Make Claude PR code review workflow manual #9
Conversation
BenGWeeks
commented
Jan 4, 2026
BenGWeeks
commented
- Remove automatic trigger on pull_request events
- Add workflow_dispatch for manual UI trigger with PR number input
- Add issue_comment trigger for /claude-review command on PRs
- Add step to dynamically determine PR number from trigger source
- Remove automatic trigger on pull_request events - Add workflow_dispatch for manual UI trigger with PR number input - Add issue_comment trigger for /claude-review command on PRs - Add step to dynamically determine PR number from trigger source
There was a problem hiding this comment.
Pull request overview
This PR converts the Claude Code Review workflow from automatic triggering on pull requests to manual triggering. The workflow can now be triggered either through the GitHub Actions UI with a PR number input, or via a /claude-review command in PR comments.
Key changes:
- Replaced automatic
pull_requesttrigger with manualworkflow_dispatchandissue_commenttriggers - Added conditional job execution to filter for PR comments with the trigger phrase
- Implemented dynamic PR number extraction based on the trigger source
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Only run on PR comments (not issue comments) with trigger phrase, or on manual dispatch | ||
| if: | | ||
| github.event_name == 'workflow_dispatch' || | ||
| (github.event.issue.pull_request && contains(github.event.comment.body, '/claude-review')) |
There was a problem hiding this comment.
The issue_comment trigger allows any user to trigger this workflow by commenting on a PR. This could be a security concern if you want to restrict who can trigger code reviews. Consider adding a permission check in the if condition to verify that the commenter has appropriate permissions (e.g., checking github.actor against an allowed list, or verifying github.event.comment.author_association is OWNER, MEMBER, or COLLABORATOR).
| # Only run on PR comments (not issue comments) with trigger phrase, or on manual dispatch | |
| if: | | |
| github.event_name == 'workflow_dispatch' || | |
| (github.event.issue.pull_request && contains(github.event.comment.body, '/claude-review')) | |
| # Only run on PR comments (not issue comments) with trigger phrase from authorized users, or on manual dispatch | |
| if: | | |
| github.event_name == 'workflow_dispatch' || | |
| ( | |
| github.event.issue.pull_request && | |
| contains(github.event.comment.body, '/claude-review') && | |
| ( | |
| github.event.comment.author_association == 'OWNER' || | |
| github.event.comment.author_association == 'MEMBER' || | |
| github.event.comment.author_association == 'COLLABORATOR' | |
| ) | |
| ) |
Address GitHub Copilot security feedback by restricting the issue_comment trigger to authorized users only (OWNER, MEMBER, COLLABORATOR). This prevents unauthorized users from consuming workflow resources.
2 participants
