@monte3l/groundwork 0.1.0-next.1 → 1.0.0-rc.3

package/templates/packs/github/files/.github/workflows/claude.yml

@@ -0,0 +1,106 @@
+name: Claude Code
+
+# Anthropic's official Claude Code GitHub Action (anthropics/claude-code-action),
+# in interactive mode: responds to @claude mentions on issues, PR reviews,
+# and review comments. Claude commits to a branch and links back to a
+# PR-creation page -- it never opens a PR itself.
+#
+# Want automated review on every PR too? That's a separate workflow, not a
+# block to uncomment here (a second `on:`/`jobs:` in one file would collide
+# the moment it's uncommented) -- see Anthropic's own
+# examples/pr-review-comprehensive.yml:
+# https://github.com/anthropics/claude-code-action/blob/main/examples/pr-review-comprehensive.yml
+#
+# This workflow needs one of the three auth methods below (Option 1 is
+# active by default) -- until one is configured it fails cleanly on an
+# @claude mention (an auth error, not a crash or a silent no-op).
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+# Reset, then grant per job.
+permissions: {}
+
+jobs:
+  claude:
+    # Issues and comments are open to anyone on a public repository, so the
+    # `@claude` text match alone would let an outside commenter trigger a job
+    # holding `contents: write` and your auth secret. Each branch below also
+    # requires the `author_association` of the comment's, review's or
+    # issue's author to be OWNER, MEMBER or COLLABORATOR. Two consequences:
+    # an org member whose membership is private can surface as CONTRIBUTOR
+    # and be skipped, and on `issues` the check is on the issue's author, not
+    # on whoever assigned it, so assigning an outsider's issue does not start
+    # a run.
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association))
+    # One run per issue/PR at a time. A later @claude mention queues behind
+    # the run in flight without cancelling it; GitHub keeps only the latest
+    # pending run per group, so a burst of mentions can drop the middle ones.
+    concurrency:
+      group: claude-${{ github.event.issue.number || github.event.pull_request.number }}
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      # Required even with a static API key: the default GitHub App
+      # authentication path uses this to fetch a GitHub OIDC token for its
+      # own token exchange, separate from how the action authenticates to
+      # Anthropic.
+      id-token: write
+      actions: read # lets Claude read CI results on the PR it's tagged in
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          fetch-depth: 1
+
+      - name: Run Claude Code
+        uses: anthropics/claude-code-action@ed670b4cf9de2a5a570d130d2f6197b9e543cd64 # v1.0.240
+        with:
+          # Option 1 (active default): a stored API key. Install the Claude
+          # GitHub App (https://github.com/apps/claude) and add
+          # ANTHROPIC_API_KEY as a repository secret.
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+
+          # Commit through the GitHub API instead of local `git`, so GitHub
+          # signs the commits -- a branch ruleset requiring signed commits
+          # would otherwise reject whatever this job pushes.
+          use_commit_signing: true
+
+          # Option 2: a Claude subscription's OAuth token instead of an API
+          # key -- generate once locally with `claude setup-token`, then add
+          # it as CLAUDE_CODE_OAUTH_TOKEN and swap it in for the line above.
+          # claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # Option 3: Workload Identity Federation -- no stored secret at
+          # all, exchanges this workflow's GitHub OIDC token for a
+          # short-lived Anthropic token. Needs a one-time setup in the
+          # Anthropic Console (Settings -> Workload identity): register a
+          # GitHub Actions issuer, create a service account, create a
+          # federation rule. Then replace anthropic_api_key above with:
+          # anthropic_federation_rule_id: fdrl_xxxxxxxxxxxx
+          # anthropic_organization_id: 00000000-0000-0000-0000-000000000000
+          # anthropic_service_account_id: svac_xxxxxxxxxxxx
+
+          # Optional: customize the trigger phrase (default: @claude)
+          # trigger_phrase: "/claude"
+
+          # Optional: configure Claude's behavior with CLI arguments
+          # claude_args: |
+          #   --max-turns 10
+          #   --allowedTools "Bash(npm install),Bash(npm run build),Bash(npm run test:*)"

package/templates/packs/github/pack.json

@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 1,
+  "name": "github",
+  "description": "GitHub-hosted collaboration on top of the baseline: Anthropic's official Claude Code GitHub Action (anthropics/claude-code-action) wired for @claude mention-mode, a second Action that posts an automated Claude review comment on every PR, and three gh-CLI skills -- reviewing-dependabot-prs (classify and batch-merge open Dependabot PRs), triaging-scan-alerts (triage open code-scanning alerts to file:line, report only), and watching-pr-checks (check a PR's CI status and hand off to a project's own /triaging-ci on a real failure).",
+  "modes": ["fresh", "adopt"],
+  "budget": {
+    "agents": 0,
+    "skills": 3,
+    "hooks": 0,
+    "workflows": 2,
+    "scripts": 0
+  },
+  "wiring": {
+    "settings": {},
+    "packageScripts": {},
+    "verifySteps": []
+  },
+  "adoptNotes": "claude.yml only reacts to @claude mentions from a repository owner, member or collaborator (author_association), so an outside commenter on a public repository cannot start a job that holds contents: write and your auth secret; an org member with private membership may surface as CONTRIBUTOR and be skipped. It also commits through the GitHub API (use_commit_signing) so a signed-commits ruleset accepts its work. Both workflows need one thing this pack cannot verify or install: an ANTHROPIC_API_KEY repository secret (the active default), or a CLAUDE_CODE_OAUTH_TOKEN from a Claude subscription, or a Workload Identity Federation setup in the Anthropic Console -- see the comments in .github/workflows/claude.yml for all three. Until one is configured, either workflow runs and fails cleanly (an auth error in the run log, not a crash and not a silent no-op): claude.yml on an @claude mention, claude-pr-review.yml on the next PR open/push. An adopted project that already has its own .github/workflows/claude.yml or claude-pr-review.yml surfaces as an ordinary file conflict -- keep the existing one if it's already configured for that project's own auth choice, since this pack's version would just overwrite a working setup with its own generic defaults. triaging-scan-alerts reads code-scanning alerts, and nothing in the baseline or this pack produces them: turn on GitHub's CodeQL default setup for the repository (Settings > Code security), or install the `publishing` pack, whose scorecard.yml uploads SARIF, otherwise the skill's first call returns \"code scanning is not enabled\" and reports nothing. The other two skills have no such dependency: they install anywhere a .claude/ directory exists and need only `gh` CLI auth (already required by every other gh-CLI-based skill this baseline ships). watching-pr-checks' handoff to /triaging-ci degrades gracefully if the project doesn't have that skill installed -- it still reports the real failure, just without the handoff."
+}