Add Claude Code GitHub Workflow by palango · Pull Request #453 · celo-org/op-geth

palango · 2026-01-09T13:49:46Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

karlb · 2026-01-09T13:58:33Z

.github/workflows/claude.yml

+          # Optional: Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          # claude_args: '--allowed-tools Bash(gh pr:*)'


If we want to use claude for changes, we should probably allow

"Bash(go test:*)" "Bash(go fmt:*)" "Bash(make lint)"

for a working feedback loop.

I added some, feel free to add more.

karlb

Not sure if my thoughts are correct here and what you used as a starting point for these workflows. I haven't configured something like this before.

karlb · 2026-01-09T15:16:13Z

.github/workflows/claude.yml

+      contents: read
+      pull-requests: read


What is the expected result of Claude's action? I would expect at least one write here, so that it can either push a commit or add a PR comment.

karlb · 2026-01-09T15:18:47Z

.github/workflows/claude.yml

+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1


Suggested change

fetch-depth: 1

fetch-depth: 10

Increasing the number a bit does not cost much but allows us to refer to recent commits and allows Claude to get a bit more context.

karlb · 2026-01-09T15:21:04Z

.github/workflows/claude.yml

+          # Add claude_args to customize behavior and configuration
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
+          # or https://code.claude.com/docs/en/cli-reference for available options
+          claude_args: "--allowed-tools Bash(gh pr:*) Bash(go test:*) Bash(go fmt:*) Bash(make test) Bash(make all) Bash(make geth)"


I think this is missing quotes for proper escaping unless we use the allowed_tools key.

Suggested change

claude_args: "--allowed-tools Bash(gh pr:*) Bash(go test:*) Bash(go fmt:*) Bash(make test) Bash(make all) Bash(make geth)"

allowed_tools: |

Bash(gh pr:*)

Bash(go test:*)

Bash(go fmt:*)

Bash(make test)

Bash(make all)

Bash(make geth)

karlb · 2026-01-09T15:22:55Z

.github/workflows/claude-code-review.yml

+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read


I don't think Claude can leave a PR comment unless we add write permissions here.

karlb · 2026-01-09T15:25:34Z

.github/workflows/claude-code-review.yml

+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1


I assume we'll get better results if this is large enough to include all PR commits. Reviewing the separate commits including their commit messages is relevant for some PRs. This should be enough for most cases:

Suggested change

fetch-depth: 1

fetch-depth: 20

palango · 2026-01-09T15:30:05Z

Not sure if my thoughts are correct here and what you used as a starting point for these workflows. I haven't configured something like this before.

I used /install-github-app, so I hope the config makes sense. I'll check you comments next week.

…60763

jcortejoso · 2026-03-05T09:11:23Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ad9e6836d4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-03-05T09:14:20Z

.github/workflows/claude.yml

+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


Restrict Claude invocations to trusted users

The job-level if only checks for @claude text and never checks author_association, so any public user who can open an issue or comment can trigger runs that consume secrets.ANTHROPIC_API_KEY. On a public repo this enables untrusted users to spend API budget and drive automated actions; add a trust gate (for example OWNER/MEMBER/COLLABORATOR) alongside the mention checks.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-03-05T09:14:20Z

.github/workflows/claude-code-review.yml

+        id: claude-review
+        uses: anthropics/claude-code-action@v1
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}


Guard review workflow when Anthropic secret is unavailable

This workflow always passes secrets.ANTHROPIC_API_KEY, but pull_request runs from forked repositories do not receive repository secrets, so external contributor PRs will execute this job with an empty key and the Claude step will fail. Add a condition to skip when the secret is missing (or use a fork-safe trigger strategy) to avoid persistent failed checks on fork PRs.

Useful? React with 👍 / 👎.

alvarof2 · 2026-03-05T09:49:37Z

@codex review

chatgpt-codex-connector · 2026-03-05T09:52:40Z

💡 Codex Review

op-geth/.github/workflows/claude.yml

Lines 16 to 19 in ad9e683

    
                 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || 
        
                 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || 
        
                 (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || 
        
                 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

Restrict @claude triggers to trusted users

This condition only checks for @claude text and does not gate on github.actor or author_association, so any external user can open an issue/comment containing @claude and trigger a run that uses secrets.ANTHROPIC_API_KEY. In a public repo this allows untrusted users to repeatedly consume paid API calls (and invoke automation) even though the workflow is intended to be triggerable only by trusted collaborators.

op-geth/.github/workflows/claude-code-review.yml

Lines 4 to 5 in ad9e683

    
           pull_request: 
        
             types: [opened, synchronize, ready_for_review, reopened]

Skip fork PR events when requiring repository secrets

The workflow runs on all pull_request opens/syncs, but it always requires secrets.ANTHROPIC_API_KEY; for PRs coming from forks, GitHub does not provide repository secrets to pull_request workflows, so this job will fail/no-op for external contributors and can create persistent noisy failures if the check is enabled. Add a fork guard (or use a safe pull_request_target pattern) before invoking the action.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

palango added 2 commits January 9, 2026 14:49

"Claude PR Assistant workflow"

d32bf2c

"Claude Code Review workflow"

6b2500c

palango requested a review from karlb January 9, 2026 13:49

palango marked this pull request as ready for review January 9, 2026 13:56

karlb reviewed Jan 9, 2026

View reviewed changes

Add allowed commands for Claude

fc7b563

karlb reviewed Jan 9, 2026

View reviewed changes

palango mentioned this pull request Jan 12, 2026

Remove alfajores and baklava testnet code #451

Merged

Merge branch 'celo-rebase-15' into add-claude-github-actions-17679665…

ad9e683

…60763

chatgpt-codex-connector bot reviewed Mar 5, 2026

View reviewed changes

Conversation

palango commented Jan 9, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

karlb Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

palango Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

karlb left a comment

Choose a reason for hiding this comment

Uh oh!

karlb Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

karlb Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

karlb Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

karlb Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

karlb Jan 9, 2026

Choose a reason for hiding this comment

Uh oh!

palango commented Jan 9, 2026

Uh oh!

jcortejoso commented Mar 5, 2026

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector bot Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

alvarof2 commented Mar 5, 2026

Uh oh!

chatgpt-codex-connector bot commented Mar 5, 2026

💡 Codex Review

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants