mirror of
https://github.com/markwylde/claude-code-gitea-action.git
synced 2026-01-29 11:23:31 +08:00
Merge branch 'main' into gitea
This commit is contained in:
Mark Wylde
89
.github/workflows/test-custom-executables.yml
vendored
Normal file
89
.github/workflows/test-custom-executables.yml
vendored
Normal file
@@ -0,0 +1,89 @@
|
||||
name: Test Custom Executables
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
pull_request:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
test-custom-executables:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
||||
|
||||
- name: Install Bun manually
|
||||
run: |
|
||||
echo "Installing Bun..."
|
||||
curl -fsSL https://bun.sh/install | bash
|
||||
echo "Bun installed at: $HOME/.bun/bin/bun"
|
||||
|
||||
# Verify Bun installation
|
||||
if [ -f "$HOME/.bun/bin/bun" ]; then
|
||||
echo "✅ Bun executable found"
|
||||
$HOME/.bun/bin/bun --version
|
||||
else
|
||||
echo "❌ Bun executable not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Install Claude Code manually
|
||||
run: |
|
||||
echo "Installing Claude Code..."
|
||||
curl -fsSL https://claude.ai/install.sh | bash -s latest
|
||||
echo "Claude Code installed at: $HOME/.local/bin/claude"
|
||||
|
||||
# Verify Claude installation
|
||||
if [ -f "$HOME/.local/bin/claude" ]; then
|
||||
echo "✅ Claude executable found"
|
||||
ls -la "$HOME/.local/bin/claude"
|
||||
else
|
||||
echo "❌ Claude executable not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Test with both custom executables
|
||||
id: custom-test
|
||||
uses: ./base-action
|
||||
with:
|
||||
prompt: |
|
||||
List the files in the current directory starting with "package"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
path_to_claude_code_executable: /home/runner/.local/bin/claude
|
||||
path_to_bun_executable: /home/runner/.bun/bin/bun
|
||||
allowed_tools: "LS,Read"
|
||||
|
||||
- name: Verify custom executables worked
|
||||
run: |
|
||||
OUTPUT_FILE="${{ steps.custom-test.outputs.execution_file }}"
|
||||
CONCLUSION="${{ steps.custom-test.outputs.conclusion }}"
|
||||
|
||||
echo "Conclusion: $CONCLUSION"
|
||||
echo "Output file: $OUTPUT_FILE"
|
||||
|
||||
if [ "$CONCLUSION" = "success" ]; then
|
||||
echo "✅ Action completed successfully with both custom executables"
|
||||
else
|
||||
echo "❌ Action failed with custom executables"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -f "$OUTPUT_FILE" ] && [ -s "$OUTPUT_FILE" ]; then
|
||||
echo "✅ Execution log file created successfully"
|
||||
if jq . "$OUTPUT_FILE" > /dev/null 2>&1; then
|
||||
echo "✅ Output is valid JSON"
|
||||
# Verify the task was completed
|
||||
if grep -q "package" "$OUTPUT_FILE"; then
|
||||
echo "✅ Claude successfully listed package files"
|
||||
else
|
||||
echo "⚠️ Could not verify if package files were listed"
|
||||
fi
|
||||
else
|
||||
echo "❌ Output is not valid JSON"
|
||||
exit 1
|
||||
fi
|
||||
else
|
||||
echo "❌ Execution log file not found or empty"
|
||||
exit 1
|
||||
fi
|
||||
33
docs/capabilities-and-limitations.md
Normal file
33
docs/capabilities-and-limitations.md
Normal file
@@ -0,0 +1,33 @@
|
||||
# Capabilities and Limitations
|
||||
|
||||
## What Claude Can Do
|
||||
|
||||
- **Respond in a Single Comment**: Claude operates by updating a single initial comment with progress and results
|
||||
- **Answer Questions**: Analyze code and provide explanations
|
||||
- **Implement Code Changes**: Make simple to moderate code changes based on requests
|
||||
- **Prepare Pull Requests**: Creates commits on a branch and links back to a prefilled PR creation page
|
||||
- **Perform Code Reviews**: Analyze PR changes and provide detailed feedback
|
||||
- **Smart Branch Handling**:
|
||||
- When triggered on an **issue**: Always creates a new branch for the work
|
||||
- When triggered on an **open PR**: Always pushes directly to the existing PR branch
|
||||
- When triggered on a **closed PR**: Creates a new branch since the original is no longer active
|
||||
- **View GitHub Actions Results**: Can access workflow runs, job logs, and test results on the PR where it's tagged when `actions: read` permission is configured (see [Additional Permissions for CI/CD Integration](./configuration.md#additional-permissions-for-cicd-integration))
|
||||
|
||||
## What Claude Cannot Do
|
||||
|
||||
- **Submit PR Reviews**: Claude cannot submit formal GitHub PR reviews
|
||||
- **Approve PRs**: For security reasons, Claude cannot approve pull requests
|
||||
- **Post Multiple Comments**: Claude only acts by updating its initial comment
|
||||
- **Execute Commands Outside Its Context**: Claude only has access to the repository and PR/issue context it's triggered in
|
||||
- **Run Arbitrary Bash Commands**: By default, Claude cannot execute Bash commands unless explicitly allowed using the `allowed_tools` configuration
|
||||
- **Perform Branch Operations**: Cannot merge branches, rebase, or perform other git operations beyond pushing commits
|
||||
|
||||
## How It Works
|
||||
|
||||
1. **Trigger Detection**: Listens for comments containing the trigger phrase (default: `@claude`) or issue assignment to a specific user
|
||||
2. **Context Gathering**: Analyzes the PR/issue, comments, code changes
|
||||
3. **Smart Responses**: Either answers questions or implements changes
|
||||
4. **Branch Management**: Creates new PRs for human authors, pushes directly for Claude's own PRs
|
||||
5. **Communication**: Posts updates at every step to keep you informed
|
||||
|
||||
This action is built on top of [`anthropics/claude-code-base-action`](https://github.com/anthropics/claude-code-base-action).
|
||||
99
docs/cloud-providers.md
Normal file
99
docs/cloud-providers.md
Normal file
@@ -0,0 +1,99 @@
|
||||
# Cloud Providers
|
||||
|
||||
You can authenticate with Claude using any of these three methods:
|
||||
|
||||
1. Direct Anthropic API (default)
|
||||
2. Amazon Bedrock with OIDC authentication
|
||||
3. Google Vertex AI with OIDC authentication
|
||||
|
||||
For detailed setup instructions for AWS Bedrock and Google Vertex AI, see the [official documentation](https://docs.anthropic.com/en/docs/claude-code/github-actions#using-with-aws-bedrock-%26-google-vertex-ai).
|
||||
|
||||
**Note**:
|
||||
|
||||
- Bedrock and Vertex use OIDC authentication exclusively
|
||||
- AWS Bedrock automatically uses cross-region inference profiles for certain models
|
||||
- For cross-region inference profile models, you need to request and be granted access to the Claude models in all regions that the inference profile uses
|
||||
|
||||
## Model Configuration
|
||||
|
||||
Use provider-specific model names based on your chosen provider:
|
||||
|
||||
```yaml
|
||||
# For direct Anthropic API (default)
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# ... other inputs
|
||||
|
||||
# For Amazon Bedrock with OIDC
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_bedrock: "true"
|
||||
claude_args: |
|
||||
--model anthropic.claude-4-0-sonnet-20250805-v1:0
|
||||
# ... other inputs
|
||||
|
||||
# For Google Vertex AI with OIDC
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_vertex: "true"
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet@20250805
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
## OIDC Authentication for Bedrock and Vertex
|
||||
|
||||
Both AWS Bedrock and GCP Vertex AI require OIDC authentication.
|
||||
|
||||
```yaml
|
||||
# For AWS Bedrock with OIDC
|
||||
- name: Configure AWS Credentials (OIDC)
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
|
||||
aws-region: us-west-2
|
||||
|
||||
- name: Generate GitHub App token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
app-id: ${{ secrets.APP_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_bedrock: "true"
|
||||
claude_args: |
|
||||
--model anthropic.claude-4-0-sonnet-20250805-v1:0
|
||||
# ... other inputs
|
||||
|
||||
permissions:
|
||||
id-token: write # Required for OIDC
|
||||
```
|
||||
|
||||
```yaml
|
||||
# For GCP Vertex AI with OIDC
|
||||
- name: Authenticate to Google Cloud
|
||||
uses: google-github-actions/auth@v2
|
||||
with:
|
||||
workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
|
||||
service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
|
||||
|
||||
- name: Generate GitHub App token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v2
|
||||
with:
|
||||
app-id: ${{ secrets.APP_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_vertex: "true"
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet@20250805
|
||||
# ... other inputs
|
||||
|
||||
permissions:
|
||||
id-token: write # Required for OIDC
|
||||
```
|
||||
373
docs/configuration.md
Normal file
373
docs/configuration.md
Normal file
@@ -0,0 +1,373 @@
|
||||
# Advanced Configuration
|
||||
|
||||
## Using Custom MCP Configuration
|
||||
|
||||
You can add custom MCP (Model Context Protocol) servers to extend Claude's capabilities using the `--mcp-config` flag in `claude_args`. These servers merge with the built-in GitHub MCP servers.
|
||||
|
||||
### Basic Example: Adding a Sequential Thinking Server
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--mcp-config '{"mcpServers": {"sequential-thinking": {"command": "npx", "args": ["-y", "@modelcontextprotocol/server-sequential-thinking"]}}}'
|
||||
--allowedTools mcp__sequential-thinking__sequentialthinking
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
### Passing Secrets to MCP Servers
|
||||
|
||||
For MCP servers that require sensitive information like API keys or tokens, you can create a configuration file with GitHub Secrets:
|
||||
|
||||
```yaml
|
||||
- name: Create MCP Config
|
||||
run: |
|
||||
cat > /tmp/mcp-config.json << 'EOF'
|
||||
{
|
||||
"mcpServers": {
|
||||
"custom-api-server": {
|
||||
"command": "npx",
|
||||
"args": ["-y", "@example/api-server"],
|
||||
"env": {
|
||||
"API_KEY": "${{ secrets.CUSTOM_API_KEY }}",
|
||||
"BASE_URL": "https://api.example.com"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--mcp-config /tmp/mcp-config.json
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
### Using Python MCP Servers with uv
|
||||
|
||||
For Python-based MCP servers managed with `uv`, you need to specify the directory containing your server:
|
||||
|
||||
```yaml
|
||||
- name: Create MCP Config for Python Server
|
||||
run: |
|
||||
cat > /tmp/mcp-config.json << 'EOF'
|
||||
{
|
||||
"mcpServers": {
|
||||
"my-python-server": {
|
||||
"type": "stdio",
|
||||
"command": "uv",
|
||||
"args": [
|
||||
"--directory",
|
||||
"${{ github.workspace }}/path/to/server/",
|
||||
"run",
|
||||
"server_file.py"
|
||||
]
|
||||
}
|
||||
}
|
||||
}
|
||||
EOF
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--mcp-config /tmp/mcp-config.json
|
||||
--allowedTools my-python-server__<tool_name> # Replace <tool_name> with your server's tool names
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
For example, if your Python MCP server is at `mcp_servers/weather.py`, you would use:
|
||||
|
||||
```yaml
|
||||
"args":
|
||||
["--directory", "${{ github.workspace }}/mcp_servers/", "run", "weather.py"]
|
||||
```
|
||||
|
||||
### Multiple MCP Servers
|
||||
|
||||
You can add multiple MCP servers by using multiple `--mcp-config` flags:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--mcp-config /tmp/config1.json
|
||||
--mcp-config /tmp/config2.json
|
||||
--mcp-config '{"mcpServers": {"inline-server": {"command": "npx", "args": ["@example/server"]}}}'
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
**Important**:
|
||||
|
||||
- Always use GitHub Secrets (`${{ secrets.SECRET_NAME }}`) for sensitive values like API keys, tokens, or passwords. Never hardcode secrets directly in the workflow file.
