From 32f2df31eee59f2a8c42011ea784c3fe6ee04565 Mon Sep 17 00:00:00 2001
From: TRIP <1933142963@qq.com>
Date: Thu, 7 May 2026 10:46:53 +0800
Subject: [PATCH] Add Claude Code GitHub Workflow (#308)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* "Claude PR Assistant workflow"

* "Claude Code Review workflow"

* ci(claude): 收紧 review 触发：只 OWNER @claude 才跑，默认 Sonnet 4.6

- 删除 claude-code-review.yml：原本 PR opened/sync 自动触发会无差别烧 OAuth 额度
- claude.yml if 加 author_association == 'OWNER' 门禁：只有仓库 owner 评论 @claude 才触发
- 加 Pick model step：默认 claude-sonnet-4-6；评论包含 --opus / claude-opus 时切 claude-opus-4-7
- 用 env 注入 body / title 而不是直接 inline expression，避免外部内容引号注入

---------

Co-authored-by: baiqing <lbx12309@icloud.com>
---
 .github/workflows/claude.yml | 68 ++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 .github/workflows/claude.yml

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
new file mode 100644
index 00000000..cc1eff5a
--- /dev/null
+++ b/.github/workflows/claude.yml
@@ -0,0 +1,68 @@
+name: Claude Code
+
+# 触发策略：
+# - 默认不主动 review；任何 PR 打开 / 同步都不会自动调用模型，避免烧 OAuth token 额度。
+# - 评论 / review / issue 中出现 `@claude` 才触发，且发起者必须是仓库 OWNER（appergb）。
+# - 模型默认 claude-sonnet-4-6（量大、成本低）；评论里写 `--opus` 或包含 `claude-opus`
+#   字样会切到 claude-opus-4-7（用于需要更深推理的任务）。
+
+on:
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  issues:
+    types: [opened, assigned]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  claude:
+    # 双重门禁：(1) 内容含 @claude  (2) 触发者是 OWNER。
+    # author_association == 'OWNER' 是 GitHub 内建字段，免一次 API 调用。
+    if: |
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.author_association == 'OWNER') ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.author_association == 'OWNER') ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && github.event.review.author_association == 'OWNER') ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && github.event.issue.author_association == 'OWNER')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
+      actions: read # Required for Claude to read CI results on PRs
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Pick model (default sonnet, opt-in opus)
+        id: pick_model
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+          REVIEW_BODY: ${{ github.event.review.body }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          ISSUE_TITLE: ${{ github.event.issue.title }}
+        run: |
+          set -eu
+          body="${COMMENT_BODY}${REVIEW_BODY}${ISSUE_BODY}${ISSUE_TITLE}"
+          if [[ "$body" == *"--opus"* ]] || [[ "$body" == *"claude-opus"* ]]; then
+            echo "model=claude-opus-4-7" >> "$GITHUB_OUTPUT"
+          else
+            echo "model=claude-sonnet-4-6" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Run Claude Code
+        id: claude
+        uses: anthropics/claude-code-action@v1
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+
+          # 让 Claude 能看 CI 结果
+          additional_permissions: |
+            actions: read
+
+          # 模型策略：默认 sonnet，评论里 --opus 才升级到 opus
+          claude_args: '--model ${{ steps.pick_model.outputs.model }}'