Skip to content

Commit 3ee085e

Browse files
tianjianjiangclaude
tianjianjiang
and
claude
committed
ci: refactor to reusable workflow and add mcp__github__get_me
Major refactoring to eliminate duplication and ensure MCP tool consistency across all Claude Code workflows. Changes: 1. Created new reusable workflow (claude-review-reusable.yml): - Single source of truth for MCP tool configuration - Standardized permissions and action setup - Parameterized prompt via workflow_call inputs - Complete MCP tool list including mcp__github__get_me 2. Refactored claude.yml to use reusable workflow: - Removed duplicated action configuration - Kept trigger logic (issue_comment, PR review comments) - Passes custom prompt as input - Much shorter and cleaner 3. Refactored claude-code-review.yml to use reusable workflow: - Removed duplicated action configuration - Kept fork PR skip condition - Kept paths-ignore for OIDC security - Passes custom prompt as input 4. Added mcp__github__get_me to standard tool list: - Fixes permission denials in run #19002499746 - Provides authenticated user context - Prevents wasted API calls - Now included automatically in both workflows Standard MCP Tool List (now centralized): - mcp__github__get_me (NEW - user context) - mcp__github__get_pull_request (PR metadata) - mcp__github__create_pending_pull_request_review (start review) - mcp__github__get_pull_request_diff (code changes) - mcp__github__add_comment_to_pending_review (inline comments) - mcp__github__submit_pending_pull_request_review (publish) Benefits: - Eliminates duplication (70+ lines reduced to ~30 per workflow) - Impossible for workflows to drift (single source of truth) - Easier maintenance (update once, applies everywhere) - Consistent MCP tools across all Claude workflows - No more permission denials for get_me or get_pull_request Evidence: - Run #19002499746 had permission denial for mcp__github__get_me - Run #19002226499 had permission denial for mcp__github__get_pull_request - Both now resolved by centralized tool list Related: https://github.com/openvanilla/McBopomofo/actions/runs/19002499746 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent d7a697f commit 3ee085e

3 files changed

Lines changed: 105 additions & 98 deletions

File tree

‎.github/workflows/claude-code-review.yml‎

Lines changed: 30 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -30,63 +30,41 @@ jobs:
3030
# 3. Manually review the code
3131
#
3232
# This workflow only runs on PRs from branches within this repository.
33-
3433
if: github.event.pull_request.head.repo.full_name == github.repository
35-
runs-on: ubuntu-latest
36-
permissions:
37-
contents: read
38-
pull-requests: write # Changed from read to write - needed to post PR comments
39-
issues: read
40-
id-token: write
41-
42-
steps:
43-
- name: Checkout repository
44-
uses: actions/checkout@v4
45-
with:
46-
fetch-depth: 1
47-
48-
- name: Run Claude Code Review
49-
id: claude-review
50-
uses: anthropics/claude-code-action@v1
51-
with:
52-
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
53-
prompt: |
54-
REPO: ${{ github.repository }}
55-
PR NUMBER: ${{ github.event.pull_request.number }}
5634