|
||||
- Your custom servers will override any built-in servers with the same name.
|
||||
- The `claude_args` supports multiple `--mcp-config` flags that will be merged together.
|
||||
|
||||
## Additional Permissions for CI/CD Integration
|
||||
|
||||
The `additional_permissions` input allows Claude to access GitHub Actions workflow information when you grant the necessary permissions. This is particularly useful for analyzing CI/CD failures and debugging workflow issues.
|
||||
|
||||
### Enabling GitHub Actions Access
|
||||
|
||||
To allow Claude to view workflow run results, job logs, and CI status:
|
||||
|
||||
1. **Grant the necessary permission to your GitHub token**:
|
||||
|
||||
- When using the default `GITHUB_TOKEN`, add the `actions: read` permission to your workflow:
|
||||
|
||||
```yaml
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
issues: write
|
||||
actions: read # Add this line
|
||||
```
|
||||
|
||||
2. **Configure the action with additional permissions**:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
additional_permissions: |
|
||||
actions: read
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
3. **Claude will automatically get access to CI/CD tools**:
|
||||
When you enable `actions: read`, Claude can use the following MCP tools:
|
||||
- `mcp__github_ci__get_ci_status` - View workflow run statuses
|
||||
- `mcp__github_ci__get_workflow_run_details` - Get detailed workflow information
|
||||
- `mcp__github_ci__download_job_log` - Download and analyze job logs
|
||||
|
||||
### Example: Debugging Failed CI Runs
|
||||
|
||||
```yaml
|
||||
name: Claude CI Helper
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
issues: write
|
||||
actions: read # Required for CI access
|
||||
|
||||
jobs:
|
||||
claude-ci-helper:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
additional_permissions: |
|
||||
actions: read
|
||||
# Now Claude can respond to "@claude why did the CI fail?"
|
||||
```
|
||||
|
||||
**Important Notes**:
|
||||
|
||||
- The GitHub token must have the `actions: read` permission in your workflow
|
||||
- If the permission is missing, Claude will warn you and suggest adding it
|
||||
- Currently, only `actions: read` is supported, but the format allows for future extensions
|
||||
|
||||
## Custom Environment Variables
|
||||
|
||||
You can pass custom environment variables to Claude Code execution using the `settings` input. This is useful for CI/test setups that require specific environment variables:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
settings: |
|
||||
{
|
||||
"env": {
|
||||
"NODE_ENV": "test",
|
||||
"CI": "true",
|
||||
"DATABASE_URL": "postgres://test:test@localhost:5432/test_db"
|
||||
}
|
||||
}
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
These environment variables will be available to Claude Code during execution, allowing it to run tests, build processes, or other commands that depend on specific environment configurations.
|
||||
|
||||
## Limiting Conversation Turns
|
||||
|
||||
You can limit the number of back-and-forth exchanges Claude can have during task execution using the `claude_args` input. This is useful for:
|
||||
|
||||
- Controlling costs by preventing runaway conversations
|
||||
- Setting time boundaries for automated workflows
|
||||
- Ensuring predictable behavior in CI/CD pipelines
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--max-turns 5 # Limit to 5 conversation turns
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
When the turn limit is reached, Claude will stop execution gracefully. Choose a value that gives Claude enough turns to complete typical tasks while preventing excessive usage.
|
||||
|
||||
## Custom Tools
|
||||
|
||||
By default, Claude only has access to:
|
||||
|
||||
- File operations (reading, committing, editing files, read-only git commands)
|
||||
- Comment management (creating/updating comments)
|
||||
- Basic GitHub operations
|
||||
|
||||
Claude does **not** have access to execute arbitrary Bash commands by default. If you want Claude to run specific commands (e.g., npm install, npm test), you must explicitly allow them using the `claude_args` configuration:
|
||||
|
||||
**Note**: If your repository has a `.mcp.json` file in the root directory, Claude will automatically detect and use the MCP server tools defined there. However, these tools still need to be explicitly allowed.
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
claude_args: |
|
||||
--allowedTools "Bash(npm install),Bash(npm run test),Edit,Replace,NotebookEditCell"
|
||||
--disallowedTools "TaskOutput,KillTask"
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
**Note**: The base GitHub tools are always included. Use `--allowedTools` to add additional tools (including specific Bash commands), and `--disallowedTools` to prevent specific tools from being used.
|
||||
|
||||
## Custom Model
|
||||
|
||||
Specify a Claude model using `claude_args`:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet-20250805
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
For provider-specific models:
|
||||
|
||||
```yaml
|
||||
# AWS Bedrock
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_bedrock: "true"
|
||||
claude_args: |
|
||||
--model anthropic.claude-4-0-sonnet-20250805-v1:0
|
||||
# ... other inputs
|
||||
|
||||
# Google Vertex AI
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_vertex: "true"
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet@20250805
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
## Claude Code Settings
|
||||
|
||||
You can provide Claude Code settings to customize behavior such as model selection, environment variables, permissions, and hooks. Settings can be provided either as a JSON string or a path to a settings file.
|
||||
|
||||
### Option 1: Settings File
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
settings: "path/to/settings.json"
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
### Option 2: Inline Settings
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
settings: |
|
||||
{
|
||||
"model": "claude-opus-4-1-20250805",
|
||||
"env": {
|
||||
"DEBUG": "true",
|
||||
"API_URL": "https://api.example.com"
|
||||
},
|
||||
"permissions": {
|
||||
"allow": ["Bash", "Read"],
|
||||
"deny": ["WebFetch"]
|
||||
},
|
||||
"hooks": {
|
||||
"PreToolUse": [{
|
||||
"matcher": "Bash",
|
||||
"hooks": [{
|
||||
"type": "command",
|
||||
"command": "echo Running bash command..."
|
||||
}]
|
||||
}]
|
||||
}
|
||||
}
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
The settings support all Claude Code settings options including:
|
||||
|
||||
- `model`: Override the default model
|
||||
- `env`: Environment variables for the session
|
||||
- `permissions`: Tool usage permissions
|
||||
- `hooks`: Pre/post tool execution hooks
|
||||
- And more...
|
||||
|
||||
For a complete list of available settings and their descriptions, see the [Claude Code settings documentation](https://docs.anthropic.com/en/docs/claude-code/settings).
|
||||
|
||||
**Notes**:
|
||||
|
||||
- The `enableAllProjectMcpServers` setting is always set to `true` by this action to ensure MCP servers work correctly.
|
||||
- The `claude_args` input provides direct access to Claude Code CLI arguments and takes precedence over settings.
|
||||
- We recommend using `claude_args` for simple configurations and `settings` for complex configurations with hooks and environment variables.
|
||||
|
||||
## Migration from Deprecated Inputs
|
||||
|
||||
Many individual input parameters have been consolidated into `claude_args` or `settings`. Here's how to migrate:
|
||||
|
||||
| Old Input | New Approach |
|
||||
| --------------------- | -------------------------------------------------------- |
|
||||
| `allowed_tools` | Use `claude_args: "--allowedTools Tool1,Tool2"` |
|
||||
| `disallowed_tools` | Use `claude_args: "--disallowedTools Tool1,Tool2"` |
|
||||
| `max_turns` | Use `claude_args: "--max-turns 10"` |
|
||||
| `model` | Use `claude_args: "--model claude-4-0-sonnet-20250805"` |
|
||||
| `claude_env` | Use `settings` with `"env"` object |
|
||||
| `custom_instructions` | Use `claude_args: "--system-prompt 'Your instructions'"` |
|
||||
| `mcp_config` | Use `claude_args: "--mcp-config '{...}'"` |
|
||||
| `direct_prompt` | Use `prompt` input instead |
|
||||
| `override_prompt` | Use `prompt` with GitHub context variables |
|
||||
|
||||
## Custom Executables for Specialized Environments
|
||||
|
||||
For specialized environments like Nix, custom container setups, or other package management systems where the default installation doesn't work, you can provide your own executables:
|
||||
|
||||
### Custom Claude Code Executable
|
||||
|
||||
Use `path_to_claude_code_executable` to provide your own Claude Code binary instead of using the automatically installed version:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
path_to_claude_code_executable: "/path/to/custom/claude"
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
### Custom Bun Executable
|
||||
|
||||
Use `path_to_bun_executable` to provide your own Bun runtime instead of the default installation:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
path_to_bun_executable: "/path/to/custom/bun"
|
||||
# ... other inputs
|
||||
```
|
||||
|
||||
**Important**: Using incompatible versions may cause the action to fail. Ensure your custom executables are compatible with the action's requirements.
|
||||
122
docs/custom-automations.md
Normal file
122
docs/custom-automations.md
Normal file
@@ -0,0 +1,122 @@
|
||||
# Custom Automations
|
||||
|
||||
These examples show how to configure Claude to act automatically based on GitHub events. When you provide a `prompt` input, the action automatically runs in agent mode without requiring manual @mentions. Without a `prompt`, it runs in interactive mode, responding to @claude mentions.
|
||||
|
||||
## Mode Detection & Tracking Comments
|
||||
|
||||
The action automatically detects which mode to use based on your configuration:
|
||||
|
||||
- **Interactive Mode** (no `prompt` input): Responds to @claude mentions, creates tracking comments with progress indicators
|
||||
- **Automation Mode** (with `prompt` input): Executes immediately, **does not create tracking comments**
|
||||
|
||||
> **Note**: In v1, automation mode intentionally does not create tracking comments by default to reduce noise in automated workflows. If you need progress tracking, use the `track_progress: true` input parameter.
|
||||
|
||||
## Supported GitHub Events
|
||||
|
||||
This action supports the following GitHub events ([learn more GitHub event triggers](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows)):
|
||||
|
||||
- `pull_request` or `pull_request_target` - When PRs are opened or synchronized
|
||||
- `issue_comment` - When comments are created on issues or PRs
|
||||
- `pull_request_comment` - When comments are made on PR diffs
|
||||
- `issues` - When issues are opened or assigned
|
||||
- `pull_request_review` - When PR reviews are submitted
|
||||
- `pull_request_review_comment` - When comments are made on PR reviews
|
||||
- `repository_dispatch` - Custom events triggered via API
|
||||
- `workflow_dispatch` - Manual workflow triggers (coming soon)
|
||||
|
||||
## Automated Documentation Updates
|
||||
|
||||
Automatically update documentation when specific files change (see [`examples/claude-pr-path-specific.yml`](../examples/claude-pr-path-specific.yml)):
|
||||
|
||||
```yaml
|
||||
on:
|
||||
pull_request:
|
||||
paths:
|
||||
- "src/api/**/*.ts"
|
||||
|
||||
steps:
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
Update the API documentation in README.md to reflect
|
||||
the changes made to the API endpoints in this PR.
