Add Claude Code GitHub Workflow

[Dhravya]

🤖 Installing Claude Code GitHub App

This PR adds a GitHub Actions workflow that enables Claude Code integration in our repository.

What is Claude Code?

Claude Code is an AI coding agent that can help with:

• Bug fixes and improvements
• Documentation updates
• Implementing new features
• Code reviews and suggestions
• Writing tests
• And more!

How it works

Once this PR is merged, we'll be able to interact with Claude by mentioning @claude in a pull request or issue comment.
Once the workflow is triggered, Claude will analyze the comment and surrounding context, and execute on the request in a GitHub action.

Important Notes

• This workflow won't take effect until this PR is merged
• @claude mentions won't work until after the merge is complete
• The workflow runs automatically whenever Claude is mentioned in PR or issue comments
• Claude gets access to the entire PR or issue context including files, diffs, and previous comments

Security

• Our Anthropic API key is securely stored as a GitHub Actions secret
• Only users with write access to the repository can trigger the workflow
• All Claude runs are stored in the GitHub Actions run history
• Claude's default tools are limited to reading/writing files and interacting with our repo by creating comments, branches, and commits.
• We can add more allowed tools by adding them to the workflow file like:

allowed_tools: Bash(npm install),Bash(npm run build),Bash(npm run lint),Bash(npm run test)

There's more information in the Claude Code action repo.

After merging this PR, let's try mentioning @claude in a comment on any PR to get started!

[sentry]

Bug: The workflow trigger condition only checks for an @claude mention, allowing any user to trigger it, which contradicts the documented behavior of requiring write access.
_{Severity: MEDIUM}

Suggested Fix

Update the if condition in the workflow to check the commenter's permissions. Use github.event.comment.author_association to ensure the actor is a COLLABORATOR or OWNER before running the job. For example: (github.event.comment.author_association == 'COLLABORATOR' || github.event.comment.author_association == 'OWNER').

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/claude.yml#L15-L19

Potential issue: The GitHub workflow is configured to trigger on events like
`issue_comment` whenever the comment body contains `@claude`. However, the trigger
condition does not check the `author_association` to verify if the user has write
permissions. This allows any user who can comment on the repository's issues or pull
requests to trigger the workflow, leading to potential unauthorized consumption of the
Anthropic API quota. This behavior contradicts the PR description's claim that only
users with write access can trigger the action.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[sentry]

Bug: The workflow lacks the necessary write permissions for contents, pull-requests, and issues, which will cause the Claude action to fail when trying to create comments or commits.
_{Severity: CRITICAL}

Suggested Fix

In the workflow file, update the permissions block to grant write access where needed. Change contents: read to contents: write, pull-requests: read to pull-requests: write, and issues: read to issues: write to allow the action to modify repository content as intended.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/claude.yml#L22-L24

Potential issue: The GitHub workflow grants only `read` permissions for `contents`,
`pull-requests`, and `issues`. However, the `anthropics/claude-code-action` requires
`write` permissions to perform its core functions, such as creating comments, commits,
or branches, as described in the PR. Because the necessary write permissions are
missing, the action will fail when it attempts to modify the repository, preventing it
from working as intended.

_{Did we get this right? 👍 / 👎 to inform future reviews.}