Add Claude Code GitHub Workflow by imsyy · Pull Request #6 · SPlayer-Dev/SPlayer-Next

imsyy · 2026-04-16T13:33:49Z

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

Bug fixes and improvements
Documentation updates
Implementing new features
Code reviews and suggestions
Writing tests
And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

This workflow won't take effect until this PR is merged
@claude mentions won't work until after the merge is complete
The workflow runs automatically whenever Claude is mentioned in PR or issue comments
Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

Our Anthropic API key is securely stored as a GitHub Actions secret
Only users with write access to the repository can trigger the workflow
All Claude runs are stored in the GitHub Actions run history
Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

Copilot

Pull request overview

Adds GitHub Actions workflows to integrate Anthropic Claude Code into the repository, enabling automated agent runs based on PR/issue activity.

Changes:

Add an “@claude”-triggered workflow for issue/PR comments and reviews.
Add an automatic PR workflow to run a Claude Code review plugin on PR events.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
.github/workflows/claude.yml	Introduces the comment/review/issue-event triggered Claude Code workflow.
.github/workflows/claude-code-review.yml	Introduces an always-on Claude-based PR review workflow triggered on PR lifecycle events.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-16T13:37:50Z

+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))


The workflow can be triggered by any user who can create an issue/comment/review containing “@claude”. Because this job uses a repo secret (CLAUDE_CODE_OAUTH_TOKEN), this effectively allows untrusted users (e.g., first-time issue creators or fork PR authors) to trigger secret-backed runs. Add an explicit trust gate (e.g., restrict to OWNER/MEMBER/COLLABORATOR author_association, or check repo write permissions via the GitHub API) and consider dropping the issues trigger (opened/assigned) entirely to avoid secret exposure from issue titles/bodies.

Suggested change

issues:

types: [opened, assigned]

pull_request_review:

types: [submitted]

jobs:

claude:

if: |

(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||

(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||

(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

pull_request_review:

types: [submitted]

jobs:

claude:

if: |

(github.event_name == 'issue_comment' &&

contains(github.event.comment.body, '@claude') &&

(github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR')) ||

(github.event_name == 'pull_request_review_comment' &&

contains(github.event.comment.body, '@claude') &&

(github.event.comment.author_association == 'OWNER' ||

github.event.comment.author_association == 'MEMBER' ||

github.event.comment.author_association == 'COLLABORATOR')) ||

(github.event_name == 'pull_request_review' &&

contains(github.event.review.body, '@claude') &&

(github.event.review.author_association == 'OWNER' ||

github.event.review.author_association == 'MEMBER' ||

github.event.review.author_association == 'COLLABORATOR'))

Copilot · 2026-04-16T13:37:50Z

+      pull-requests: read
+      issues: read


Job-level permissions are read-only for issues and pull-requests, so this workflow will not be able to post PR/issue comments or apply changes using the default GITHUB_TOKEN. Either update the permissions to the minimum required write scopes for the intended behavior (commenting/committing), or clarify in the workflow/PR description that this is intended to be read-only analysis.

Suggested change

pull-requests: read

issues: read

pull-requests: write

issues: write

Copilot · 2026-04-16T13:37:50Z

+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]


The PR description says the workflow is triggered by mentioning @claude in a PR/issue comment, but this workflow also triggers on issues events (opened/assigned) if the issue title/body contains @claude. If that’s not intended, remove the issues trigger; if it is intended, please update the PR description/security notes accordingly since it changes who/what can initiate a run.

Copilot · 2026-04-16T13:37:51Z

+on:
+  pull_request:
+    types: [opened, synchronize, ready_for_review, reopened]
+    # Optional: Only run on specific file changes


This workflow runs automatically on every PR open/sync/reopen/ready_for_review, which is broader than the PR description (which describes opt-in execution via “@claude” mentions). If this should be opt-in (to control cost/noise), add an if: gate (label/author association), or narrow triggers/paths; otherwise update the PR description to reflect the always-on review behavior.

Copilot · 2026-04-16T13:37:51Z

+
+      - name: Run Claude Code Review
+        id: claude-review
+        uses: anthropics/claude-code-action@v1


Both workflows reference anthropics/claude-code-action@v1 (a moving tag). For a third-party action that will run with secrets available, pin to a specific commit SHA (or a version tag plus @<sha> pattern) to reduce supply-chain risk from upstream tag changes.

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@0123456789abcdef0123456789abcdef01234567

Copilot · 2026-04-16T13:37:51Z

+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1


This workflow also uses a moving tag (anthropics/claude-code-action@v1). Since it may run with secrets available, consider pinning to a commit SHA to mitigate supply-chain risk from upstream tag retargeting.

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@<FULL_LENGTH_COMMIT_SHA> # pin to the reviewed v1 revision

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…ctions-1776346331261 Add Claude Code GitHub Workflow

imsyy added 2 commits April 16, 2026 21:32

"Claude PR Assistant workflow"

c203d57

"Claude Code Review workflow"

74d59d7

Copilot AI review requested due to automatic review settings April 16, 2026 13:33

Copilot started reviewing on behalf of imsyy April 16, 2026 13:34

View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

chore: 为 Claude workflow 添加中文回答提示词并格式化

3b63a1c

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

imsyy merged commit 4a696c3 into dev Apr 16, 2026
2 checks passed

imsyy deleted the add-claude-github-actions-1776346331261 branch April 16, 2026 13:43

roarrabbit pushed a commit to roarrabbit/SPlayer-Next that referenced this pull request Aug 27, 2026

Merge pull request SPlayer-Dev#6 from SPlayer-Dev/add-claude-github-a…

a9b60d2

…ctions-1776346331261 Add Claude Code GitHub Workflow

zqhaohao mentioned this pull request Nov 11, 2026

[Bug] Linux arm64 构建在飞腾 D2000 / 麒麟 V10 SP1 (glibc 2.31) 上启动即 SIGTRAP 核心转储（Electron 44 运行时不兼容） #465

Open

4 of 5 tasks

Navigation Menu

Repository navigation

Add Claude Code GitHub Workflow - #6

Add Claude Code GitHub Workflow#6
imsyy merged 3 commits into
devfrom
add-claude-github-actions-1776346331261

imsyy commented Apr 16, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: anthropics/claude-code-action@v1
	uses: anthropics/claude-code-action@0123456789abcdef0123456789abcdef01234567

	uses: anthropics/claude-code-action@v1
	uses: anthropics/claude-code-action@<FULL_LENGTH_COMMIT_SHA> # pin to the reviewed v1 revision

Conversation

imsyy commented Apr 16, 2026

🤖 Installing Claude Code GitHub App

What is Claude Code?

How it works

Important Notes

Security

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants