github/workflows/_claude-code.yml@main
with:
setup_script: |
pip install lintrunner==0.12.7 lintrunner-adapters==0.13.0
pip install -r requirements-lintrunner.txt
lintrunner init
Comment on lines 10 to +16
Copy link

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The previous workflow had a caller-side job if: gate (repo owner, @claude mention, and author_association) to avoid running for every new issue/issue_comment and to prevent unauthorized users from triggering a secrets-enabled job. With the reusable workflow call, that gate is gone, so this workflow will trigger on all issues: opened and issue_comment: created events unless the reusable workflow reintroduces an equivalent top-level guard.

Consider adding back a job-level if: in this caller (even if the reusable workflow also checks) to preserve the fast exit behavior and reduce both cost/noise and the blast radius if the called workflow’s checks ever regress.

Copilot uses AI. Check for mistakes.
permissions:
contents: read
pull-requests: write
issues: write
id-token: write
steps:
# Fork PR support enabled by using izaitsevfb/claude-code-action@forked-pr-fix

- uses: actions/checkout@v4
with:
fetch-depth: 1

- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'

- name: Install lintrunner
run: |
pip install lintrunner==0.12.5
lintrunner init

- name: Configure AWS credentials via OIDC
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_claude_code
aws-region: us-east-1

- name: Run Claude Code
uses: izaitsevfb/claude-code-action@forked-pr-fix
with:
# We filter by github.actor at workflow level, there is no point of filtering here as well
allowed_bots: "*"
claude_args: "--model global.anthropic.claude-opus-4-6-v1"
settings: '{"alwaysThinkingEnabled": true}'
use_bedrock: "true"

- name: Upload usage metrics
if: always()
uses: pytorch/test-infra/.github/actions/upload-claude-usage@main
secrets: inherit
Loading