Add Claude Code GitHub Workflow

[akshayutture-augment]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[claude]

Code Review: Claude Code GitHub Workflow Integration

Thank you for adding Claude Code integration to this repository! I've reviewed the proposed workflows and have the following feedback:

✅ Strengths

1. Clear Documentation: The PR description provides excellent context about what Claude Code is and how it works
2. Security-First Approach: API key is properly stored as a GitHub secret
3. Appropriate Permissions: Both workflows use minimal required permissions (read-only for most resources)
4. Flexible Configuration: Good use of commented-out examples for optional filters

🔍 Code Quality & Best Practices

.github/workflows/claude-code-review.yml

Issues:

1. Missing write Permission: The workflow needs pull-requests: write permission to post review comments. Currently, it only has pull-requests: read, which will cause the gh pr comment command to fail.

   Recommended fix:

   permissions:
     contents: read
     pull-requests: write  # Changed from 'read' to 'write'
     issues: read
     id-token: write

2. Limited Tool Access: The allowed-tools configuration only permits gh commands. For a Discourse project (Ruby on Rails + Ember.js), Claude may need additional tools to properly review code:

   • Linting tools (rubocop, eslint, prettier)
   • Test runners (rspec, qunit)
   • Build tools (bundle, pnpm)

3. Prompt Enhancement: The review prompt should reference the project's specific guidelines from CLAUDE.md and AI-AGENTS.md

4. Resource Optimization: Consider adding concurrency controls like other workflows in this repo

.github/workflows/claude.yml

Issues:

1. Missing write Permissions: This workflow also needs write permissions to function properly:

   permissions:
     contents: write        # To create branches/commits
     pull-requests: write   # To comment on PRs
     issues: write          # To comment on issues
     id-token: write
     actions: read

2. No Tool Restrictions: The commented-out claude_args shows no tool restrictions. For security, consider explicitly allowing only necessary tools rather than relying on defaults.

🔒 Security Concerns

1. Workflow Trigger Security:

   • The claude-code-review.yml runs on ALL PRs without filtering. This could consume API quota on spam/bot PRs.
   • Consider uncommenting the author filter to limit to specific users or first-time contributors.

2. Secret Management:

   • Ensure ANTHROPIC_API_KEY secret is set at repository level before merging
   • Consider documenting who has access to manage this secret

3. Tool Access Scope:

   • The interactive workflow (claude.yml) has broader capabilities than the review workflow
   • Document that users with write access can invoke Claude with any prompt
   • Consider rate limiting or monitoring usage

⚡ Performance Considerations

1. Checkout Depth: Both workflows use fetch-depth: 1, which is good for performance
2. Workflow Redundancy: Both workflows will run on PRs if Claude is mentioned AND the PR is opened/synchronized. This could be wasteful.
3. Resource Costs: Claude API calls can be expensive on large PRs. Consider adding file size/count limits.

🧪 Test Coverage

Missing:

• No way to test these workflows before merging
• Recommendation: Test on a draft PR first after merging

📝 Additional Recommendations

1. Documentation: Create .github/CLAUDE_USAGE.md documenting usage, commands, and troubleshooting
2. Monitoring: After deployment, monitor GitHub Actions usage/costs and Anthropic API usage
3. Discourse-Specific Context: The prompts should emphasize Discourse's architecture:
   • Ruby on Rails backend with Guardian authorization
   • Ember.js frontend with Glimmer components
   • FormKit for forms
   • Site settings configuration
   • Service objects pattern

🎯 Required Changes Before Merge

1. ✅ Fix permissions in both workflows (pull-requests: write, issues: write, contents: write where needed)
2. ✅ Verify ANTHROPIC_API_KEY secret is configured
3. ⚠️ Consider tool access scope for security

💡 Suggested Improvements (Optional)

1. Add concurrency controls
2. Expand allowed tools for better code review capabilities
3. Enhance prompts with Discourse-specific context
4. Add author/path filters to reduce unnecessary runs
5. Create usage documentation

---

Overall, this is a valuable addition to the repository! The main blockers are the permission issues. Once those are fixed, I'd recommend a gradual rollout (perhaps testing on a few PRs first) before enabling for all PRs.

Status: ⚠️ Changes Requested - Please fix the permission issues before merging.