/install-github-app generates no-op workflows: missing --comment + read-only permissions

[MrMatthewDavis]

Summary

Running /install-github-app generates two workflows — .github/workflows/claude.yml and .github/workflows/claude-code-review.yml — that are functionally no-ops out of the box due to two independent defects. The review workflow runs on every PR, consumes a full agent run, and posts nothing; users only discover this by opening the Actions logs.

Generated with Claude Code CLI 2.1.162, using anthropics/claude-code-action@v1.

Defect 1 — review prompt is missing --comment, so nothing is ever posted

The generated claude-code-review.yml invokes:

prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

But the code-review plugin command (from the anthropics/claude-code.git marketplace) gates all PR commenting behind a --comment argument. Its step 7 reads verbatim:

If --comment argument was NOT provided, stop here. Do not post any GitHub comments.

So as generated, the workflow reviews each PR and then stops at the terminal summary — no inline comments, no summary comment. The integration silently appears to do nothing.

Fix: the generated prompt should include --comment:

prompt: '/code-review:code-review --comment ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

Defect 2 — generated job permissions are read-only, diverging from the documented examples

Both generated workflows scope the job token read-only:

# claude-code-review.yml (generated)
permissions:
  contents: read
  pull-requests: read
  issues: read
  id-token: write

# claude.yml (generated)
permissions:
  contents: read
  pull-requests: read
  issues: read
  id-token: write
  actions: read

This diverges from the repo's own examples, which use write scopes:

• examples/claude.yml → contents: write, pull-requests: write, issues: write
• examples/pr-review-comprehensive.yml → pull-requests: write

Nuance / open question: when the official Claude GitHub App is installed (which /install-github-app does), docs/security.md indicates GitHub writes go through the app installation token (Contents/PRs/Issues Read & Write), and action.yml's output is documented as the "Claude App token if available". If that token is what posts comments, the read-only workflow permissions: block may not actually block posting — in which case the generated read-only scopes are merely inconsistent with the examples rather than strictly broken. It would help to clarify in the docs which token is used for comment-posting, and to make the generated templates consistent with whichever is correct.

Repro

1. In any repo, run /install-github-app and complete the OAuth flow.
2. Inspect the two generated workflow files on the PR it opens.
3. Observe: review prompt lacks --comment; both permissions: blocks are read-only.
4. Merge and open a test PR → the Claude Code Review job runs green but posts no review.

Suggested fix

The /install-github-app generator should emit:

• --comment in the claude-code-review.yml review prompt, and
• write scopes matching the documented examples (pull-requests: write for the review workflow; contents/pull-requests/issues: write for claude.yml).

Happy to send a PR if useful.

[anishesg]

Took a look, #1399 should address it.