feat(ci): add Claude Code Action with lerobot-specific config by pkooij · Pull Request #3323 · huggingface/lerobot

pkooij · 2026-04-08T15:36:59Z

Summary

Adds Claude Code Action integration, building on and fixing the pre-commit failures from #3322.

.github/CLAUDE.md — repo-specific instructions Claude reads on every run: core abstractions, engineering principles, ML-specific checks (data leakage, loss correctness, DDP safety), and a PR checklist. Kept in .github/ so it does not appear at the repo root for contributors.

claude-code-review.yml — auto-reviews every PR with a structured lerobot-specific prompt, using claude-opus-4-6. Posts a single sticky comment (no thread spam).

claude.yml — responds to @claude mentions in PR/issue comments and reviews. Restricted to OWNER, MEMBER, and COLLABORATOR to prevent public API abuse.

Both workflows: pinned action SHA, persist-credentials: false, FORCE_JAVASCRIPT_ACTIONS_TO_NODE24, and actions: read for CI log access.

Note: The "Workflow validation failed" error on this PR is expected — new workflow files can only trigger after they exist on main.

Test plan

pre-commit run --all-files passes
After merge: open a test PR and verify Claude posts a sticky review comment
After merge: comment @claude on a PR and verify response

…ials: false Fixes pre-commit zizmor failures from PR #3322: - Pin anthropics/claude-code-action@v1 to commit hash (26ddc358) to satisfy blanket pinning policy - Add persist-credentials: false to actions/checkout steps to suppress credential-persistence warning - Remove trailing blank lines to satisfy end-of-file-fixer Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pkooij · 2026-04-08T15:42:14Z

@claude

- Add CLAUDE.md with lerobot-specific review instructions (core abstractions, engineering principles, ML-specific checks, PR checklist) - Enable use_sticky_comment: true on both workflows (single updating comment per PR) - Add structured lerobot-specific review prompt to claude-code-review.yml - Upgrade permissions: contents/pull-requests/issues write for interactive claude.yml - Add actions: read to claude-code-review.yml for CI log access - Set FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true to suppress Node.js 20 deprecation warnings Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…borators Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md is CI-only config — moving it to .github/ ensures it is not visible at the repo root when contributors clone lerobot. Both workflows now explicitly reference .github/CLAUDE.md in their prompt/system-prompt. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

s1lent4gnt · 2026-04-08T16:56:22Z

.github/workflows/claude.yml

+       (github.event.issue.author_association == 'OWNER' || github.event.issue.author_association == 'MEMBER' || github.event.issue.author_association == 'COLLABORATOR'))
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write


We should probably decrease the permission to read, to prevent prompt-injection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

imstevenpmwork · 2026-04-09T10:07:36Z

@claude Can you explain what's the difference between this PR and #3332 ?

claude · 2026-04-09T10:07:51Z

Claude Code is working…

I'll analyze this and get back to you.

View job run

imstevenpmwork · 2026-04-09T11:08:45Z

@claude Can you explain what's the difference between this PR and #3332 ?

claude · 2026-04-09T11:09:01Z

Claude finished @imstevenpmwork's task in 5m 9s —— View job

Comparing PR #3323 vs PR #3332

Gather context on this PR (feat(ci): add Claude Code Action with lerobot-specific config #3323)
Gather context on PR feat(ci): add agent assitance workflow #3332 (via what's on main)
Compare and explain differences

I wasn't able to fetch #3332's description directly, but I compared its code (now on main via #3333) against this PR's code. Here's the breakdown:

Scope

	This PR (#3323)	PR #3332 (on `main`)
Files	3 files: `CLAUDE.md`, `claude-code-review.yml`, `claude.yml`	1 file: `claude.yml` only
Auto-review	Yes — `claude-code-review.yml` runs on every PR open/sync	No
Domain instructions	Yes — `.github/CLAUDE.md` with lerobot-specific guidance (core abstractions, ML checks, review checklist)	No — relies on a generic anti-prompt-injection system prompt
Issue triggers	Yes — responds to `@claude` in newly opened/assigned issues	No — only PR/issue comments and PR reviews

