feat(skills): add pull request workflow skills #5219
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Claude Code | |
| # @claude runs only when a maintainer (OWNER/MEMBER/COLLABORATOR) explicitly mentions the | |
| # bot in an issue, an issue comment, a PR review, or a PR review comment. It deliberately | |
| # does NOT trigger on `pull_request_target`: | |
| # - Anthropic's OIDC exchange is broken for that event (401 "Invalid OIDC token"; | |
| # anthropics/claude-code-action#713), and | |
| # - a PR-body `@claude` check self-triggered it, because bot-authored PR descriptions | |
| # carry attribution text like "Generated by the @claude workflow". Attribution text | |
| # must never be interpreted as a command. | |
| # If automatic PR-open reviews are wanted later, add a dedicated workflow with a fixed | |
| # prompt rather than reading a PR body for `@claude`. | |
| # | |
| # Separate known limitation — CI does not auto-run on @claude-authored PRs. The bot pushes | |
| # its branch with GITHUB_TOKEN, GitHub does not fire `push` workflows for GITHUB_TOKEN | |
| # pushes, and test.yml is push-only, so a claude/** branch never runs the test suite and | |
| # the PR looks mergeable while unvalidated. The setup steps below let @claude self-verify | |
| # in-run (partial mitigation); still verify @claude PRs locally, or re-push the branch with | |
| # a human token to trigger test.yml, before merging. Proper fix: push with a PAT/App token | |
| # as the action's github_token. | |
| on: | |
| issue_comment: | |
| types: [created] | |
| pull_request_review_comment: | |
| types: [created] | |
| issues: | |
| types: [opened, assigned] | |
| pull_request_review: | |
| types: [submitted] | |
| env: | |
| FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true" | |
| jobs: | |
| claude: | |
| if: | | |
| ( | |
| (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || | |
| (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || | |
| (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) | |
| ) && ( | |
| github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR' || | |
| github.event.sender.author_association == 'OWNER' || | |
| github.event.sender.author_association == 'MEMBER' || | |
| github.event.sender.author_association == 'COLLABORATOR' | |
| ) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| # write access lets @claude push its working branch and open the PR; | |
| # with contents:read the push failed as github-actions[bot] (403) and the | |
| # run dead-ended after committing locally (see #1084). | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| id-token: write | |
| actions: read # Required for Claude to read CI results on PRs | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 1 | |
| # Provision the toolchain @claude needs to self-verify a change before pushing. | |
| # Without this the runner has no just/uv, so a run burns its whole time budget on | |
| # pip workarounds and can time out AFTER writing the code but BEFORE committing | |
| # (that is what happened on the first #1011 run). Mirrors test.yml's known-good setup. | |
| - name: Set up Python 3.12 | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| cache: "pip" | |
| - name: Install uv | |
| run: pip install uv | |
| - uses: extractions/setup-just@v4 | |
| - name: Create virtual env and install dependencies | |
| run: | | |
| uv venv | |
| uv pip install -e ".[dev]" | |
| - name: Run Claude Code | |
| id: claude | |
| uses: anthropics/claude-code-action@v1 | |
| with: | |
| claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| track_progress: true # Enable visual progress tracking | |
| # This is an optional setting that allows Claude to read CI results on PRs | |
| additional_permissions: | | |
| actions: read | |
| # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it. | |
| # prompt: 'Update the pull request description to include a summary of changes.' | |
| # Allow the interpreters @claude needs to self-verify a change before | |
| # opening the PR. The default Bash allowlist already covers git/gh and | |
| # file edits (that part worked in #1084); it only blocked test runners, | |
| # so this list is additive and scoped to project quality gates. | |
| claude_args: '--allowed-tools "Bash(just:*),Bash(uv:*),Bash(uvx:*),Bash(pytest:*),Bash(ruff:*),Bash(python:*),Bash(python3:*)"' | |
| # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md | |
| # or https://docs.claude.com/en/docs/claude-code/sdk#command-line for available options |