mirror of
https://github.com/openobserve/openobserve.git
synced 2026-11-05 16:10:43 +00:00
Ashish KolheandClaude Opus 4.5
c23f3ed23b
### **PR Type**
Enhancement
___
### **Description**
- New auto-implement workflow with team permission checks
• Detects PR vs issue and invokes reusable workflow
- New pr-fix workflow handling @claude_fix commands
• Context detection, branch creation, PR creation, success comments
- Added permission check to base `claude.yml` workflow
___
<details> <summary><h3> File Walkthrough</h3></summary>
<table><thead><tr><th></th><th align="left">Relevant
files</th></tr></thead><tbody><tr><td><strong>Enhancement</strong></td><td><table>
<tr>
<td>
<details>
<summary><strong>claude-auto-implement.yml</strong><dd><code>Add
auto-implement workflow with permissions</code>
</dd></summary>
<hr>
.github/workflows/claude-auto-implement.yml
<ul><li>Introduce <code>claude-auto-implement</code> workflow
triggers<br> <li> Add team membership check for @claude_impl
commands<br> <li> Detect PR vs issue mode and set branch/pr outputs<br>
<li> Invoke openobserve/o2-enterprise reusable workflow</ul>
</details>
</td>
<td><a
href="https://github.com/openobserve/openobserve/pull/9955/files#diff-8c42c989e1898874026d7b5ee03636f42ba74bb37fb7ce62c6741cbeb1b50125">+126/-0</a>
</td>
</tr>
<tr>
<td>
<details>
<summary><strong>claude-pr-fix.yml</strong><dd><code>Add pr-fix workflow
with permission check</code>
</dd></summary>
<hr>
.github/workflows/claude-pr-fix.yml
<ul><li>Introduce <code>claude-pr-fix</code> workflow for @claude_fix
commands<br> <li> Add team membership check and context detection<br>
<li> Call reusable workflow and create PR for issue fixes<br> <li> Post
success comments and reactions</ul>
</details>
</td>
<td><a
href="https://github.com/openobserve/openobserve/pull/9955/files#diff-38d41a683d1962f3da3e5c040ca36285ddb03170285c12bef918173d881310b0">+279/-0</a>
</td>
</tr>
</table></td></tr><tr><td><strong>Configuration
changes</strong></td><td><table>
<tr>
<td>
<details>
<summary><strong>claude.yml</strong><dd><code>Add permission check to
base workflow</code>
</dd></summary>
<hr>
.github/workflows/claude.yml
<ul><li>Add <code>check-permission</code> job before main
<code>claude</code> job<br> <li> Verify <code>argocd-dev</code> team
membership on trigger<br> <li> Comment when unauthorized users invoke
commands</ul>
</details>
</td>
<td><a
href="https://github.com/openobserve/openobserve/pull/9955/files#diff-53fec9c265fdba82268df5cd90315b8da57cce43d8e20efbf5c0bdcd1de1342e">+53/-0</a>
</td>
</tr>
</table></td></tr></tr></tbody></table>
</details>
___
---------
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
91 lines
3.6 KiB
YAML
91 lines
3.6 KiB
YAML
name: Claude Code
|
|
|
|
on:
|
|
issue_comment:
|
|
types: [created]
|
|
pull_request_review_comment:
|
|
types: [created]
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Security: Check if user is a member of argocd-dev team
|
|
check-permission:
|
|
if: |
|
|
github.event.sender.type != 'Bot' && (
|
|
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
|
|
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
|
|
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
|
|
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))))
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
authorized: ${{ steps.check.outputs.authorized }}
|
|
steps:
|
|
- name: Check team membership
|
|
id: check
|
|
uses: actions/github-script@v7
|
|
with:
|
|
github-token: ${{ secrets.E2E_DEV_CI_TOKEN }}
|
|
script: |
|
|
const team = 'argocd-dev';
|
|
const org = 'openobserve';
|
|
const username = context.actor;
|
|
|
|
try {
|
|
// Check if user is a member of the team
|
|
await github.rest.teams.getMembershipForUserInOrg({
|
|
org: org,
|
|
team_slug: team,
|
|
username: username
|
|
});
|
|
console.log(`✅ ${username} is a member of ${org}/${team}`);
|
|
core.setOutput('authorized', 'true');
|
|
} catch (error) {
|
|
if (error.status === 404) {
|
|
console.log(`❌ ${username} is NOT a member of ${org}/${team}`);
|
|
core.setOutput('authorized', 'false');
|
|
|
|
// Get the issue/PR number for commenting
|
|
const issueNumber = context.issue?.number || context.payload.pull_request?.number;
|
|
if (issueNumber) {
|
|
await github.rest.issues.createComment({
|
|
owner: context.repo.owner,
|
|
repo: context.repo.repo,
|
|
issue_number: issueNumber,
|
|
body: `⚠️ @${username} You don't have permission to trigger \`@claude\`. Only members of the [argocd-dev](https://github.com/orgs/openobserve/teams/argocd-dev) team can use this command.`
|
|
});
|
|
}
|
|
} else {
|
|
throw error;
|
|
}
|
|
}
|
|
|
|
claude:
|
|
needs: check-permission
|
|
if: |
|
|
needs.check-permission.outputs.authorized == 'true' &&
|
|
github.event.sender.type != 'Bot' && (
|
|
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
|
|
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
|
|
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
|
|
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))))
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
pull-requests: write
|
|
issues: write
|
|
id-token: write
|
|
actions: read # Required for Claude to read CI results on PRs
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 1
|
|
|
|
- name: Run Claude Code
|
|
id: claude
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|