Skip to content

Commit f43bd34

Browse files
justin808claude
justin808
and
claude
committed
Add workflow-level permissions for Claude Code actions
The Claude Code GitHub Action requires id-token: write permission to authenticate via OIDC. While the permissions were set at the job level, GitHub Actions requires them at the workflow level for proper OIDC token generation. This commit adds workflow-level permissions to both claude.yml and claude-code-review.yml to fix the OIDC authentication error: "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable" 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent 83ec927 commit f43bd34

File tree

4 files changed

+184
-0
lines changed

4 files changed

+184
-0
lines changed

‎.github/FUNDING.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
github: [shakacode]

‎.github/workflows/claude-code-review.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Claude Code Review
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize]
6+
# Optional: Only run on specific file changes
7+
# paths:
8+
# - "src/**/*.ts"
9+
# - "src/**/*.tsx"
10+
# - "src/**/*.js"
11+
# - "src/**/*.jsx"
12+
13+
permissions:
14+
contents: read
15+
pull-requests: read
16+
issues: read
17+
id-token: write
18+
19+
jobs:
20+
claude-review:
21+
# Optional: Filter by PR author
22+
# if: |
23+
# github.event.pull_request.user.login == 'external-contributor' ||
24+
# github.event.pull_request.user.login == 'new-developer' ||
25+
# github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
26+
27+
runs-on: ubuntu-latest
28+
permissions:
29+
contents: read
30+
pull-requests: read
31+
issues: read
32+
id-token: write
33+
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 1
39+
40+
- name: Run Claude Code Review
41+
id: claude-review
42+
uses: anthropics/claude-code-action@v1
43+
with:
44+
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
45+
prompt: |
46+
REPO: ${{ github.repository }}
47+
PR NUMBER: ${{ github.event.pull_request.number }}
48+
49+
Please review this pull request and provide feedback on:
50+
- Code quality and best practices
51+
- Potential bugs or issues
52+
- Performance considerations
53+
- Security concerns
54+
- Test coverage
55+
56+
Use the repository's CLAUDE.md for guidance on style and conventions. Be constructive and helpful in your feedback.
57+
58+
Use `gh pr comment` with your Bash tool to leave your review as a comment on the PR.
59+
60+
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
61+
# or https://docs.claude.com/en/docs/claude-code/sdk#command-line for available options
62+
claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'
63+

‎.github/workflows/claude.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Claude Code
2+
3+
on:
4+
issue_comment:
5+
types: [created]
6+
pull_request_review_comment:
7+
types: [created]
8+
issues:
9+
types: [opened, assigned]
10+
pull_request_review:
11+
types: [submitted]
12+
13+
permissions:
14+
contents: read
15+
pull-requests: read
16+
issues: read
17+
id-token: write
18+
actions: read
19+
20+
jobs:
21+
claude:
22+
if: |
23+
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
24+
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
25+
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
26+
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
27+
runs-on: ubuntu-latest
28+
permissions:
29+
contents: read
30+
pull-requests: read
31+
issues: read
32+
id-token: write
33+
actions: read # Required for Claude to read CI results on PRs
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 1
39+
40+
- name: Run Claude Code
41+
id: claude
42+
uses: anthropics/claude-code-action@v1
43+
with:
44+
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
45+
46+
# This is an optional setting that allows Claude to read CI results on PRs
47+
additional_permissions: |
48+
actions: read
49+
50+
# Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it.
51+
# prompt: 'Update the pull request description to include a summary of changes.'
52+
53+
# Optional: Add claude_args to customize behavior and configuration
54+
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
55+
# or https://docs.claude.com/en/docs/claude-code/sdk#command-line for available options
56+
# claude_args: '--model claude-opus-4-1-20250805 --allowed-tools Bash(gh pr:*)'
57+

‎.github/workflows/ruby.yml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
name: Ruby
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
9+
jobs:
10+
rails_6_1:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
- uses: actions/checkout@v4
15+
- name: Set up Ruby
16+
uses: ruby/setup-ruby@v1
17+
with:
18+
ruby-version: 2.7.6
19+
bundler-cache: true
20+
- name: Run tests
21+
run: bundle exec rake
22+
- name: Run interaction tests
23+
run: ./specs_e2e/rails_6_1/test.sh
24+
env:
25+
CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
26+
27+
rails_7_2:
28+
runs-on: ubuntu-latest
29+
30+
steps:
31+
- uses: actions/checkout@v4
32+
- name: Set up Ruby
33+
uses: ruby/setup-ruby@v1
34+
with:
35+
ruby-version: 3.1.3
36+
bundler-cache: true
37+
- name: Run tests
38+
run: bundle exec rake
39+
- run: gem uninstall -v '>= 2' -ax bundler || true
40+
- run: gem install bundler -v '< 2'
41+
- name: Run interaction tests
42+
run: ./specs_e2e/rails_7_2/test.sh
43+
env:
44+
CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}
45+
46+
rails_8:
47+
runs-on: ubuntu-latest
48+
49+
steps:
50+
- uses: actions/checkout@v4
51+
- name: Set up Ruby
52+
uses: ruby/setup-ruby@v1
53+
with:
54+
ruby-version: 3.2.2
55+
bundler-cache: true
56+
- name: Run tests
57+
run: bundle exec rake
58+
- run: gem uninstall -v '>= 2' -ax bundler || true
59+
- run: gem install bundler -v '< 2'
60+
- name: Run interaction tests
61+
run: ./specs_e2e/rails_8/test.sh
62+
env:
63+
CYPRESS_RECORD_KEY: ${{ secrets.CYPRESS_RECORD_KEY }}

0 commit comments

Comments
 (0)