在 Github 中通过创建 issue 来唤醒 claude 工作

name: Claude Assistant
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]
  issues:
    types: [opened, assigned]

# 仓库级权限：按需最小化——只读场景可把三个 write 都改成 read
permissions:
  contents: write
  pull-requests: write
  issues: write
  # 用 CLAUDE_CODE_OAUTH_TOKEN 时必加，OAuth 流程要用 OIDC token 去换；
  # 用 ANTHROPIC_API_KEY 时可省。
  id-token: write
  # 让 Claude 能读 CI run 日志（"我 PR 的 CI 挂了帮我看看"）
  actions: read

jobs:
  claude-response:
    # 双重门槛：
    #   1. actor 必须是仓库主人本人——防外部用户触发
    #   2. 触发载体里必须出现 @claude——没有则直接 skip，连 runner 都不起，省 Action 额度
    # 注意：include_comments_by_actor 只过滤"评论"，不一定覆盖 issue body /
    # PR description / review body，所以第 1 条的 actor 校验是必须的纵深防御。
    if: |
      github.actor == '你的用户名' && (
        (github.event_name == 'issue_comment'               && contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review'         && contains(github.event.review.body,  '@claude')) ||
        (github.event_name == 'issues'                      && (contains(github.event.issue.body,  '@claude')
                                                             || contains(github.event.issue.title, '@claude')))
      )
    runs-on: ubuntu-latest
    steps:
      # claude-code-action 需要 .git 目录才能创建分支去提 PR
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          # 第三道门：评论场景也只接受白名单
          include_comments_by_actor: "你的用户名"
          # 工具权限：纵深防御——Bash 不再裸开，按命令前缀逐条白名单。
          # 只读场景可把所有 Bash(...) 和 Edit/Write 删掉。
          claude_args: |
            --max-turns 30
            --allowedTools "WebFetch,WebSearch,Edit,Write,Read,Glob,Grep,TodoWrite,Bash(git:*),Bash(gh:*),Bash(npm:*),Bash(pnpm:*),Bash(yarn:*),Bash(npx:*),Bash(node:*),Bash(curl:*),Bash(jq:*),Bash(rg:*),Bash(fd:*)"

name: Claude with Custom App
on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  pull_request_review:
    types: [submitted]
  issues:
    types: [opened, assigned]

permissions:
  contents: write
  pull-requests: write
  issues: write
  id-token: write  # 用 OAuth Token 时必加
  actions: read    # 让 Claude 能看 CI run 日志

jobs:
  claude-response:
    if: |
      github.actor == '你的用户名' && (
        (github.event_name == 'issue_comment'               && contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
        (github.event_name == 'pull_request_review'         && contains(github.event.review.body,  '@claude')) ||
        (github.event_name == 'issues'                      && (contains(github.event.issue.body,  '@claude')
                                                             || contains(github.event.issue.title, '@claude')))
      )
    runs-on: ubuntu-latest
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@v1
        with:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}

      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ steps.app-token.outputs.token }}
          include_comments_by_actor: "你的用户名"
          claude_args: |
            --max-turns 30
            --allowedTools "WebFetch,WebSearch,Edit,Write,Read,Glob,Grep,TodoWrite,Bash(git:*),Bash(gh:*),Bash(npm:*),Bash(pnpm:*),Bash(yarn:*),Bash(npx:*),Bash(node:*),Bash(curl:*),Bash(jq:*),Bash(rg:*),Bash(fd:*)"