Add Claude Code GitHub Workflow by heyitsaamir · Pull Request #431 · microsoft/teams.ts

heyitsaamir · 2026-01-08T21:24:12Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate Anthropic Claude Code into the repo, enabling (1) on-demand runs when @claude is mentioned and (2) automatic PR code review runs.

Changes:

Added a workflow to run Claude Code when @claude appears in issue/PR comments, reviews, or issue text.
Added a workflow to run a Claude “code review” plugin automatically on PR lifecycle events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/claude.yml	New workflow that triggers Claude Code runs based on `@claude` mentions in issues/PR comments/reviews.
.github/workflows/claude-code-review.yml	New workflow that runs an automated Claude-based code review plugin on PR events.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-12T17:46:42Z

.github/workflows/claude.yml

+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write


The workflow permissions are read-only (issues: read, pull-requests: read, contents: read), but the PR description says Claude will be able to respond to mentions and create comments/branches/commits. If the action is expected to post back to PRs/issues (and especially to push branches/commits), the job needs the corresponding issues: write / pull-requests: write (and possibly contents: write) permissions; otherwise it will be unable to perform those operations with GITHUB_TOKEN.

Copilot · 2026-03-12T17:46:43Z

.github/workflows/claude.yml

+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1


For supply-chain hardening, consider pinning third-party actions (notably anthropics/claude-code-action) to a commit SHA instead of a mutable tag like @v1. This reduces the risk of upstream tag retargeting impacting your workflow.

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@<COMMIT-SHA>

Copilot · 2026-03-12T17:46:43Z

.github/workflows/claude-code-review.yml

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This workflow runs on every PR open/sync/reopen. For PRs coming from forks, secrets.ANTHROPIC_API_KEY won’t be available, so the job will fail/no-op and still consume CI capacity. Consider gating the job to same-repo PRs (e.g., github.event.pull_request.head.repo.full_name == github.repository) and/or skipping when the API key secret isn’t present.

Copilot · 2026-03-12T17:46:44Z

.github/workflows/claude-code-review.yml

+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write


The job permissions are read-only, which means the default GITHUB_TOKEN cannot publish a PR review/comment. If the intent is for the code-review plugin to leave feedback on the PR (as opposed to only emitting logs), it will need pull-requests: write (and potentially issues: write) permissions.

Copilot · 2026-03-12T17:46:44Z

.github/workflows/claude-code-review.yml

+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1


For supply-chain hardening, consider pinning anthropics/claude-code-action@v1 to a specific commit SHA. This avoids unexpected behavior changes if the upstream tag is moved.

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@0123456789abcdef0123456789abcdef01234567

Copilot · 2026-03-12T17:46:44Z

.github/workflows/claude.yml

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The job can be triggered by any user who can open an issue or post a comment containing @claude. Since this workflow uses a paid secret (ANTHROPIC_API_KEY) and provides the model repo/issue context, it should be gated by the author’s trust level (e.g., author_association in OWNER|MEMBER|COLLABORATOR, or a specific allowlist) to prevent untrusted users from triggering runs.

Suggested change

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

(

github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

(

github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR'

)

) ||

(

github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

(

github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR'

)

) ||

(

github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

(

github.event.review.author_association == 'OWNER' ||

github.event.review.author_association == 'MEMBER' ||

github.event.review.author_association == 'COLLABORATOR'

)

) ||

(

github.event_name == 'issues' &&

(

contains(github.event.issue.body, '@claude') ||

contains(github.event.issue.title, '@claude')

) &&

(

github.event.issue.author_association == 'OWNER' ||

github.event.issue.author_association == 'MEMBER' ||

github.event.issue.author_association == 'COLLABORATOR'

)

)

heyitsaamir added 2 commits January 8, 2026 13:19

"Claude PR Assistant workflow"

48d162f

"Claude Code Review workflow"

84d86b2

corinagum requested a review from Copilot March 12, 2026 17:43

Copilot started reviewing on behalf of corinagum March 12, 2026 17:44 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add Claude Code GitHub Workflow#431

Add Claude Code GitHub Workflow#431
heyitsaamir wants to merge 2 commits intomainfrom
add-claude-github-actions-1767907149219

heyitsaamir commented Jan 8, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: anthropics/claude-code-action@v1
	uses: anthropics/claude-code-action@<COMMIT-SHA>

	uses: anthropics/claude-code-action@v1
	uses: anthropics/claude-code-action@0123456789abcdef0123456789abcdef01234567

-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      (
+        github.event_name == 'issue_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        (
+          github.event.comment.author_association == 'OWNER' ||
+          github.event.comment.author_association == 'MEMBER' ||
+          github.event.comment.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'pull_request_review_comment' &&
+        contains(github.event.comment.body, '@claude') &&
+        (
+          github.event.comment.author_association == 'OWNER' ||
+          github.event.comment.author_association == 'MEMBER' ||
+          github.event.comment.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'pull_request_review' &&
+        contains(github.event.review.body, '@claude') &&
+        (
+          github.event.review.author_association == 'OWNER' ||
+          github.event.review.author_association == 'MEMBER' ||
+          github.event.review.author_association == 'COLLABORATOR'
+        )
+      ) ||
+      (
+        github.event_name == 'issues' &&
+        (
+          contains(github.event.issue.body, '@claude') ||
+          contains(github.event.issue.title, '@claude')
+        ) &&
+        (
+          github.event.issue.author_association == 'OWNER' ||
+          github.event.issue.author_association == 'MEMBER' ||
+          github.event.issue.author_association == 'COLLABORATOR'
+        )
+      )

Conversation

heyitsaamir commented Jan 8, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants