ci: migrate Claude workflow to org reusable (author gate + SHA-pinned bun)#410
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR migrates the repository’s Claude Code GitHub Actions workflow from a “direct” per-repo implementation to a thin caller that delegates behavior (including hardening) to the org-wide reusable workflow nantobv/.github/.github/workflows/claude-reusable.yml@main.
Changes:
- Replace the standalone Claude responder job/steps with a reusable-workflow call.
- Tighten the
issuestrigger totypes: [opened]only. - Add workflow-level permissions and documentation comments describing the new contract and prerequisites.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Migrates this repo's
.github/workflows/claude.ymlfrom the standalone "direct" workflow shipped by the/install-github-appskill to the hardened thin-caller pattern backed by the org-wide reusable workflow atnantobv/.github/.github/workflows/claude-reusable.yml@main.Why
The previous file (verbatim from the install-github-app template) was missing several hardenings the org has since adopted on
nantobv/.github:@claudeOWNER/MEMBER/COLLABORATORonly. Critical for any public repo.curl https://bun.sh/install | bash(no SHA pin)oven-sh/setup-bun@0c5077e5… # v2.2.0issues:retrigger[opened, assigned]— every reassignment re-fires Claude on issues whose body already says@claude[opened]onlynantobv/.github; future tightening lands without per-repo PRsWhat changes
.github/workflows/claude.ymlgoes from ~50 lines of direct workflow to a ~30-line thin caller. All behavior — security gate, action SHAs, bun bootstrap, permissions — lives in the reusable workflow. The contract on the@claudeUX is unchanged.Prereqs (already in place at the org level)
nantobvwith "All repositories" scopeCLAUDE_CODE_OAUTH_TOKENorg secret reachable by this reponantobv/.github(smoke test issue [P1] Add dry-run mode for index rebuild #17 → "pong" in 9s)Test plan
@claude reply with "pong"to confirm the responder still fires. Run logs at this repo's Actions tab → "Claude Code" workflow.@claudecomment from a non-member account (if applicable) to confirm the author gate now blocks it.🤖 Generated with Claude Code