ci: rewrite issue triage workflow #31369
Conversation
WalkthroughReplaces the single Sequence DiagramsequenceDiagram
actor GH as GitHub Actions
participant WF as Workflow
participant Checkout as actions/checkout
participant Node as actions/setup-node
participant NPM as npm (install claude-code-cli)
participant PromptFile as /tmp/prompt.txt
participant GHCLI as gh CLI (auth)
participant CLAUDE as claude-code CLI
rect rgb(245,245,245)
Note over WF: Old flow (single action)
GH->>WF: trigger workflow
WF->>CLAUDE: claude-code-action@v1 (inline prompt)
CLAUDE->>CLAUDE: execute triage
end
rect rgb(235,245,235)
Note over WF: New flow (multi-step pipeline)
GH->>WF: trigger workflow
WF->>Checkout: checkout repository
WF->>Node: setup Node.js
WF->>NPM: npm install `@anthropic/claude-code-cli`
WF->>PromptFile: write /tmp/prompt.txt (issue + instructions)
WF->>GHCLI: configure/auth gh CLI
PromptFile-->>CLAUDE: provide prompt file
WF->>CLAUDE: run claude-code CLI with prompt file
CLAUDE->>CLAUDE: execute triage
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20–30 minutes
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro 📒 Files selected for processing (1)
🔇 Additional comments (1)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/issue_triage.yml (1)
33-39: Simplify GitHub CLI setup.The GitHub CLI is pre-installed on
ubuntu-latestrunners. The fallback installation is good for resilience, but the inline shell script is verbose. Consider using the officialcli/cliaction or a simpler approach if the fallback is truly necessary.If you want to keep the fallback logic, consider extracting it into a separate script or using a cleaner conditional:
- - name: Setup GitHub CLI - run: | - gh --version || (curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \ - && sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \ - && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \ - && sudo apt update \ - && sudo apt install gh -y) + - name: Setup GitHub CLI + run: | + command -v gh >/dev/null 2>&1 || ( + curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \ + sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \ + echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \ + sudo apt update && \ + sudo apt install -y gh + )
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/issue_triage.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (9)
- GitHub Check: test debug linux-x86_64
- GitHub Check: test debug linux-aarch64
- GitHub Check: test debug windows-x86_64
- GitHub Check: test debug macos-aarch64
- GitHub Check: test debug macos-x86_64
- GitHub Check: lint debug linux-x86_64
- GitHub Check: lint debug windows-x86_64
- GitHub Check: lint debug macos-x86_64
- GitHub Check: build libs
🔇 Additional comments (3)
.github/workflows/issue_triage.yml (3)
22-102: Overall workflow structure looks reasonable.The refactoring from
claude-code-actionto direct CLI invocation is clean and gives better control over environment setup, tool restrictions, and prompt management. Once theformat()syntax issue is fixed, the workflow should execute properly.
99-102: --allowedTools syntax is correct.The syntax
"Bash(gh issue:*),Bash(gh search:*)"is valid—comma-separated scoped patterns with wildcards inside parentheses are supported. No changes needed.
47-49: Fix invalid GitHub Actions expression syntax on the prompt file creation.Line 47 uses
format('TITLE: {0}\nBODY: {1}...', ...), but GitHub Actions does not provide aformat()function. This will cause a syntax error when the workflow is parsed. Use standard GitHub Actions conditional syntax instead.Apply this diff to fix the conditional logic:
- ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: {0} - BODY: {1} - AUTHOR: {2}', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }} + ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: %s\nBODY: %s\nAUTHOR: %s', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }}Actually, if
format()is not available, rewrite the conditional block to handle both cases separately:- ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: {0} - BODY: {1} - AUTHOR: {2}', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }} + ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || 'TITLE: ' + github.event.issue.title + '\nBODY: ' + github.event.issue.body + '\nAUTHOR: ' + github.event.issue.user.login }}Likely an incorrect or invalid review comment.
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (2)
.github/workflows/issue_triage.yml (2)
32-38: Simplify GitHub CLI setup.The
ubuntu-latestrunner includes GitHub CLI pre-installed. The verbose conditional setup with apt installation is unnecessary and adds complexity. Either remove this step entirely or use the officialcli/gh-actions/setup-ghaction for consistency with GitHub's recommendations.- name: Setup GitHub CLI - run: | - gh --version || (curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \ - && sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg \ - && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \ - && sudo apt update \ - && sudo apt install gh -y) + run: gh --versionOr simply remove the step if
ghis guaranteed to be available onubuntu-latest.
29-30: Add error handling for Claude CLI installation.If the npm installation fails, the workflow continues to the next step without stopping. Consider adding explicit error handling or using
set -ein the run script to fail fast.- name: Install Claude Code CLI - run: npm install -g @anthropic-ai/claude-code + run: | + set -e + npm install -g @anthropic-ai/claude-code
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/issue_triage.yml(1 hunks)
🧰 Additional context used
🪛 actionlint (1.7.8)
.github/workflows/issue_triage.yml
43-43: "github.event.issue.title" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details
(expression)
43-43: "github.event.issue.body" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details
(expression)
🔇 Additional comments (2)
.github/workflows/issue_triage.yml (2)
92-101: Verify secret availability and add explicit error handling.The workflow references
secrets.DENOBOT_PATfor bothGITHUB_TOKENandGH_TOKEN, but there's no check to ensure it's available. Add safeguards or document the requirement clearly.Confirm that
DENOBOT_PATis defined in the repository secrets and consider adding a pre-flight check:- name: Run Claude Code Triage env: ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} GITHUB_TOKEN: ${{ secrets.DENOBOT_PAT }} GH_TOKEN: ${{ secrets.DENOBOT_PAT }} + REQUIRED_SECRETS: ${{ secrets.ANTHROPIC_API_KEY != '' && secrets.DENOBOT_PAT != '' && 'true' || 'false' }} run: | + if [ "$REQUIRED_SECRETS" != "true" ]; then + echo "Error: Required secrets (ANTHROPIC_API_KEY, DENOBOT_PAT) are not configured" + exit 1 + fi claude-code \ --mode auto \ --allowedTools "Bash(gh issue:*),Bash(gh search:*)" \ --prompt "$(cat /tmp/prompt.txt)"
46-48: Invalid GitHub Actions expression syntax.Line 46 uses
format()which does not exist in GitHub Actions expression syntax. This will cause the workflow to fail at runtime. Use conditional expressions with string concatenation instead.- ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: {0} - BODY: {1} - AUTHOR: {2}', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }} + ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: %s\nBODY: %s\nAUTHOR: %s', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }}Actually, GitHub Actions expressions don't support
format(). Rewrite this using only conditional logic:- ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: {0} - BODY: {1} - AUTHOR: {2}', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }} + ${{ github.event_name == 'workflow_dispatch' && 'This workflow was manually triggered to triage an existing issue. First, fetch the issue details using: `gh issue view [ISSUE_NUMBER] --repo denoland/deno --json number,title,body,author`' || format('TITLE: %s\nBODY: %s\nAUTHOR: %s', github.event.issue.title, github.event.issue.body, github.event.issue.user.login) }}For workflows, you'll need to pass the issue details via separate environment variables and then reference them in the prompt. See the next comment for the proper approach.
Likely an incorrect or invalid review comment.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/issue_triage.yml (1)
32-38: GitHub CLI setup is defensive but potentially redundant.Since
ghis already pre-installed onubuntu-latest, the setup script will succeed on the first check in most cases. However, the defensive fallback installation is reasonable for portability. Consider optimizing by caching or early-exit ifghis already available, though this is not critical since the check itself is fast.If you want to optimize, you could write it as:
- name: Setup GitHub CLI - run: | - gh --version || (curl -fsSL ... && sudo apt install gh -y) + run: gh --version && echo "GitHub CLI already installed" || (echo "Installing GitHub CLI..." && curl -fsSL ... && sudo apt install gh -y)Or simply trust the pre-installed version and remove this step entirely.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/issue_triage.yml(1 hunks)
🔇 Additional comments (3)
.github/workflows/issue_triage.yml (3)
40-62: Proper handling of untrusted context values with environment variables.The refactored code correctly addresses the prior security concern by moving
github.event.issuefields into environment variables (lines 43-45) before using them in the script. The conditional logic properly handles both automatic (webhook) and manual triggers—using env vars only when they're populated, and instructing Claude to fetch details for manual runs.The quoted heredocs and env var references maintain data integrity and follow GitHub Actions security best practices.
108-116: Good security posture on Claude invocation.The restricted
--allowedToolsconstrains Claude to onlygh issueandgh searchcommands, which is appropriate for the triage task. Secrets are properly passed through environment variables, and the prompt file is cleanly injected via command substitution.
29-30: No issues found. The package@anthropic-ai/claude-codeis the official Anthropic package and correctly provides theclaudecommand used in the workflow.
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/issue_triage.yml (1)
32-38: Consider simplifying the GitHub CLI setup.GitHub CLI is pre-installed on
ubuntu-latest, so the defensive installation logic here is not strictly necessary. You can simplify this to just verify it exists or trust the default setup. That said, the current approach is safe and self-healing if the environment changes.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/issue_triage.yml(1 hunks)
🔇 Additional comments (3)
.github/workflows/issue_triage.yml (3)
40-62: Good security improvements on context variable handling.The environment variables approach correctly addresses the previous security concern. Untrusted context values (
github.event.issue.*) are now passed through theenv:block and referenced as shell variables, preventing potential injection issues. The quoted heredoc syntax further hardens this against unintended expansion.
108-115: The Claude Code CLI invocation syntax is correct.The
--allowedToolssyntax used in the workflow are valid. The--allowedToolsflag accepts a comma-separated string with tool patterns likeBash(gh issue:*)andBash(gh search:*), which matches your implementation exactly.
29-30: No changes needed—Claude Code CLI package and command are correct.The web search confirms the package name
@anthropic-ai/claude-codeis correct (the AI summary was inaccurate). Theclaudecommand is the proper entry point, so the invocation at line 114 will work as expected.
1 participant
Removed usage of
claude-code-actionand instead install claude directly.