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
When API files are modified, the action automatically detects that a `prompt` is provided and runs in agent mode. Claude updates your README with the latest endpoint documentation and pushes the changes back to the PR, keeping your docs in sync with your code.
|
||||
|
||||
## Author-Specific Code Reviews
|
||||
|
||||
Automatically review PRs from specific authors or external contributors (see [`examples/claude-review-from-author.yml`](../examples/claude-review-from-author.yml)):
|
||||
|
||||
```yaml
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
review-by-author:
|
||||
if: |
|
||||
github.event.pull_request.user.login == 'developer1' ||
|
||||
github.event.pull_request.user.login == 'external-contributor'
|
||||
steps:
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
Please provide a thorough review of this pull request.
|
||||
Pay extra attention to coding standards, security practices,
|
||||
and test coverage since this is from an external contributor.
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
Perfect for automatically reviewing PRs from new team members, external contributors, or specific developers who need extra guidance. The action automatically runs in agent mode when a `prompt` is provided.
|
||||
|
||||
## Custom Prompt Templates
|
||||
|
||||
Use the `prompt` input with GitHub context variables for dynamic automation:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
Analyze PR #${{ github.event.pull_request.number }} in ${{ github.repository }} for security vulnerabilities.
|
||||
|
||||
Focus on:
|
||||
- SQL injection risks
|
||||
- XSS vulnerabilities
|
||||
- Authentication bypasses
|
||||
- Exposed secrets or credentials
|
||||
|
||||
Provide severity ratings (Critical/High/Medium/Low) for any issues found.
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
You can access any GitHub context variable using the standard GitHub Actions syntax:
|
||||
|
||||
- `${{ github.repository }}` - The repository name
|
||||
- `${{ github.event.pull_request.number }}` - PR number
|
||||
- `${{ github.event.issue.number }}` - Issue number
|
||||
- `${{ github.event.pull_request.title }}` - PR title
|
||||
- `${{ github.event.pull_request.body }}` - PR description
|
||||
- `${{ github.event.comment.body }}` - Comment text
|
||||
- `${{ github.actor }}` - User who triggered the workflow
|
||||
- `${{ github.base_ref }}` - Base branch for PRs
|
||||
- `${{ github.head_ref }}` - Head branch for PRs
|
||||
|
||||
## Advanced Configuration with claude_args
|
||||
|
||||
For more control over Claude's behavior, use the `claude_args` input to pass CLI arguments directly:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: "Review this PR for performance issues"
|
||||
claude_args: |
|
||||
--max-turns 15
|
||||
--model claude-4-0-sonnet-20250805
|
||||
--allowedTools Edit,Read,Write,Bash
|
||||
--system-prompt "You are a performance optimization expert. Focus on identifying bottlenecks and suggesting improvements."
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
This provides full access to Claude Code CLI capabilities while maintaining the simplified action interface.
|
||||
128
docs/experimental.md
Normal file
128
docs/experimental.md
Normal file
@@ -0,0 +1,128 @@
|
||||
# Experimental Features
|
||||
|
||||
**Note:** Experimental features are considered unstable and not supported for production use. They may change or be removed at any time.
|
||||
|
||||
## Automatic Mode Detection
|
||||
|
||||
The action intelligently detects the appropriate execution mode based on your workflow context, eliminating the need for manual mode configuration.
|
||||
|
||||
### Interactive Mode (Tag Mode)
|
||||
|
||||
Activated when Claude detects @mentions, issue assignments, or labels—without an explicit `prompt`.
|
||||
|
||||
- **Triggers**: `@claude` mentions in comments, issue assignment to claude user, label application
|
||||
- **Features**: Creates tracking comments with progress checkboxes, full implementation capabilities
|
||||
- **Use case**: Interactive code assistance, Q&A, and implementation requests
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# No prompt needed - responds to @claude mentions
|
||||
```
|
||||
|
||||
### Automation Mode (Agent Mode)
|
||||
|
||||
Automatically activated when you provide a `prompt` input.
|
||||
|
||||
- **Triggers**: Any GitHub event when `prompt` input is provided
|
||||
- **Features**: Direct execution without requiring @claude mentions, streamlined for automation
|
||||
- **Use case**: Automated PR reviews, scheduled tasks, workflow automation
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
Check for outdated dependencies and create an issue if any are found.
|
||||
# Automatically runs in agent mode when prompt is provided
|
||||
```
|
||||
|
||||
### How It Works
|
||||
|
||||
The action uses this logic to determine the mode:
|
||||
|
||||
1. **If `prompt` is provided** → Runs in **agent mode** for automation
|
||||
2. **If no `prompt` but @claude is mentioned** → Runs in **tag mode** for interaction
|
||||
3. **If neither** → No action is taken
|
||||
|
||||
This automatic detection ensures your workflows are simpler and more intuitive, without needing to understand or configure different modes.
|
||||
|
||||
### Advanced Mode Control
|
||||
|
||||
For specialized use cases, you can fine-tune behavior using `claude_args`:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: "Review this PR"
|
||||
claude_args: |
|
||||
--max-turns 20
|
||||
--system-prompt "You are a code review specialist"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
## Network Restrictions
|
||||
|
||||
For enhanced security, you can restrict Claude's network access to specific domains only. This feature is particularly useful for:
|
||||
|
||||
- Enterprise environments with strict security policies
|
||||
- Preventing access to external services
|
||||
- Limiting Claude to only your internal APIs and services
|
||||
|
||||
When `experimental_allowed_domains` is set, Claude can only access the domains you explicitly list. You'll need to include the appropriate provider domains based on your authentication method.
|
||||
|
||||
### Provider-Specific Examples
|
||||
|
||||
#### If using Anthropic API or subscription
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# Or: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
experimental_allowed_domains: |
|
||||
.anthropic.com
|
||||
```
|
||||
|
||||
#### If using AWS Bedrock
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_bedrock: "true"
|
||||
experimental_allowed_domains: |
|
||||
bedrock.*.amazonaws.com
|
||||
bedrock-runtime.*.amazonaws.com
|
||||
```
|
||||
|
||||
#### If using Google Vertex AI
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_vertex: "true"
|
||||
experimental_allowed_domains: |
|
||||
*.googleapis.com
|
||||
vertexai.googleapis.com
|
||||
```
|
||||
|
||||
### Common GitHub Domains
|
||||
|
||||
In addition to your provider domains, you may need to include GitHub-related domains. For GitHub.com users, common domains include:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
experimental_allowed_domains: |
|
||||
.anthropic.com # For Anthropic API
|
||||
.github.com
|
||||
.githubusercontent.com
|
||||
ghcr.io
|
||||
.blob.core.windows.net
|
||||
```
|
||||
|
||||
For GitHub Enterprise users, replace the GitHub.com domains above with your enterprise domains (e.g., `.github.company.com`, `packages.company.com`, etc.).
|
||||
|
||||
To determine which domains your workflow needs, you can temporarily run without restrictions and monitor the network requests, or check your GitHub Enterprise configuration for the specific services you use.
|
||||
356
docs/migration-guide.md
Normal file
356
docs/migration-guide.md
Normal file
@@ -0,0 +1,356 @@
|
||||
# Migration Guide: v0.x to v1.0
|
||||
|
||||
This guide helps you migrate from Claude Code Action v0.x to v1.0. The new version introduces intelligent mode detection and simplified configuration while maintaining backward compatibility for most use cases.
|
||||
|
||||
## Overview of Changes
|
||||
|
||||
### 🎯 Key Improvements in v1.0
|
||||
|
||||
1. **Automatic Mode Detection** - No more manual `mode` configuration
|
||||
2. **Simplified Configuration** - Unified `prompt` and `claude_args` inputs
|
||||
3. **Better SDK Alignment** - Closer integration with Claude Code CLI
|
||||
|
||||
### ⚠️ Breaking Changes
|
||||
|
||||
The following inputs have been deprecated and replaced:
|
||||
|
||||
| Deprecated Input | Replacement | Notes |
|
||||
| --------------------- | ------------------------------------ | --------------------------------------------- |
|
||||
| `mode` | Auto-detected | Action automatically chooses based on context |
|
||||
| `direct_prompt` | `prompt` | Direct drop-in replacement |
|
||||
| `override_prompt` | `prompt` | Use GitHub context variables instead |
|
||||
| `custom_instructions` | `claude_args: --system-prompt` | Move to CLI arguments |
|
||||
| `max_turns` | `claude_args: --max-turns` | Use CLI format |
|
||||
| `model` | `claude_args: --model` | Specify via CLI |
|
||||
| `allowed_tools` | `claude_args: --allowedTools` | Use CLI format |
|
||||
| `disallowed_tools` | `claude_args: --disallowedTools` | Use CLI format |
|
||||
| `claude_env` | `settings` with env object | Use settings JSON |
|
||||
| `mcp_config` | `claude_args: --mcp-config` | Pass MCP config via CLI arguments |
|
||||
| `timeout_minutes` | Use GitHub Actions `timeout-minutes` | Configure at job level instead of input level |
|
||||
|
||||
## Migration Examples
|
||||
|
||||
### Basic Interactive Workflow (@claude mentions)
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
mode: "tag"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
custom_instructions: "Follow our coding standards"
|
||||
max_turns: "10"
|
||||
allowed_tools: "Edit,Read,Write"
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--max-turns 10
|
||||
--system-prompt "Follow our coding standards"
|
||||
--allowedTools Edit,Read,Write
|
||||
```
|
||||
|
||||
### Automation Workflow
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
mode: "agent"
|
||||
direct_prompt: "Review this PR for security issues"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
model: "claude-3-5-sonnet-20241022"
|
||||
allowed_tools: "Edit,Read,Write"
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Review this PR for security issues
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet-20250805
|
||||
--allowedTools Edit,Read,Write
|
||||
```
|
||||
|
||||
> **⚠️ Important**: For PR reviews, always include the repository and PR context in your prompt. This ensures Claude knows which PR to review.
|
||||
|
||||
### Automation with Progress Tracking (New in v1.0)
|
||||
|
||||
**Missing the tracking comments from v0.x agent mode?** The new `track_progress` input brings them back!
|
||||
|
||||
In v1.0, automation mode (with `prompt` input) doesn't create tracking comments by default to reduce noise. However, if you need progress visibility, you can use the `track_progress` feature:
|
||||
|
||||
**Before (v0.x with tracking):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
mode: "agent"
|
||||
direct_prompt: "Review this PR for security issues"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
**After (v1.0 with tracking):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
track_progress: true # Forces tag mode with tracking comments
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Review this PR for security issues
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
#### Benefits of `track_progress`
|
||||
|
||||
1. **Preserves GitHub Context**: Automatically includes all PR/issue details, comments, and attachments
|
||||
2. **Brings Back Tracking Comments**: Creates progress indicators just like v0.x agent mode
|
||||
3. **Works with Custom Prompts**: Your `prompt` is injected as custom instructions while maintaining context
|
||||
|
||||
#### Supported Events for `track_progress`
|
||||
|
||||
The `track_progress` input only works with these GitHub events:
|
||||
|
||||
**Pull Request Events:**
|
||||
|
||||
- `opened` - New PR created
|
||||
- `synchronize` - PR updated with new commits
|
||||
- `ready_for_review` - Draft PR marked as ready
|
||||
- `reopened` - Previously closed PR reopened
|
||||
|
||||
**Issue Events:**
|
||||
|
||||
- `opened` - New issue created
|
||||
- `edited` - Issue title or body modified
|
||||
- `labeled` - Label added to issue
|
||||
- `assigned` - Issue assigned to user
|
||||
|
||||
> **Note**: Using `track_progress: true` with unsupported events will cause an error.
|
||||
|
||||
### Custom Template with Variables
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
override_prompt: |
|
||||
Analyze PR #$PR_NUMBER in $REPOSITORY
|
||||
Changed files: $CHANGED_FILES
|
||||
Focus on security vulnerabilities
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Analyze this pull request focusing on security vulnerabilities in the changed files.
|
||||
|
||||
Note: The PR branch is already checked out in the current working directory.
|
||||
```
|
||||
|
||||
> **💡 Tip**: While you can access GitHub context variables in your prompt, it's recommended to use the standard `REPO:` and `PR NUMBER:` format for consistency.
|
||||
|
||||
### Environment Variables
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
claude_env: |
|
||||
NODE_ENV: test
|
||||
CI: true
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
settings: |
|
||||
{
|
||||
"env": {
|
||||
"NODE_ENV": "test",
|
||||
"CI": "true"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Timeout Configuration
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
timeout_minutes: 30
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
claude-task:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 30 # Moved to job level
|
||||
steps:
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
## How Mode Detection Works
|
||||
|
||||
The action now automatically detects the appropriate mode:
|
||||
|
||||
1. **If `prompt` is provided** → Runs in **automation mode**
|
||||
|
||||
- Executes immediately without waiting for @claude mentions
|
||||
- Perfect for scheduled tasks, PR automation, etc.
|
||||
|
||||
2. **If no `prompt` but @claude is mentioned** → Runs in **interactive mode**
|
||||
|
||||
- Waits for and responds to @claude mentions
|
||||
- Creates tracking comments with progress
|
||||
|
||||
3. **If neither** → No action is taken
|
||||
|
||||
## Advanced Configuration with claude_args
|
||||
|
||||
The `claude_args` input provides direct access to Claude Code CLI arguments:
|
||||
|
||||
```yaml
|
||||
claude_args: |
|
||||
--max-turns 15
|
||||
--model claude-4-0-sonnet-20250805
|
||||
--allowedTools Edit,Read,Write,Bash
|
||||
--disallowedTools WebSearch
|
||||
--system-prompt "You are a senior engineer focused on code quality"
|
||||
--mcp-config '{"mcpServers": {"custom": {"command": "npx", "args": ["-y", "@example/server"]}}}'
|
||||
```
|
||||
|
||||
### Common claude_args Options
|
||||
|
||||
| Option | Description | Example |
|
||||
| ------------------- | ------------------------ | -------------------------------------- |
|
||||
| `--max-turns` | Limit conversation turns | `--max-turns 10` |
|
||||
| `--model` | Specify Claude model | `--model claude-4-0-sonnet-20250805` |
|
||||
| `--allowedTools` | Enable specific tools | `--allowedTools Edit,Read,Write` |
|
||||
| `--disallowedTools` | Disable specific tools | `--disallowedTools WebSearch` |
|
||||
| `--system-prompt` | Add system instructions | `--system-prompt "Focus on security"` |
|
||||
| `--mcp-config` | Add MCP server config | `--mcp-config '{"mcpServers": {...}}'` |
|
||||
|
||||
## Provider-Specific Updates
|
||||
|
||||
### AWS Bedrock
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_bedrock: "true"
|
||||
claude_args: |
|
||||
--model anthropic.claude-4-0-sonnet-20250805-v1:0
|
||||
```
|
||||
|
||||
### Google Vertex AI
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
use_vertex: "true"
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet@20250805
|
||||
```
|
||||
|
||||
## MCP Configuration Migration
|
||||
|
||||
### Adding Custom MCP Servers
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
mcp_config: |
|
||||
{
|
||||
"mcpServers": {
|
||||
"custom-server": {
|
||||
"command": "npx",
|
||||
"args": ["-y", "@example/server"]
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
claude_args: |
|
||||
--mcp-config '{"mcpServers": {"custom-server": {"command": "npx", "args": ["-y", "@example/server"]}}}'
|
||||
```
|
||||
|
||||
You can also pass MCP configuration from a file:
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
claude_args: |
|
||||
--mcp-config /path/to/mcp-config.json
|
||||
```
|
||||
|
||||
## Step-by-Step Migration Checklist
|
||||
|
||||
- [ ] Update action version from `@beta` to `@v1`
|
||||
- [ ] Remove `mode` input (auto-detected now)
|
||||
- [ ] Replace `direct_prompt` with `prompt`
|
||||
- [ ] Replace `override_prompt` with `prompt` using GitHub context
|
||||
- [ ] Move `custom_instructions` to `claude_args` with `--system-prompt`
|
||||
- [ ] Convert `max_turns` to `claude_args` with `--max-turns`
|
||||
- [ ] Convert `model` to `claude_args` with `--model`
|
||||
- [ ] Convert `allowed_tools` to `claude_args` with `--allowedTools`
|
||||
- [ ] Convert `disallowed_tools` to `claude_args` with `--disallowedTools`
|
||||
- [ ] Move `claude_env` to `settings` JSON format
|
||||
- [ ] Move `mcp_config` to `claude_args` with `--mcp-config`
|
||||
- [ ] Replace `timeout_minutes` with GitHub Actions `timeout-minutes` at job level
|
||||
- [ ] **Optional**: Add `track_progress: true` if you need tracking comments in automation mode
|
||||
- [ ] Test workflow in a non-production environment
|
||||
|
||||
## Getting Help
|
||||
|
||||
If you encounter issues during migration:
|
||||
|
||||
1. Check the [FAQ](./faq.md) for common questions
|
||||
2. Review [example workflows](../examples/) for reference
|
||||
3. Open an [issue](https://github.com/anthropics/claude-code-action/issues) for support
|
||||
|
||||
## Version Compatibility
|
||||
|
||||
- **v0.x workflows** will continue to work but with deprecation warnings
|
||||
- **v1.0** is the recommended version for all new workflows
|
||||
- Future versions may remove deprecated inputs entirely
|
||||
43
docs/security.md
Normal file
43
docs/security.md
Normal file
@@ -0,0 +1,43 @@
|
||||
# Security
|
||||
|
||||
## Access Control
|
||||
|
||||
- **Repository Access**: The action can only be triggered by users with write access to the repository
|
||||
- **Bot User Control**: By default, GitHub Apps and bots cannot trigger this action for security reasons. Use the `allowed_bots` parameter to enable specific bots or all bots
|
||||
- **⚠️ Non-Write User Access (RISKY)**: The `allowed_non_write_users` parameter allows bypassing the write permission requirement. **This is a significant security risk and should only be used for workflows with extremely limited permissions** (e.g., issue labeling workflows that only have `issues: write` permission). This feature:
|
||||
- Only works when `github_token` is provided as input (not with GitHub App authentication)
|
||||
- Accepts either a comma-separated list of specific usernames or `*` to allow all users
|
||||
- **Should be used with extreme caution** as it bypasses the primary security mechanism of this action
|
||||
- Is designed for automation workflows where user permissions are already restricted by the workflow's permission scope
|
||||
- **Token Permissions**: The GitHub app receives only a short-lived token scoped specifically to the repository it's operating in
|
||||
- **No Cross-Repository Access**: Each action invocation is limited to the repository where it was triggered
|
||||
- **Limited Scope**: The token cannot access other repositories or perform actions beyond the configured permissions
|
||||
|
||||
## GitHub App Permissions
|
||||
|
||||
The [Claude Code GitHub app](https://github.com/apps/claude) requires these permissions:
|
||||
|
||||
- **Pull Requests**: Read and write to create PRs and push changes
|
||||
- **Issues**: Read and write to respond to issues
|
||||
- **Contents**: Read and write to modify repository files
|
||||
|
||||
## Commit Signing
|
||||
|
||||
All commits made by Claude through this action are automatically signed with commit signatures. This ensures the authenticity and integrity of commits, providing a verifiable trail of changes made by the action.
|
||||
|
||||
## ⚠️ Authentication Protection
|
||||
|
||||
**CRITICAL: Never hardcode your Anthropic API key or OAuth token in workflow files!**
|
||||
|
||||
Your authentication credentials must always be stored in GitHub secrets to prevent unauthorized access:
|
||||
|
||||
```yaml
|
||||
# CORRECT ✅
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# OR
|
||||
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
|
||||
# NEVER DO THIS ❌
|
||||
anthropic_api_key: "sk-ant-api03-..." # Exposed and vulnerable!
|
||||
claude_code_oauth_token: "oauth_token_..." # Exposed and vulnerable!
|
||||
```
|
||||
146
docs/setup.md
Normal file
146
docs/setup.md
Normal file
@@ -0,0 +1,146 @@
|
||||
# Setup Guide
|
||||
|
||||
## Manual Setup (Direct API)
|
||||
|
||||
**Requirements**: You must be a repository admin to complete these steps.
|
||||
|
||||
1. Install the Claude GitHub app to your repository: https://github.com/apps/claude
|
||||
2. Add authentication to your repository secrets ([Learn how to use secrets in GitHub Actions](https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions)):
|
||||
- Either `ANTHROPIC_API_KEY` for API key authentication
|
||||
- Or `CLAUDE_CODE_OAUTH_TOKEN` for OAuth token authentication (Pro and Max users can generate this by running `claude setup-token` locally)
|
||||
3. Copy the workflow file from [`examples/claude.yml`](../examples/claude.yml) into your repository's `.github/workflows/`
|
||||
|
||||
## Using a Custom GitHub App
|
||||
|
||||
If you prefer not to install the official Claude app, you can create your own GitHub App to use with this action. This gives you complete control over permissions and access.
|
||||
|
||||
**When you may want to use a custom GitHub App:**
|
||||
|
||||
- You need more restrictive permissions than the official app
|
||||
- Organization policies prevent installing third-party apps
|
||||
- You're using AWS Bedrock or Google Vertex AI
|
||||
|
||||
**Steps to create and use a custom GitHub App:**
|
||||
|
||||
1. **Create a new GitHub App:**
|
||||
|
||||
- Go to https://github.com/settings/apps (for personal apps) or your organization's settings
|
||||
- Click "New GitHub App"
|
||||
- Configure the app with these minimum permissions:
|
||||
- **Repository permissions:**
|
||||
- Contents: Read & Write
|
||||
- Issues: Read & Write
|
||||
- Pull requests: Read & Write
|
||||
- **Account permissions:** None required
|
||||
- Set "Where can this GitHub App be installed?" to your preference
|
||||
- Create the app
|
||||
|
||||
2. **Generate and download a private key:**
|
||||
|
||||
- After creating the app, scroll down to "Private keys"
|
||||
- Click "Generate a private key"
|
||||
- Download the `.pem` file (keep this secure!)
|
||||
|
||||
3. **Install the app on your repository:**
|
||||
|
||||
- Go to the app's settings page
|
||||
- Click "Install App"
|
||||
- Select the repositories where you want to use Claude
|
||||
|
||||
4. **Add the app credentials to your repository secrets:**
|
||||
|
||||
- Go to your repository's Settings → Secrets and variables → Actions
|
||||
- Add these secrets:
|
||||
- `APP_ID`: Your GitHub App's ID (found in the app settings)
|
||||
- `APP_PRIVATE_KEY`: The contents of the downloaded `.pem` file
|
||||
|
||||
5. **Update your workflow to use the custom app:**
|
||||
|
||||
```yaml
|
||||
name: Claude with Custom App
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
# ... other triggers
|
||||
|
||||
jobs:
|
||||
claude-response:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
# Generate a token from your custom app
|
||||
- name: Generate GitHub App token
|
||||
id: app-token
|
||||
uses: actions/create-github-app-token@v1
|
||||
with:
|
||||
app-id: ${{ secrets.APP_ID }}
|
||||
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
||||
|
||||
# Use Claude with your custom app's token
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
github_token: ${{ steps.app-token.outputs.token }}
|
||||
# ... other configuration
|
||||
```
|
||||
|
||||
**Important notes:**
|
||||
|
||||
- The custom app must have read/write permissions for Issues, Pull Requests, and Contents
|
||||
- Your app's token will have the exact permissions you configured, nothing more
|
||||
|
||||
For more information on creating GitHub Apps, see the [GitHub documentation](https://docs.github.com/en/apps/creating-github-apps).
|
||||
|
||||
## Security Best Practices
|
||||
|
||||
**⚠️ IMPORTANT: Never commit API keys directly to your repository! Always use GitHub Actions secrets.**
|
||||
|
||||
To securely use your Anthropic API key:
|
||||
|
||||
1. Add your API key as a repository secret:
|
||||
|
||||
- Go to your repository's Settings
|
||||
- Navigate to "Secrets and variables" → "Actions"
|
||||
- Click "New repository secret"
|
||||
- Name it `ANTHROPIC_API_KEY`
|
||||
- Paste your API key as the value
|
||||
|
||||
2. Reference the secret in your workflow:
|
||||
```yaml
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
**Never do this:**
|
||||
|
||||
```yaml
|
||||
# ❌ WRONG - Exposes your API key
|
||||
anthropic_api_key: "sk-ant-..."
|
||||
```
|
||||
|
||||
**Always do this:**
|
||||
|
||||
```yaml
|
||||
# ✅ CORRECT - Uses GitHub secrets
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
```
|
||||
|
||||
This applies to all sensitive values including API keys, access tokens, and credentials.
|
||||
We also recommend that you always use short-lived tokens when possible
|
||||
|
||||
## Setting Up GitHub Secrets
|
||||
|
||||
1. Go to your repository's Settings
|
||||
2. Click on "Secrets and variables" → "Actions"
|
||||
3. Click "New repository secret"
|
||||
4. For authentication, choose one:
|
||||
- API Key: Name: `ANTHROPIC_API_KEY`, Value: Your Anthropic API key (starting with `sk-ant-`)
|
||||
- OAuth Token: Name: `CLAUDE_CODE_OAUTH_TOKEN`, Value: Your Claude Code OAuth token (Pro and Max users can generate this by running `claude setup-token` locally)
|
||||
5. Click "Add secret"
|
||||
|
||||
### Best Practices for Authentication
|
||||
|
||||
1. ✅ Always use `${{ secrets.ANTHROPIC_API_KEY }}` or `${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}` in workflows
|
||||
2. ✅ Never commit API keys or tokens to version control
|
||||
3. ✅ Regularly rotate your API keys and tokens
|
||||
4. ✅ Use environment secrets for organization-wide access
|
||||
5. ❌ Never share API keys or tokens in pull requests or issues
|
||||
6. ❌ Avoid logging workflow variables that might contain keys
|
||||
591
docs/solutions.md
Normal file
591
docs/solutions.md
Normal file
@@ -0,0 +1,591 @@
|
||||
# Solutions & Use Cases
|
||||
|
||||
This guide provides complete, ready-to-use solutions for common automation scenarios with Claude Code Action. Each solution includes working examples, configuration details, and expected outcomes.
|
||||
|
||||
## 📋 Table of Contents
|
||||
|
||||
- [Automatic PR Code Review](#automatic-pr-code-review)
|
||||
- [Review Only Specific File Paths](#review-only-specific-file-paths)
|
||||
- [Review PRs from External Contributors](#review-prs-from-external-contributors)
|
||||
- [Custom PR Review Checklist](#custom-pr-review-checklist)
|
||||
- [Scheduled Repository Maintenance](#scheduled-repository-maintenance)
|
||||
- [Issue Auto-Triage and Labeling](#issue-auto-triage-and-labeling)
|
||||
- [Documentation Sync on API Changes](#documentation-sync-on-api-changes)
|
||||
- [Security-Focused PR Reviews](#security-focused-pr-reviews)
|
||||
|
||||
---
|
||||
|
||||
## Automatic PR Code Review
|
||||
|
||||
**When to use:** Automatically review every PR opened or updated in your repository.
|
||||
|
||||
### Basic Example (No Tracking)
|
||||
|
||||
```yaml
|
||||
name: Claude Auto Review
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
review:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Please review this pull request with a focus on:
|
||||
- Code quality and best practices
|
||||
- Potential bugs or issues
|
||||
- Security implications
|
||||
- Performance considerations
|
||||
|
||||
Note: The PR branch is already checked out in the current working directory.
|
||||
|
||||
Use `gh pr comment` for top-level feedback.
|
||||
Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
|
||||
Only post GitHub comments - don't submit review text as messages.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- Triggers on `opened` and `synchronize` (new commits)
|
||||
- Always include `REPO` and `PR NUMBER` for context
|
||||
- Specify tools for commenting and reviewing
|
||||
- PR branch is pre-checked out
|
||||
|
||||
**Expected Output:** Claude posts review comments directly to the PR with inline annotations where appropriate.
|
||||
|
||||
### Enhanced Example (With Progress Tracking)
|
||||
|
||||
Want visual progress tracking for PR reviews? Use `track_progress: true` to get tracking comments like in v0.x:
|
||||
|
||||
```yaml
|
||||
name: Claude Auto Review with Tracking
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, ready_for_review, reopened]
|
||||
|
||||
jobs:
|
||||
review:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
track_progress: true # ✨ Enables tracking comments
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Please review this pull request with a focus on:
|
||||
- Code quality and best practices
|
||||
- Potential bugs or issues
|
||||
- Security implications
|
||||
- Performance considerations
|
||||
|
||||
Provide detailed feedback using inline comments for specific issues.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
|
||||
```
|
||||
|
||||
**Benefits of Progress Tracking:**
|
||||
|
||||
- **Visual Progress Indicators**: Shows "In progress" status with checkboxes
|
||||
- **Preserves Full Context**: Automatically includes all PR details, comments, and attachments
|
||||
- **Migration-Friendly**: Perfect for teams moving from v0.x who miss tracking comments
|
||||
- **Works with Custom Prompts**: Your prompt becomes custom instructions while maintaining GitHub context
|
||||
|
||||
**Expected Output:**
|
||||
|
||||
1. Claude creates a tracking comment: "Claude Code is reviewing this pull request..."
|
||||
2. Updates the comment with progress checkboxes as it works
|
||||
3. Posts detailed review feedback with inline annotations
|
||||
4. Updates tracking comment to "Completed" when done
|
||||
|
||||
---
|
||||
|
||||
## Review Only Specific File Paths
|
||||
|
||||
**When to use:** Review PRs only when specific critical files change.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: Review Critical Files
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
paths:
|
||||
- "src/auth/**"
|
||||
- "src/api/**"
|
||||
- "config/security.yml"
|
||||
|
||||
jobs:
|
||||
security-review:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
This PR modifies critical authentication or API files.
|
||||
|
||||
Please provide a security-focused review with emphasis on:
|
||||
- Authentication and authorization flows
|
||||
- Input validation and sanitization
|
||||
- SQL injection or XSS vulnerabilities
|
||||
- API security best practices
|
||||
|
||||
Note: The PR branch is already checked out.
