1name: Claude Code
2
3on:
4 issue_comment:
5 types: [created]
6 pull_request_review_comment:
7 types: [created]
8 issues:
9 types: [opened, assigned]
10 pull_request_review:
11 types: [submitted]
12
13concurrency:
14 group: claude-${{ github.event.pull_request.number || github.event.issue.number || github.run_id }}
15 # Separate @claude prompts may be independent requests; serialize them for
16 # the same issue or PR without discarding one that is already running.
17 cancel-in-progress: false
18
19jobs:
20 claude:
21 if: |
22 (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
23 (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
24 (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
25 (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
26 runs-on: ubuntu-latest
27 permissions:
28 contents: write
29 pull-requests: write
30 issues: write
31 id-token: write
32 actions: read
33 steps:
34 - name: Checkout repository
35 uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
36 with:
37 fetch-depth: 1
38
39 - name: Checkout distilled
40 run: git submodule update --init --depth=1 --checkout -- submodules/distilled
41
42 - name: Restore Turbo cache
43 uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
44 with:
45 path: .turbo
46 key: turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-${{ github.workflow }}-${{ github.run_attempt }}
47 restore-keys: |
48 turbo-${{ runner.os }}-${{ github.repository_id }}-${{ github.sha }}-
49 turbo-${{ runner.os }}-${{ github.repository_id }}-
50
51 - name: Setup pnpm, Node.js, Bun and install dependencies
52 uses: pnpm/setup@703c52620218391530e48b9e8870d5c0082e1b9b # v2.1.0
53 with:
54 cache: true
55 install: true
56 require-lockfile: true
57
58 - name: Configure AWS credentials
59 id: aws
60 uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
61 with:
62 role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
63 aws-region: us-east-1
64 output-credentials: true
65
66 - name: Run Claude Code
67 uses: anthropics/claude-code-action@e63208cb983318a44e3f945e959ef894b707dcfa # v1.0.192
68 env:
69 AWS_ACCESS_KEY_ID: ${{ steps.aws.outputs.aws-access-key-id }}
70 AWS_SECRET_ACCESS_KEY: ${{ steps.aws.outputs.aws-secret-access-key }}
71 AWS_SESSION_TOKEN: ${{ steps.aws.outputs.aws-session-token }}
72 AWS_REGION: us-east-1
73 AWS_DEFAULT_REGION: us-east-1
74 CLOUDFLARE_API_TOKEN: ${{ secrets.TEST_CLOUDFLARE_API_TOKEN }}
75 CLOUDFLARE_ACCOUNT_ID: ${{ secrets.TEST_CLOUDFLARE_ACCOUNT_ID }}
76 with:
77 anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
78 claude_args: |
79 --model claude-fable-5
80 --allowedTools "Bash(aws:*),WebFetch,WebSearch"