Add Claude Code Review GitHub Actions workflows

[justin808]

Summary

Brings over the Claude review process from react_on_rails so PRs to this repo get the same automated and interactive Claude support. This repo previously had no .github/ workflows at all.

What's added

• .github/workflows/claude-code-review.yml — runs anthropics/claude-code-action@v1 on every PR (opened, synchronize, ready_for_review, reopened) and posts review feedback as GitHub comments / inline comments. The review-focus prompt keeps the standard checks (code quality, bugs, security, performance) and adds two concerns specific to this repo:
  • Portability — flags consumer-repo commands, labels, branches, trackers, or paths hardcoded in skills/ or workflows/ (per AGENTS.md → Editing Rules).
  • Shell / Ruby helper safety in bin/ and skills/*/bin/.
• .github/workflows/claude.yml — the interactive @claude bot for issue/PR comments, reviews, and newly opened/assigned issues.

Both are faithful ports of the react_on_rails workflows; the only adaptation is the two extra review-focus bullets above.

Requirements

Both workflows need the CLAUDE_CODE_OAUTH_TOKEN secret. react_on_rails already uses it under the shakacode org, so the org-level secret should be available here — please confirm it's set for this repo.

Validation

• bin/validate — all checks pass.
• actionlint — clean on both files.
• YAML parses successfully.

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@justin808, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 50 minutes and 38 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 4ca1fc12-1a49-42e9-9dfb-65060634f898

📥 Commits

Reviewing files that changed from the base of the PR and between b466a15 and 2d112ef.

📒 Files selected for processing (2)

• .github/workflows/claude-code-review.yml
• .github/workflows/claude.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/distracted-elgamal-924ebf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[claude]

Claude Code Review

This PR adds two GitHub Actions workflows: an automated PR review trigger (claude-code-review.yml) and an interactive @claude bot (claude.yml). The structure is reasonable but four issues need attention before these workflows will function correctly in production.

Findings

1. Hard runtime failure — actions/checkout@v6 does not exist (claude-code-review.yml:18)
v6 has never been released; the latest stable major is v4. The checkout step in claude-code-review.yml will fail with "Unable to resolve action" on every run, meaning no reviews will ever be posted. The sibling claude.yml correctly uses @v4.

2. claude.yml — interactive bot has read-only permissions and cannot post responses (claude.yml:23-24)
The job grants pull-requests: read and issues: read, but the @claude bot's entire purpose is to reply to comments on issues and PRs. Without write permissions on both scopes, the action cannot post any response, making the workflow non-functional for its intended purpose.

3. issues: write over-granted in the review workflow (claude-code-review.yml:13)
The review workflow only posts PR comments (gh pr comment, mcp__github_inline_comment__create_inline_comment). Neither touches issues. pull-requests: write is sufficient; the extra issues: write scope gives a prompt-injected or compromised step the ability to create, close, or label issues unnecessarily.

4. actions: read declared twice in claude.yml (claude.yml:26 + lines 40-41)
The permission appears once in the job-level permissions block and again in the additional_permissions input to claude-code-action. The latter is meant to request permissions not already granted at the job level; the duplicate is a no-op today but will cause confusion if the two copies diverge on future edits.

[claude]

actions/checkout@v6 does not exist — the latest stable major release is v4. This step will fail at runtime with "Unable to resolve action", causing every automated review to silently never run. The sibling claude.yml correctly pins @v4.

Suggested change

	uses: actions/checkout@v6
	uses: actions/checkout@v4

[claude]

issues: write is broader than necessary. The workflow's only output paths are gh pr comment and mcp__github_inline_comment__create_inline_comment, both of which operate on the pull request, not on issues. pull-requests: write is sufficient. The extra scope lets a prompt-injected step create, close, or label repository issues.

Suggested change

	issues: write
	pull-requests: write

[claude]

The interactive bot needs write access to both pull-requests and issues to post any response to @claude mentions. With only read on both scopes, every invocation will silently fail to reply. Compare claude-code-review.yml which correctly grants pull-requests: write.

Suggested change

	contents: read
	pull-requests: read
	issues: read
	contents: read
	pull-requests: write
	issues: write

[claude]

actions: read is already declared in the job-level permissions block (line 26). additional_permissions is the action's mechanism to request permissions the job hasn't already granted; duplicating an already-granted permission here is a no-op and will cause confusion if the two copies diverge on a future edit.

Suggested change

	additional_permissions: |
	actions: read