Add Claude Code GitHub Workflow

[grahambrooks]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[Copilot]

Pull request overview

Adds GitHub Actions workflows to integrate the Claude Code GitHub App into this repository, enabling Claude-driven automation via triggers on repository activity.

Changes:

• Introduces a mention-driven workflow (claude.yml) that runs when @claude appears in issue/PR comment/review contexts.
• Introduces an automatic PR review workflow (claude-code-review.yml) that runs Claude Code Review on PR lifecycle events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/claude.yml	Adds an @claude mention-triggered workflow to run anthropics/claude-code-action.
.github/workflows/claude-code-review.yml	Adds an always-on PR workflow to run the Claude code-review plugin on PR events.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The workflow can be triggered by any commenter who can create an issue/PR comment. Since this job uses a repository secret, you should gate execution to trusted actors (e.g., OWNER/MEMBER/COLLABORATOR) by checking author_association (comment/review/issue) or otherwise verifying the actor has write access before running the action.

Suggested change

	(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
	(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
	(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
	(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
	(github.event_name == 'issue_comment' &&
	contains(github.event.comment.body, '@claude') &&
	contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
	(github.event_name == 'pull_request_review_comment' &&
	contains(github.event.comment.body, '@claude') &&
	contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) ||
	(github.event_name == 'pull_request_review' &&
	contains(github.event.review.body, '@claude') &&
	contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) ||
	(github.event_name == 'issues' &&
	(contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
	contains(fromJson('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association))

[Copilot]

contains(github.event.review.body, ...) / contains(github.event.issue.body, ...) can error if the body field is null/empty for certain event payloads (e.g., approval reviews without text, issues without a body). Consider coalescing these to an empty string before calling contains so the job condition evaluates to false instead of failing the workflow run.

Suggested change

	(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
	(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
	(github.event_name == 'pull_request_review' && contains(github.event.review.body || '', '@claude')) ||
	(github.event_name == 'issues' && (contains(github.event.issue.body || '', '@claude') || contains(github.event.issue.title, '@claude')))

[Copilot]

The PR description says Claude runs when someone mentions @claude in an issue/PR comment, but this workflow runs automatically on every PR open/sync/reopen. Either update the PR description to reflect the always-on review workflow, or add a job/workflow condition to only run when explicitly requested (or scope it to specific authors/paths).

[Copilot]

Because this workflow is triggered on pull_request, it will also run on PRs from forks, where secrets.CLAUDE_CODE_OAUTH_TOKEN is not available. That typically causes the job to fail and can block community contributions. Consider skipping the job for forked PRs (or otherwise handling missing secrets gracefully) to avoid failing checks on external PRs.