workflow-claude-actions

/workflow-claude-actions - Claude Code GitHub Actions on the newest Opus

This builds on Claude Code's built-in /install-github-app. The result is two workflows:

• a review workflow that runs the code-review plugin on every PR and posts its findings as inline comments;
• a mention workflow that answers @claude in issues, PR comments and reviews.

Both pass --model opus. The alias resolves to the newest Opus that the action's bundled Claude Code knows about, and anthropics/claude-code-action@v1 is a floating tag, so new Opus releases are picked up without editing the files. Pinning the action to a SHA or exact version, or setting ANTHROPIC_MODEL or ANTHROPIC_DEFAULT_OPUS_MODEL, stops that.

The bundled workflows are in ${CLAUDE_SKILL_DIR}/assets/: claude-code-review.yml and claude.yml.

This skill may create one branch, change workflow files under .github/workflows/, push the branch and open one PR, and it does that only after the user approves the diff in step 3. It never merges, never changes other files, and never changes repo settings or secrets. The user sets any secret themselves.

1. Look at the repo

1. gh repo view --json nameWithOwner,defaultBranchRef,viewerPermission,isPrivate.

2. git status --porcelain must be empty. If it isn't, stop and ask the user to commit or stash first. Record the current branch so you can switch back at the end.

3. Base branch: if the repo's CLAUDE.md names an integration branch that work lands on, or recent PRs into the default branch come from a staging (or develop) branch, target that branch. Otherwise target the default branch.

4. Existing workflows: find the Claude workflows on the base branch by content, not filename:

   git fetch origin <base>
   git grep -l "anthropics/claude-code-action" "origin/<base>" -- .github/workflows
   

   • A file that triggers on pull_request (or pull_request_target) and reviews PRs is a review workflow.
   • A file that triggers on issue_comment, pull_request_review_comment, pull_request_review or issues and checks for @claude is a mention workflow.
   • One file can be both. It counts as both, so don't copy the other bundled file.
   • Other Claude workflows (issue triage, CI fixes, scheduled jobs) are out of scope. Leave them alone, and mention them in the report.

5. For each review or mention workflow, look at every step that uses the action (a file can have several jobs or steps) and note:

   • The action ref. @v1 floats. A SHA or an exact version such as @v1.0.12 is pinned.
   • Pre-v1. @beta, @v0 or any v0.x ref, or pre-v1 inputs (direct_prompt, override_prompt, model, allowed_tools, disallowed_tools, custom_instructions, mode, max_turns, claude_env, mcp_config, timeout_minutes) mean the old action, which has no claude_args input.
   • The auth setup. claude_code_oauth_token, anthropic_api_key, or another setup: use_bedrock, use_vertex, use_foundry, or anthropic_federation_rule_id (workload identity federation). The other setups also rely on env vars or credential steps.
   • The model. claude_args and any --model (or --model=) in it, and any ANTHROPIC_MODEL or ANTHROPIC_DEFAULT_OPUS_MODEL in the step's, job's or workflow's env:. ANTHROPIC_MODEL overrides --model.
   • For the review workflow, whether it posts to the PR. It does if it has --comment in a /code-review prompt, the mcp__github_inline_comment__create_inline_comment tool, or a custom prompt that comments with gh pr comment.
   • For the review workflow on a public repo, whether it skips fork PRs and bot PRs. Fork PRs get no OIDC token or secrets, and the action refuses PRs from bots such as Dependabot, so without a guard those PRs get a red check.
   • Its state in gh workflow list --all --json path,state.

6. Claude GitHub App: a user token can't see whether the app is installed. A recent comment or review by claude[bot] in the repo proves it is: