From 5c1ab2769d5032853618c332fc5fa0a1188432ce Mon Sep 17 00:00:00 2001 From: Daniel Munoz Date: Sat, 25 Jul 2026 22:27:38 -0700 Subject: [PATCH] Make Claude code review post PR comments The review workflow ran but never posted anything to the PR: - The code-review plugin only posts to GitHub when invoked with --comment; without it, findings go to the workflow log only. - The job token had read-only pull-requests/issues permissions. - Comment-posting tools were not in the allowed tools list. Add --comment (which also posts a "No issues found" summary when the review comes back clean), bump permissions to write, and allowlist the tools the plugin uses. Co-Authored-By: Claude Fable 5 --- .github/workflows/claude-code-review.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 5ae9a3f..7185ce6 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -21,8 +21,8 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - pull-requests: read - issues: read + pull-requests: write + issues: write id-token: write steps: @@ -38,7 +38,9 @@ jobs: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' - prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' + prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }} --comment' + claude_args: | + --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*),Bash(gh issue view:*),Bash(gh issue list:*),Bash(gh search:*)" # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md # or https://code.claude.com/docs/en/cli-reference for available options