57-
Please review this PR focusing ONLY on critical issues. Use the repository's CLAUDE.md for conventions.
35+
# Use the reusable workflow which contains the standardized MCP tool configuration
36+
# This eliminates duplication and ensures consistency across all Claude workflows
37+
uses: ./.github/workflows/claude-review-reusable.yml
38+
with:
39+
prompt: |
40+
REPO: ${{ github.repository }}
41+
PR NUMBER: ${{ github.event.pull_request.number }}
5842
59-
Review for:
60-
- Potential bugs or logic errors
61-
- Security vulnerabilities
62-
- Performance problems
63-
- Correctness issues
64-
- Violations of repository coding standards
43+
Please review this PR focusing ONLY on critical issues. Use the repository's CLAUDE.md for conventions.
6544
66-
Keep your response concise:
67-
- Focus on critical/high-priority issues only
68-
- Use inline comments with code suggestions for specific fixes
69-
- Group similar issues together to avoid repetition
70-
- Skip style/formatting nitpicks unless they impact security or performance
71-
- No general observations, praise, or minor suggestions
45+
Review for:
46+
- Potential bugs or logic errors
47+
- Security vulnerabilities
48+
- Performance problems
49+
- Correctness issues
50+
- Violations of repository coding standards
7251
73-
Use the GitHub review system to post your feedback:
74-
1. Use `mcp__github__get_pull_request` to understand the PR context if needed
75-
2. Use `mcp__github__create_pending_pull_request_review` to start a pending review
76-
3. Use `mcp__github__get_pull_request_diff` to see the code changes and line numbers
77-
4. Use `mcp__github__add_comment_to_pending_review` for inline comments on specific lines
78-
5. Use `mcp__github__submit_pending_pull_request_review` with event type "COMMENT" to publish
52+
Keep your response concise:
53+
- Focus on critical/high-priority issues only
54+
- Use inline comments with code suggestions for specific fixes
55+
- Group similar issues together to avoid repetition
56+
- Skip style/formatting nitpicks unless they impact security or performance
57+
- No general observations, praise, or minor suggestions
7958
80-
When suggesting code changes, use GitHub's ```suggestion blocks so authors can apply changes directly.
59+
Use the GitHub review system to post your feedback:
60+
1. Use `mcp__github__get_pull_request` to understand the PR context if needed
61+
2. Use `mcp__github__get_me` to get authenticated user context if needed
62+
3. Use `mcp__github__create_pending_pull_request_review` to start a pending review
63+
4. Use `mcp__github__get_pull_request_diff` to see the code changes and line numbers
64+
5. Use `mcp__github__add_comment_to_pending_review` for inline comments on specific lines
65+
6. Use `mcp__github__submit_pending_pull_request_review` with event type "COMMENT" to publish
8166
82-
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
83-
# Use MCP GitHub tools for posting PR reviews (more reliable than gh CLI)
84-
# Includes mcp__github__get_pull_request which was missing and caused permission denials
85-
claude_args: >-
86-
--allowedTools
87-
mcp__github__get_pull_request,
88-
mcp__github__create_pending_pull_request_review,
89-
mcp__github__get_pull_request_diff,
90-
mcp__github__add_comment_to_pending_review,
91-
mcp__github__submit_pending_pull_request_review
67+
When suggesting code changes, use GitHub's ```suggestion blocks so authors can apply changes directly.
68+
secrets:
69+
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
9270

‎.github/workflows/claude-review-reusable.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Claude PR Review (Reusable)
2+
3+
# Reusable workflow for Claude Code PR reviews
4+
# Used by both claude.yml and claude-code-review.yml to maintain consistency
5+
# and eliminate duplication of MCP tool configuration.
6+
7+
on:
8+
workflow_call:
9+
inputs:
10+
prompt:
11+
description: 'The prompt to send to Claude for PR review'
12+
required: true
13+
type: string
14+
claude_args_override:
15+
description: 'Optional override for claude_args (defaults to standard MCP tools)'
16+
required: false
17+
type: string
18+
default: ''
19+
secrets:
20+
CLAUDE_CODE_OAUTH_TOKEN:
21+
description: 'OAuth token for Claude Code authentication'
22+
required: true
23+
24+
jobs:
25+
review:
26+
runs-on: ubuntu-latest
27+
permissions:
28+
contents: read
29+
pull-requests: write # Required for posting PR reviews
30+
issues: read
31+
id-token: write # Required for OIDC token exchange
32+
actions: read # Required for Claude to read CI results
33+
34+
steps:
35+
- name: Checkout repository
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-depth: 1
39+
40+
- name: Run Claude Code Review
41+
id: claude-review
42+
uses: anthropics/claude-code-action@v1
43+
with:
44+
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
45+
prompt: ${{ inputs.prompt }}
46+
47+
# Standard MCP tool list for GitHub PR reviews
48+
# This is the single source of truth for allowed tools across all Claude workflows
49+
#
50+
# Tools included:
51+
# - mcp__github__get_me: Get authenticated user context (prevents permission denials)
52+
# - mcp__github__get_pull_request: Get PR metadata, title, description (context understanding)
53+
# - mcp__github__create_pending_pull_request_review: Start a pending review
54+
# - mcp__github__get_pull_request_diff: Get code changes and line numbers for inline comments
55+
# - mcp__github__add_comment_to_pending_review: Add inline review comments
56+
# - mcp__github__submit_pending_pull_request_review: Publish the review
57+
claude_args: ${{ inputs.claude_args_override != '' && inputs.claude_args_override || format('--allowedTools mcp__github__get_me,mcp__github__get_pull_request,mcp__github__create_pending_pull_request_review,mcp__github__get_pull_request_diff,mcp__github__add_comment_to_pending_review,mcp__github__submit_pending_pull_request_review') }}

‎.github/workflows/claude.yml‎

Lines changed: 18 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -12,56 +12,28 @@ on:
1212

1313
jobs:
1414
claude:
15+
# Only trigger when @claude is mentioned in comments/reviews
1516
if: |
1617
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
1718
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
1819
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
1920
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
20-
runs-on: ubuntu-latest
21-
permissions:
22-
contents: read
23-
pull-requests: write # Required for posting inline review comments
24-
issues: read
25-
id-token: write
26-
actions: read # Required for Claude to read CI results on PRs
27-
steps:
28-
- name: Checkout repository
29-
uses: actions/checkout@v4
30-
with:
31-
fetch-depth: 1
3221
33-
- name: Run Claude Code
34-
id: claude
35-
uses: anthropics/claude-code-action@v1
36-
with:
37-
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
38-
39-
# This is an optional setting that allows Claude to read CI results on PRs
40-
additional_permissions: |
41-
actions: read
42-
43-
# Enable inline review comments with suggestions for PR reviews
44-
# When @claude is mentioned in PR comments, it will provide detailed inline feedback
45-
prompt: |
46-
Please review this PR and provide inline feedback using the GitHub review system. Follow these steps:
47-
48-
1. **Get PR context** (optional): Use `mcp__github__get_pull_request` to understand the PR's purpose, title, and description
49-
2. **Start a review**: Use `mcp__github__create_pending_pull_request_review` to begin a pending review
50-
3. **Get diff information**: Use `mcp__github__get_pull_request_diff` to understand the code changes and line numbers
51-
4. **Add inline comments**: Use `mcp__github__add_comment_to_pending_review` for each specific piece of feedback on particular lines
52-
5. **Submit the review**: Use `mcp__github__submit_pending_pull_request_review` with event type "COMMENT" (not "REQUEST_CHANGES") to publish all comments as a non-blocking review
53-
54-
When suggesting code changes, use GitHub's suggestion format with ```suggestion blocks so authors can apply changes directly.
55-
56-
# Enable GitHub MCP server tools for inline review comments
57-
# See: https://github.com/anthropics/claude-code-action/issues/60
58-
# Added mcp__github__get_pull_request for consistency with claude-code-review.yml
59-
# and to prevent permission denials when Claude needs PR context
60-
claude_args: >-
61-
--allowedTools
62-
mcp__github__get_pull_request,
63-
mcp__github__create_pending_pull_request_review,
64-
mcp__github__get_pull_request_diff,
65-
mcp__github__add_comment_to_pending_review,
66-
mcp__github__submit_pending_pull_request_review
22+
# Use the reusable workflow which contains the standardized MCP tool configuration
23+
# This eliminates duplication and ensures consistency across all Claude workflows
24+
uses: ./.github/workflows/claude-review-reusable.yml
25+
with:
26+
prompt: |
27+
Please review this PR and provide inline feedback using the GitHub review system. Follow these steps:
28+
29+
1. **Get PR context** (optional): Use `mcp__github__get_pull_request` to understand the PR's purpose, title, and description
30+
2. **Get user context** (optional): Use `mcp__github__get_me` to understand the authenticated user
31+
3. **Start a review**: Use `mcp__github__create_pending_pull_request_review` to begin a pending review
32+
4. **Get diff information**: Use `mcp__github__get_pull_request_diff` to understand the code changes and line numbers
33+
5. **Add inline comments**: Use `mcp__github__add_comment_to_pending_review` for each specific piece of feedback on particular lines
34+
6. **Submit the review**: Use `mcp__github__submit_pending_pull_request_review` with event type "COMMENT" (not "REQUEST_CHANGES") to publish all comments as a non-blocking review
35+
36+
When suggesting code changes, use GitHub's suggestion format with ```suggestion blocks so authors can apply changes directly.
37+
secrets:
38+
CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
6739

0 commit comments

Comments
 (0)