claude.yaml

name: Claude Code
on:
  repository_dispatch:
    types: [claude-trigger]
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, assigned]
  pull_request_review:
    types: [submitted]
jobs:
  claude:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) ||
      github.event_name == 'repository_dispatch'
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
      issues: write
      id-token: write
      actions: read # Required for Claude to read CI results on PRs
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: NixOS/nix-installer-action@main
        with:
          extra-conf: |
            extra-substituters = https://cache.thalheim.io
            extra-trusted-public-keys = cache.thalheim.io-1:R7msbosLEZKrxk/lKxf9BTjOOH7Ax3H0Qj0/6wiHOgc=
      - name: Determine PR number
        if: |
          github.event_name == 'repository_dispatch' ||
          github.event_name == 'issue_comment' ||
          github.event_name == 'pull_request_review_comment' ||
          github.event_name == 'pull_request_review'
        run: |
          # Determine PR number based on event type
          case "${{ github.event_name }}" in
            repository_dispatch)
              PR_NUMBER="${{ github.event.client_payload.pr_number }}"
              ;;
            issue_comment)
              PR_NUMBER="${{ github.event.issue.number }}"
              ;;
            pull_request_review_comment|pull_request_review)
              PR_NUMBER="${{ github.event.pull_request.number }}"
              ;;
          esac

          echo "PR_NUMBER=$PR_NUMBER" >> "$GITHUB_ENV"
      - name: Checkout PR branch and gather build info
        if: env.PR_NUMBER != ''
        run: |
          gh pr checkout "${{ env.PR_NUMBER }}"
          BASE_BRANCH="$(git branch --show-current)"

          # Get buildbot check results
          PR_URL="https://github.com/${{ github.repository }}/pull/${{ env.PR_NUMBER }}"
          nix build .#buildbot-pr-check --log-format bar-with-logs
          BUILDBOT_OUTPUT=$(./result/bin/buildbot-pr-check "$PR_URL" 2>&1 || true)

          {
            echo "BASE_BRANCH=$BASE_BRANCH"
            echo "BUILDBOT_OUTPUT<<EOF"
            echo "$BUILDBOT_OUTPUT"
            echo "EOF"
          } >> "$GITHUB_ENV"
        env:
          GH_TOKEN: ${{ github.token }}
      - name: Configure git for Claude
        if: env.BASE_BRANCH != ''
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
      - name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@v1
        env:
          # Explicitly DO NOT pass GITHUB_TOKEN or GH_TOKEN to Claude
          GITHUB_TOKEN: ""
          GH_TOKEN: ""
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          claude_args: "--allowed-tools Bash,Read,Write,Edit,Glob,Grep,WebFetch(*.github.qkg1.top,*.thalheim.io,*.nixos.org)"
          prompt: |
            ${{ github.event.client_payload.prompt }}

            Buildbot CI check results:
            ${{ env.BUILDBOT_OUTPUT }}

            Make the necessary fixes to resolve the build failures. You can commit your changes locally, but do not try to push or create pull requests - that will be handled automatically after you finish.

            IMPORTANT: Do NOT act on CI infrastructure issues such as remote builders being unreachable or unavailable.
            If the build failure is caused by infrastructure issues rather than code problems, simply explain this in your output (visible in the action log) and do not attempt any fixes.

            IMPORTANT: Do NOT downgrade flake inputs (e.g., reverting flake.lock changes) as a fix for build failures.
            If the only way to fix the build would be to downgrade a flake input, do nothing and explain the situation in your output instead.
      - name: Clean up temporary files
        if: env.BASE_BRANCH != ''
        run: rm -f output.txt
      - name: Create Pull Request with fixes
        if: env.BASE_BRANCH != ''
        uses: peter-evans/create-pull-request@v8
        id: cpr
        with:
          commit-message: "Fix CI failures"
          branch: claude-fix-${{ github.run_id }}
          delete-branch: true
          title: "Fix CI failures in ${{ env.BASE_BRANCH }}"
          body: |
            Automated fixes by Claude Code for CI failures.

            Base branch: ${{ env.BASE_BRANCH }}
            Workflow run: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}

            ## Buildbot Results
            ```
            ${{ env.BUILDBOT_OUTPUT }}
            ```
          base: ${{ env.BASE_BRANCH }}
      - name: Comment on original PR with results
        if: env.BASE_BRANCH != ''
        run: |
          # Build comment with conditional PR link
          FIX_PR="${{ steps.cpr.outputs.pull-request-number }}"

          gh pr comment "${{ env.PR_NUMBER }}" --body-file - <<EOF
          🤖 Claude Code analysis complete: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
          ${FIX_PR:+
          Created fix PR: #${FIX_PR}}
          EOF
        env:
          GH_TOKEN: ${{ github.token }}