|
||||
|
||||
Post detailed security findings as PR comments.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- `paths:` filter triggers only for specific file changes
|
||||
- Custom prompt emphasizes security for sensitive areas
|
||||
- Useful for compliance or security reviews
|
||||
|
||||
**Expected Output:** Security-focused review when critical files are modified.
|
||||
|
||||
---
|
||||
|
||||
## Review PRs from External Contributors
|
||||
|
||||
**When to use:** Apply stricter review criteria for external or new contributors.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: External Contributor Review
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
external-review:
|
||||
if: github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
CONTRIBUTOR: ${{ github.event.pull_request.user.login }}
|
||||
|
||||
This is a first-time contribution from @${{ github.event.pull_request.user.login }}.
|
||||
|
||||
Please provide a comprehensive review focusing on:
|
||||
- Compliance with project coding standards
|
||||
- Proper test coverage (unit and integration)
|
||||
- Documentation for new features
|
||||
- Potential breaking changes
|
||||
- License header requirements
|
||||
|
||||
Be welcoming but thorough in your review. Use inline comments for code-specific feedback.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr view:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- `if:` condition targets specific contributor types
|
||||
- Includes contributor username in context
|
||||
- Emphasis on onboarding and standards
|
||||
|
||||
**Expected Output:** Detailed review helping new contributors understand project standards.
|
||||
|
||||
---
|
||||
|
||||
## Custom PR Review Checklist
|
||||
|
||||
**When to use:** Enforce specific review criteria for your team's workflow.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: PR Review Checklist
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
checklist-review:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Review this PR against our team checklist:
|
||||
|
||||
## Code Quality
|
||||
- [ ] Code follows our style guide
|
||||
- [ ] No commented-out code
|
||||
- [ ] Meaningful variable names
|
||||
- [ ] DRY principle followed
|
||||
|
||||
## Testing
|
||||
- [ ] Unit tests for new functions
|
||||
- [ ] Integration tests for new endpoints
|
||||
- [ ] Edge cases covered
|
||||
- [ ] Test coverage > 80%
|
||||
|
||||
## Documentation
|
||||
- [ ] README updated if needed
|
||||
- [ ] API docs updated
|
||||
- [ ] Inline comments for complex logic
|
||||
- [ ] CHANGELOG.md updated
|
||||
|
||||
## Security
|
||||
- [ ] No hardcoded credentials
|
||||
- [ ] Input validation implemented
|
||||
- [ ] Proper error handling
|
||||
- [ ] No sensitive data in logs
|
||||
|
||||
For each item, check if it's satisfied and comment on any that need attention.
|
||||
Post a summary comment with checklist results.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- Structured checklist in prompt
|
||||
- Systematic review approach
|
||||
- Team-specific criteria
|
||||
|
||||
**Expected Output:** Systematic review with checklist results and specific feedback.
|
||||
|
||||
---
|
||||
|
||||
## Scheduled Repository Maintenance
|
||||
|
||||
**When to use:** Regular automated maintenance tasks.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: Weekly Maintenance
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 0 * * 0" # Every Sunday at midnight
|
||||
workflow_dispatch: # Manual trigger option
|
||||
|
||||
jobs:
|
||||
maintenance:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
issues: write
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
|
||||
Perform weekly repository maintenance:
|
||||
|
||||
1. Check for outdated dependencies in package.json
|
||||
2. Scan for security vulnerabilities using `npm audit`
|
||||
3. Review open issues older than 90 days
|
||||
4. Check for TODO comments in recent commits
|
||||
5. Verify README.md examples still work
|
||||
|
||||
Create a single issue summarizing any findings.
|
||||
If critical security issues are found, also comment on open PRs.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "Read,Bash(npm:*),Bash(gh issue:*),Bash(git:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- `schedule:` for automated runs
|
||||
- `workflow_dispatch:` for manual triggering
|
||||
- Comprehensive tool permissions for analysis
|
||||
|
||||
**Expected Output:** Weekly maintenance report as GitHub issue.
|
||||
|
||||
---
|
||||
|
||||
## Issue Auto-Triage and Labeling
|
||||
|
||||
**When to use:** Automatically categorize and prioritize new issues.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: Issue Triage
|
||||
on:
|
||||
issues:
|
||||
types: [opened]
|
||||
|
||||
jobs:
|
||||
triage:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
issues: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
ISSUE NUMBER: ${{ github.event.issue.number }}
|
||||
TITLE: ${{ github.event.issue.title }}
|
||||
BODY: ${{ github.event.issue.body }}
|
||||
AUTHOR: ${{ github.event.issue.user.login }}
|
||||
|
||||
Analyze this new issue and:
|
||||
1. Determine if it's a bug report, feature request, or question
|
||||
2. Assess priority (critical, high, medium, low)
|
||||
3. Suggest appropriate labels
|
||||
4. Check if it duplicates existing issues
|
||||
|
||||
Based on your analysis, add the appropriate labels using:
|
||||
`gh issue edit [number] --add-label "label1,label2"`
|
||||
|
||||
If it appears to be a duplicate, post a comment mentioning the original issue.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "Bash(gh issue:*),Bash(gh search:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- Triggered on new issues
|
||||
- Issue context in prompt
|
||||
- Label management capabilities
|
||||
|
||||
**Expected Output:** Automatically labeled and categorized issues.
|
||||
|
||||
---
|
||||
|
||||
## Documentation Sync on API Changes
|
||||
|
||||
**When to use:** Keep docs up-to-date when API code changes.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: Sync API Documentation
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
paths:
|
||||
- "src/api/**/*.ts"
|
||||
- "src/routes/**/*.ts"
|
||||
|
||||
jobs:
|
||||
doc-sync:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ github.event.pull_request.head.ref }}
|
||||
fetch-depth: 0
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
This PR modifies API endpoints. Please:
|
||||
|
||||
1. Review the API changes in src/api and src/routes
|
||||
2. Update API.md to document any new or changed endpoints
|
||||
3. Ensure OpenAPI spec is updated if needed
|
||||
4. Update example requests/responses
|
||||
|
||||
Use standard REST API documentation format.
|
||||
Commit any documentation updates to this PR branch.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "Read,Write,Edit,Bash(git:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- Path-specific trigger
|
||||
- Write permissions for doc updates
|
||||
- Git tools for committing
|
||||
|
||||
**Expected Output:** API documentation automatically updated with code changes.
|
||||
|
||||
---
|
||||
|
||||
## Security-Focused PR Reviews
|
||||
|
||||
**When to use:** Deep security analysis for sensitive repositories.
|
||||
|
||||
**Complete Example:**
|
||||
|
||||
```yaml
|
||||
name: Security Review
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
security-events: write
|
||||
id-token: write
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# Optional: Add track_progress: true for visual progress tracking during security reviews
|
||||
# track_progress: true
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Perform a comprehensive security review:
|
||||
|
||||
## OWASP Top 10 Analysis
|
||||
- SQL Injection vulnerabilities
|
||||
- Cross-Site Scripting (XSS)
|
||||
- Broken Authentication
|
||||
- Sensitive Data Exposure
|
||||
- XML External Entities (XXE)
|
||||
- Broken Access Control
|
||||
- Security Misconfiguration
|
||||
- Cross-Site Request Forgery (CSRF)
|
||||
- Using Components with Known Vulnerabilities
|
||||
- Insufficient Logging & Monitoring
|
||||
|
||||
## Additional Security Checks
|
||||
- Hardcoded secrets or credentials
|
||||
- Insecure cryptographic practices
|
||||
- Unsafe deserialization
|
||||
- Server-Side Request Forgery (SSRF)
|
||||
- Race conditions or TOCTOU issues
|
||||
|
||||
Rate severity as: CRITICAL, HIGH, MEDIUM, LOW, or NONE.
|
||||
Post detailed findings with recommendations.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*)"
|
||||
```
|
||||
|
||||
**Key Configuration:**
|
||||
|
||||
- Security-focused prompt structure
|
||||
- OWASP alignment
|
||||
- Severity rating system
|
||||
|
||||
**Expected Output:** Detailed security analysis with prioritized findings.
|
||||
|
||||
---
|
||||
|
||||
## Tips for All Solutions
|
||||
|
||||
### Always Include GitHub Context
|
||||
|
||||
```yaml
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
[Your specific instructions]
|
||||
```
|
||||
|
||||
### Common Tool Permissions
|
||||
|
||||
- **PR Comments**: `Bash(gh pr comment:*)`
|
||||
- **Inline Comments**: `mcp__github_inline_comment__create_inline_comment`
|
||||
- **File Operations**: `Read,Write,Edit`
|
||||
- **Git Operations**: `Bash(git:*)`
|
||||
|
||||
### Best Practices
|
||||
|
||||
- Be specific in your prompts
|
||||
- Include expected output format
|
||||
- Set clear success criteria
|
||||
- Provide context about the repository
|
||||
- Use inline comments for code-specific feedback
|
||||
223
docs/usage.md
Normal file
223
docs/usage.md
Normal file
@@ -0,0 +1,223 @@
|
||||
# Usage
|
||||
|
||||
Add a workflow file to your repository (e.g., `.github/workflows/claude.yml`):
|
||||
|
||||
```yaml
|
||||
name: Claude Assistant
|
||||
on:
|
||||
issue_comment:
|
||||
types: [created]
|
||||
pull_request_review_comment:
|
||||
types: [created]
|
||||
issues:
|
||||
types: [opened, assigned, labeled]
|
||||
pull_request_review:
|
||||
types: [submitted]
|
||||
|
||||
jobs:
|
||||
claude-response:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
# Or use OAuth token instead:
|
||||
# claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
|
||||
|
||||
# Optional: provide a prompt for automation workflows
|
||||
# prompt: "Review this PR for security issues"
|
||||
|
||||
# Optional: pass advanced arguments to Claude CLI
|
||||
# claude_args: |
|
||||
# --max-turns 10
|
||||
# --model claude-4-0-sonnet-20250805
|
||||
|
||||
# Optional: add custom trigger phrase (default: @claude)
|
||||
# trigger_phrase: "/claude"
|
||||
# Optional: add assignee trigger for issues
|
||||
# assignee_trigger: "claude"
|
||||
# Optional: add label trigger for issues
|
||||
# label_trigger: "claude"
|
||||
# Optional: grant additional permissions (requires corresponding GitHub token permissions)
|
||||
# additional_permissions: |
|
||||
# actions: read
|
||||
# Optional: allow bot users to trigger the action
|
||||
# allowed_bots: "dependabot[bot],renovate[bot]"
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------------- |
|
||||
| `anthropic_api_key` | Anthropic API key (required for direct API, not needed for Bedrock/Vertex) | No\* | - |
|
||||
| `claude_code_oauth_token` | Claude Code OAuth token (alternative to anthropic_api_key) | No\* | - |
|
||||
| `prompt` | Instructions for Claude. Can be a direct prompt or custom template for automation workflows | No | - |
|
||||
| `track_progress` | Force tag mode with tracking comments. Only works with specific PR/issue events. Preserves GitHub context | No | `false` |
|
||||
| `claude_args` | Additional arguments to pass directly to Claude CLI (e.g., `--max-turns 10 --model claude-4-0-sonnet-20250805`) | No | "" |
|
||||
| `base_branch` | The base branch to use for creating new branches (e.g., 'main', 'develop') | No | - |
|
||||
| `use_sticky_comment` | Use just one comment to deliver PR comments (only applies for pull_request event workflows) | No | `false` |
|
||||
| `github_token` | GitHub token for Claude to operate with. **Only include this if you're connecting a custom GitHub app of your own!** | No | - |
|
||||
| `use_bedrock` | Use Amazon Bedrock with OIDC authentication instead of direct Anthropic API | No | `false` |
|
||||
| `use_vertex` | Use Google Vertex AI with OIDC authentication instead of direct Anthropic API | No | `false` |
|
||||
| `assignee_trigger` | The assignee username that triggers the action (e.g. @claude). Only used for issue assignment | No | - |
|
||||
| `label_trigger` | The label name that triggers the action when applied to an issue (e.g. "claude") | No | - |
|
||||
| `trigger_phrase` | The trigger phrase to look for in comments, issue/PR bodies, and issue titles | No | `@claude` |
|
||||
| `branch_prefix` | The prefix to use for Claude branches (defaults to 'claude/', use 'claude-' for dash format) | No | `claude/` |
|
||||
| `settings` | Claude Code settings as JSON string or path to settings JSON file | No | "" |
|
||||
| `additional_permissions` | Additional permissions to enable. Currently supports 'actions: read' for viewing workflow results | No | "" |
|
||||
| `experimental_allowed_domains` | Restrict network access to these domains only (newline-separated). | No | "" |
|
||||
| `use_commit_signing` | Enable commit signing using GitHub's commit signature verification. When false, Claude uses standard git commands | No | `false` |
|
||||
| `bot_id` | GitHub user ID to use for git operations (defaults to Claude's bot ID) | No | `41898282` |
|
||||
| `bot_name` | GitHub username to use for git operations (defaults to Claude's bot name) | No | `claude[bot]` |
|
||||
| `allowed_bots` | Comma-separated list of allowed bot usernames, or '\*' to allow all bots. Empty string (default) allows no bots | No | "" |
|
||||
| `allowed_non_write_users` | **⚠️ RISKY**: Comma-separated list of usernames to allow without write permissions, or '\*' for all users. Only works with `github_token` input. See [Security](./security.md) | No | "" |
|
||||
| `path_to_claude_code_executable` | Optional path to a custom Claude Code executable. Skips automatic installation. Useful for Nix, custom containers, or specialized environments | No | "" |
|
||||
| `path_to_bun_executable` | Optional path to a custom Bun executable. Skips automatic Bun installation. Useful for Nix, custom containers, or specialized environments | No | "" |
|
||||
|
||||
### Deprecated Inputs
|
||||
|
||||
These inputs are deprecated and will be removed in a future version:
|
||||
|
||||
| Input | Description | Migration Path |
|
||||
| --------------------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------- |
|
||||
| `mode` | **DEPRECATED**: Mode is now automatically detected based on workflow context | Remove this input; the action auto-detects the correct mode |
|
||||
| `direct_prompt` | **DEPRECATED**: Use `prompt` instead | Replace with `prompt` |
|
||||
| `override_prompt` | **DEPRECATED**: Use `prompt` with template variables or `claude_args` with `--system-prompt` | Use `prompt` for templates or `claude_args` for system prompts |
|
||||
| `custom_instructions` | **DEPRECATED**: Use `claude_args` with `--system-prompt` or include in `prompt` | Move instructions to `prompt` or use `claude_args` |
|
||||
| `max_turns` | **DEPRECATED**: Use `claude_args` with `--max-turns` instead | Use `claude_args: "--max-turns 5"` |
|
||||
| `model` | **DEPRECATED**: Use `claude_args` with `--model` instead | Use `claude_args: "--model claude-4-0-sonnet-20250805"` |
|
||||
| `fallback_model` | **DEPRECATED**: Use `claude_args` with fallback configuration | Configure fallback in `claude_args` or `settings` |
|
||||
| `allowed_tools` | **DEPRECATED**: Use `claude_args` with `--allowedTools` instead | Use `claude_args: "--allowedTools Edit,Read,Write"` |
|
||||
| `disallowed_tools` | **DEPRECATED**: Use `claude_args` with `--disallowedTools` instead | Use `claude_args: "--disallowedTools WebSearch"` |
|
||||
| `mcp_config` | **DEPRECATED**: Use `claude_args` with `--mcp-config` instead | Use `claude_args: "--mcp-config '{...}'"` |
|
||||
| `claude_env` | **DEPRECATED**: Use `settings` with env configuration | Configure environment in `settings` JSON |
|
||||
|
||||
\*Required when using direct Anthropic API (default and when not using Bedrock or Vertex)
|
||||
|
||||
> **Note**: This action is currently in beta. Features and APIs may change as we continue to improve the integration.
|
||||
|
||||
## Upgrading from v0.x?
|
||||
|
||||
For a comprehensive guide on migrating from v0.x to v1.0, including step-by-step instructions and examples, see our **[Migration Guide](./migration-guide.md)**.
|
||||
|
||||
### Quick Migration Examples
|
||||
|
||||
#### Interactive Workflows (with @claude mentions)
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
mode: "tag"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
custom_instructions: "Focus on security"
|
||||
max_turns: "10"
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--max-turns 10
|
||||
--system-prompt "Focus on security"
|
||||
```
|
||||
|
||||
#### Automation Workflows
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
mode: "agent"
|
||||
direct_prompt: "Update the API documentation"
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
model: "claude-4-0-sonnet-20250805"
|
||||
allowed_tools: "Edit,Read,Write"
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Update the API documentation to reflect changes in this PR
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--model claude-4-0-sonnet-20250805
|
||||
--allowedTools Edit,Read,Write
|
||||
```
|
||||
|
||||
#### Custom Templates
|
||||
|
||||
**Before (v0.x):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@beta
|
||||
with:
|
||||
override_prompt: |
|
||||
Analyze PR #$PR_NUMBER for security issues.
|
||||
Focus on: $CHANGED_FILES
|
||||
```
|
||||
|
||||
**After (v1.0):**
|
||||
|
||||
```yaml
|
||||
- uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
Analyze PR #${{ github.event.pull_request.number }} for security issues.
|
||||
Focus on the changed files in this PR.
|
||||
```
|
||||
|
||||
## Ways to Tag @claude
|
||||
|
||||
These examples show how to interact with Claude using comments in PRs and issues. By default, Claude will be triggered anytime you mention `@claude`, but you can customize the exact trigger phrase using the `trigger_phrase` input in the workflow.
|
||||
|
||||
Claude will see the full PR context, including any comments.
|
||||
|
||||
### Ask Questions
|
||||
|
||||
Add a comment to a PR or issue:
|
||||
|
||||
```
|
||||
@claude What does this function do and how could we improve it?
|
||||
```
|
||||
|
||||
Claude will analyze the code and provide a detailed explanation with suggestions.
|
||||
|
||||
### Request Fixes
|
||||
|
||||
Ask Claude to implement specific changes:
|
||||
|
||||
```
|
||||
@claude Can you add error handling to this function?
|
||||
```
|
||||
|
||||
### Code Review
|
||||
|
||||
Get a thorough review:
|
||||
|
||||
```
|
||||
@claude Please review this PR and suggest improvements
|
||||
```
|
||||
|
||||
Claude will analyze the changes and provide feedback.
|
||||
|
||||
### Fix Bugs from Screenshots
|
||||
|
||||
Upload a screenshot of a bug and ask Claude to fix it:
|
||||
|
||||
```
|
||||
@claude Here's a screenshot of a bug I'm seeing [upload screenshot]. Can you fix it?
|
||||
```
|
||||
|
||||
Claude can see and analyze images, making it easy to fix visual bugs or UI issues.
|
||||
97
examples/ci-failure-auto-fix.yml
Normal file
97
examples/ci-failure-auto-fix.yml
Normal file
@@ -0,0 +1,97 @@
|
||||
name: Auto Fix CI Failures
|
||||
|
||||
on:
|
||||
workflow_run:
|
||||
workflows: ["CI"]
|
||||
types:
|
||||
- completed
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
pull-requests: write
|
||||
actions: read
|
||||
issues: write
|
||||
id-token: write # Required for OIDC token exchange
|
||||
|
||||
jobs:
|
||||
auto-fix:
|
||||
if: |
|
||||
github.event.workflow_run.conclusion == 'failure' &&
|
||||
github.event.workflow_run.pull_requests[0] &&
|
||||
!startsWith(github.event.workflow_run.head_branch, 'claude-auto-fix-ci-')
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ github.event.workflow_run.head_branch }}
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Setup git identity
|
||||
run: |
|
||||
git config --global user.email "claude[bot]@users.noreply.github.com"
|
||||
git config --global user.name "claude[bot]"
|
||||
|
||||
- name: Create fix branch
|
||||
id: branch
|
||||
run: |
|
||||
BRANCH_NAME="claude-auto-fix-ci-${{ github.event.workflow_run.head_branch }}-${{ github.run_id }}"
|
||||
git checkout -b "$BRANCH_NAME"
|
||||
echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Get CI failure details
|
||||
id: failure_details
|
||||
uses: actions/github-script@v7
|
||||
with:
|
||||
script: |
|
||||
const run = await github.rest.actions.getWorkflowRun({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
run_id: ${{ github.event.workflow_run.id }}
|
||||
});
|
||||
|
||||
const jobs = await github.rest.actions.listJobsForWorkflowRun({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
run_id: ${{ github.event.workflow_run.id }}
|
||||
});
|
||||
|
||||
const failedJobs = jobs.data.jobs.filter(job => job.conclusion === 'failure');
|
||||
|
||||
let errorLogs = [];
|
||||
for (const job of failedJobs) {
|
||||
const logs = await github.rest.actions.downloadJobLogsForWorkflowRun({
|
||||
owner: context.repo.owner,
|
||||
repo: context.repo.repo,
|
||||
job_id: job.id
|
||||
});
|
||||
errorLogs.push({
|
||||
jobName: job.name,
|
||||
logs: logs.data
|
||||
});
|
||||
}
|
||||
|
||||
return {
|
||||
runUrl: run.data.html_url,
|
||||
failedJobs: failedJobs.map(j => j.name),
|
||||
errorLogs: errorLogs
|
||||
};
|
||||
|
||||
- name: Fix CI failures with Claude
|
||||
id: claude
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
/fix-ci
|
||||
Failed CI Run: ${{ fromJSON(steps.failure_details.outputs.result).runUrl }}
|
||||
Failed Jobs: ${{ join(fromJSON(steps.failure_details.outputs.result).failedJobs, ', ') }}
|
||||
PR Number: ${{ github.event.workflow_run.pull_requests[0].number }}
|
||||
Branch Name: ${{ steps.branch.outputs.branch_name }}
|
||||
Base Branch: ${{ github.event.workflow_run.head_branch }}
|
||||
Repository: ${{ github.repository }}
|
||||
|
||||
Error logs:
|
||||
${{ toJSON(fromJSON(steps.failure_details.outputs.result).errorLogs) }}
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: "--allowedTools 'Edit,MultiEdit,Write,Read,Glob,Grep,LS,Bash(git:*),Bash(bun:*),Bash(npm:*),Bash(npx:*),Bash(gh:*)'"
|
||||
63
examples/issue-deduplication.yml
Normal file
63
examples/issue-deduplication.yml
Normal file
@@ -0,0 +1,63 @@
|
||||
name: Issue Deduplication
|
||||
|
||||
on:
|
||||
issues:
|
||||
types: [opened]
|
||||
|
||||
jobs:
|
||||
deduplicate:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Check for duplicate issues
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
prompt: |
|
||||
Analyze this new issue and check if it's a duplicate of existing issues in the repository.
