claude-code.yml

name: Claude Code

# This workflow enables Claude to respond to @claude mentions in issues, PRs, comments, and reviews
# for the ai-toolkit repository itself.

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, assigned]
  pull_request_review:
    types: [submitted]

permissions:
  id-token: write # Required for OIDC authentication in _claude-main.yml
  contents: read
  issues: write
  pull-requests: write
  actions: read # Required to read CI results on PRs in _claude-main.yml

jobs:
  claude:
    # Only run when @claude is mentioned and the comment is not from a bot
    # Security: fork guard applied to events where PR context is available
    # (pull_request_review_comment, pull_request_review). issue_comment events
    # are lower risk because _claude-main.yml checks out the default branch, not fork code.
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.type != 'Bot') ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.type != 'Bot' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && github.event.review.user.type != 'Bot' && github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && github.event.issue.user.type != 'Bot')

    uses: ./.github/workflows/_claude-main.yml
    secrets:
      ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
      CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
    with:
      # Use default Sonnet 4.6 model
      model: 'claude-sonnet-4-6'

      # Repository-specific instructions
      custom_instructions: |
        Be sure to follow rules in all CLAUDE.md files.

        When working in the ai-toolkit repository:
        - This is an Nx monorepo - use Nx commands for all operations
        - Follow the code quality requirements in the root CLAUDE.md
        - Always run format, lint, and typecheck after making changes
        - Use the established naming conventions for workflows and packages
        - Pin external GitHub Actions to commit hashes with version comments
        - Complex scripts should be in separate files or published packages
        - Update CLAUDE.md files in affected packages after changes

      # Standard timeout for most interactions
      timeout_minutes: 10