|
||||
|
||||
Issue: #${{ github.event.issue.number }}
|
||||
Repository: ${{ github.repository }}
|
||||
|
||||
Your task:
|
||||
1. Use mcp__github__get_issue to get details of the current issue (#${{ github.event.issue.number }})
|
||||
2. Search for similar existing issues using mcp__github__search_issues with relevant keywords from the issue title and body
|
||||
3. Compare the new issue with existing ones to identify potential duplicates
|
||||
|
||||
Criteria for duplicates:
|
||||
- Same bug or error being reported
|
||||
- Same feature request (even if worded differently)
|
||||
- Same question being asked
|
||||
- Issues describing the same root problem
|
||||
|
||||
If you find duplicates:
|
||||
- Add a comment on the new issue linking to the original issue(s)
|
||||
- Apply a "duplicate" label to the new issue
|
||||
- Be polite and explain why it's a duplicate
|
||||
- Suggest the user follow the original issue for updates
|
||||
|
||||
If it's NOT a duplicate:
|
||||
- Don't add any comments
|
||||
- You may apply appropriate topic labels based on the issue content
|
||||
|
||||
Use these tools:
|
||||
- mcp__github__get_issue: Get issue details
|
||||
- mcp__github__search_issues: Search for similar issues
|
||||
- mcp__github__list_issues: List recent issues if needed
|
||||
- mcp__github__create_issue_comment: Add a comment if duplicate found
|
||||
- mcp__github__update_issue: Add labels
|
||||
|
||||
Be thorough but efficient. Focus on finding true duplicates, not just similar issues.
|
||||
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github__get_issue,mcp__github__search_issues,mcp__github__list_issues,mcp__github__create_issue_comment,mcp__github__update_issue,mcp__github__get_issue_comments"
|
||||
29
examples/issue-triage.yml
Normal file
29
examples/issue-triage.yml
Normal file
@@ -0,0 +1,29 @@
|
||||
name: Claude Issue Triage
|
||||
description: Run Claude Code for issue triage in GitHub Actions
|
||||
on:
|
||||
issues:
|
||||
types: [opened]
|
||||
|
||||
jobs:
|
||||
triage-issue:
|
||||
runs-on: ubuntu-latest
|
||||
timeout-minutes: 10
|
||||
permissions:
|
||||
contents: read
|
||||
issues: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Run Claude Code for Issue Triage
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
# NOTE: /label-issue here requires a .claude/commands/label-issue.md file in your repo (see this repo's .claude directory for an example)
|
||||
prompt: "/label-issue REPO: ${{ github.repository }} ISSUE_NUMBER${{ github.event.issue.number }}"
|
||||
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
allowed_non_write_users: "*" # Required for issue triage workflow, if users without repo write access create issues
|
||||
github_token: ${{ secrets.GITHUB_TOKEN }}
|
||||
42
examples/manual-code-analysis.yml
Normal file
42
examples/manual-code-analysis.yml
Normal file
@@ -0,0 +1,42 @@
|
||||
name: Claude Commit Analysis
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
analysis_type:
|
||||
description: "Type of analysis to perform"
|
||||
required: true
|
||||
type: choice
|
||||
options:
|
||||
- summarize-commit
|
||||
- security-review
|
||||
default: "summarize-commit"
|
||||
|
||||
jobs:
|
||||
analyze-commit:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
issues: write
|
||||
id-token: write
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 2 # Need at least 2 commits to analyze the latest
|
||||
|
||||
- name: Run Claude Analysis
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
BRANCH: ${{ github.ref_name }}
|
||||
|
||||
Analyze the latest commit in this repository.
|
||||
|
||||
${{ github.event.inputs.analysis_type == 'summarize-commit' && 'Task: Provide a clear, concise summary of what changed in the latest commit. Include the commit message, files changed, and the purpose of the changes.' || '' }}
|
||||
|
||||
${{ github.event.inputs.analysis_type == 'security-review' && 'Task: Review the latest commit for potential security vulnerabilities. Check for exposed secrets, insecure coding patterns, dependency vulnerabilities, or any other security concerns. Provide specific recommendations if issues are found.' || '' }}
|
||||
74
examples/pr-review-comprehensive.yml
Normal file
74
examples/pr-review-comprehensive.yml
Normal file
@@ -0,0 +1,74 @@
|
||||
name: PR Review with Progress Tracking
|
||||
|
||||
# This example demonstrates how to use the track_progress feature to get
|
||||
# visual progress tracking for PR reviews, similar to v0.x agent mode.
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, ready_for_review, reopened]
|
||||
|
||||
jobs:
|
||||
review-with-tracking:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: write
|
||||
id-token: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: PR Review with Progress Tracking
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
|
||||
# Enable progress tracking
|
||||
track_progress: true
|
||||
|
||||
# Your custom review instructions
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Perform a comprehensive code review with the following focus areas:
|
||||
|
||||
1. **Code Quality**
|
||||
- Clean code principles and best practices
|
||||
- Proper error handling and edge cases
|
||||
- Code readability and maintainability
|
||||
|
||||
2. **Security**
|
||||
- Check for potential security vulnerabilities
|
||||
- Validate input sanitization
|
||||
- Review authentication/authorization logic
|
||||
|
||||
3. **Performance**
|
||||
- Identify potential performance bottlenecks
|
||||
- Review database queries for efficiency
|
||||
- Check for memory leaks or resource issues
|
||||
|
||||
4. **Testing**
|
||||
- Verify adequate test coverage
|
||||
- Review test quality and edge cases
|
||||
- Check for missing test scenarios
|
||||
|
||||
5. **Documentation**
|
||||
- Ensure code is properly documented
|
||||
- Verify README updates for new features
|
||||
- Check API documentation accuracy
|
||||
|
||||
Provide detailed feedback using inline comments for specific issues.
|
||||
Use top-level comments for general observations or praise.
|
||||
|
||||
# Tools for comprehensive PR review
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
|
||||
|
||||
# When track_progress is enabled:
|
||||
# - Creates a tracking comment with progress checkboxes
|
||||
# - Includes all PR context (comments, attachments, images)
|
||||
# - Updates progress as the review proceeds
|
||||
# - Marks as completed when done
|
||||
48
examples/pr-review-filtered-authors.yml
Normal file
48
examples/pr-review-filtered-authors.yml
Normal file
@@ -0,0 +1,48 @@
|
||||
name: Claude Review - Specific Authors
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
|
||||
jobs:
|
||||
review-by-author:
|
||||
# Only run for PRs from specific authors
|
||||
if: |
|
||||
github.event.pull_request.user.login == 'developer1' ||
|
||||
github.event.pull_request.user.login == 'developer2' ||
|
||||
github.event.pull_request.user.login == 'external-contributor'
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: read
|
||||
id-token: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Review PR from Specific Author
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Please provide a thorough review of this pull request.
|
||||
|
||||
Note: The PR branch is already checked out in the current working directory.
|
||||
|
||||
Since this is from a specific author that requires careful review,
|
||||
please pay extra attention to:
|
||||
- Adherence to project coding standards
|
||||
- Proper error handling
|
||||
- Security best practices
|
||||
- Test coverage
|
||||
- Documentation
|
||||
|
||||
Provide detailed feedback and suggestions for improvement.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*)"
|
||||
49
examples/pr-review-filtered-paths.yml
Normal file
49
examples/pr-review-filtered-paths.yml
Normal file
@@ -0,0 +1,49 @@
|
||||
name: Claude Review - Path Specific
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize]
|
||||
paths:
|
||||
# Only run when specific paths are modified
|
||||
- "src/**/*.js"
|
||||
- "src/**/*.ts"
|
||||
- "api/**/*.py"
|
||||
# You can add more specific patterns as needed
|
||||
|
||||
jobs:
|
||||
claude-review-paths:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
contents: read
|
||||
pull-requests: read
|
||||
id-token: write
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
fetch-depth: 1
|
||||
|
||||
- name: Claude Code Review
|
||||
uses: anthropics/claude-code-action@v1
|
||||
with:
|
||||
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
||||
prompt: |
|
||||
REPO: ${{ github.repository }}
|
||||
PR NUMBER: ${{ github.event.pull_request.number }}
|
||||
|
||||
Please review this pull request focusing on the changed files.
|
||||
|
||||
Note: The PR branch is already checked out in the current working directory.
|
||||
|
||||
Provide feedback on:
|
||||
- Code quality and adherence to best practices
|
||||
- Potential bugs or edge cases
|
||||
- Performance considerations
|
||||
- Security implications
|
||||
- Suggestions for improvement
|
||||
|
||||
Since this PR touches critical source code paths, please be thorough
|
||||
in your review and provide inline comments where appropriate.
|
||||
|
||||
claude_args: |
|
||||
--allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*)"
|
||||
Reference in New Issue
Block a user