Security approach

	This PR (#3323)	PR #3332 (on `main`)
Auth check	Inline `author_association` filter in the workflow `if:` condition	Separate shell step (`Authorize commenter`)
Repo guard	None	`github.repository == 'huggingface/lerobot'`
Prompt injection protection	None	`CLAUDE_SYSTEM_PROMPT` env var with explicit anti-injection instructions
Checkout action	`actions/checkout@v4` (tag)	`actions/checkout@de0fac2e...` (pinned SHA, v6.0.2)
Permissions	Job-level `permissions:` block	Top-level `permissions:` block
`contents` permission	`read`	`read`

Other differences

	This PR (#3323)	PR #3332 (on `main`)
`use_sticky_comment`	`true`	not set
`track_progress`	not set	`true`
`FORCE_JAVASCRIPT_ACTIONS_TO_NODE24`	`true`	not set
Claude system prompt	Points to `.github/CLAUDE.md` for lerobot conventions	Generic anti-prompt-injection instructions
`additional_permissions`	`actions: read` (for CI log access)	not set

Summary

feat(ci): add agent assitance workflow #3332 (already on main) is a minimal, security-hardened @claude mention handler — one workflow file, with prompt-injection protection, pinned SHAs, and a repo guard.
feat(ci): add Claude Code Action with lerobot-specific config #3323 (this PR) is a broader integration that adds domain-specific intelligence: an 86-line .github/CLAUDE.md with lerobot-specific review guidance (core abstractions, ML checks, engineering principles), plus a dedicated auto-review workflow that reviews every PR automatically. However, it would replace feat(ci): add agent assitance workflow #3332's security measures (prompt-injection protection, repo guard, pinned checkout SHA) with its own approach.

If this PR is to be merged on top of what's already on main, the claude.yml conflict will need to be resolved — ideally combining the security hardening from #3332 with the domain-specific features from this PR.

haixuanTao · 2026-04-09T11:17:09Z

@claude what’s up

imstevenpmwork · 2026-04-09T11:21:45Z

.github/workflows/claude-code-review.yml

+      id-token: write
+      actions: read
+    env:
+      FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true


@claude what is this doing?

imstevenpmwork · 2026-04-09T11:27:55Z

.github/workflows/claude.yml

+            actions: read
+
+          claude_args: '--system-prompt "Read .github/CLAUDE.md for lerobot-specific conventions before responding."'
+          # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md


@claude could you summarize the information in this link?

imstevenpmwork · 2026-04-09T11:30:53Z

@claude could you close this PR with a comment stating that it was superseded by: #3332 ?

claude · 2026-04-09T11:31:13Z

Claude finished @imstevenpmwork's task in 26s —— View job

Understand request: close this PR as superseded by feat(ci): add agent assitance workflow #3332
Close the PR with an explanatory comment

I'm unable to close PRs due to permission limitations of the GitHub App. You can close this PR manually by clicking the "Close pull request" button below, or by running:

gh pr close 3323 --comment "Superseded by #3332."

The comment explaining the closure has already been covered in the discussion above — #3332 (merged via #3333) provides the security-hardened Claude Code Action setup that is now on main.

imstevenpmwork · 2026-04-09T14:55:06Z

Superseded by: #3332

paulinebm and others added 3 commits April 8, 2026 17:22

"Claude PR Assistant workflow"

30d2fe3

"Claude Code Review workflow"

055f20f

github-actions bot added CI Issues related to the continuous integration pipeline github_actions labels Apr 8, 2026

pkooij changed the title ~~fix(ci): pin claude-code-action to commit SHA and fix pre-commit failures~~ feat(ci): add Claude Code Action workflows with CLAUDE.md and lerobot-specific review config Apr 8, 2026

github-actions bot added the documentation Improvements or fixes to the project’s docs label Apr 8, 2026

pkooij and others added 7 commits April 8, 2026 17:54

docs(claude): add Processor to core abstractions in CLAUDE.md

db7334a

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(ci): use claude-opus-4-6 for PR reviews

e8f504e

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge branch 'main' into fix/claude-code-action-precommit

9d97426

feat(ci): restrict @claude trigger to repo owners, members, and colla…

4b8436a

…borators Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docs(claude): remove LOC minimization guideline from CLAUDE.md

892e9f1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: remove root CLAUDE.md (moved to .github/CLAUDE.md)

b0286b1

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

pkooij changed the title ~~feat(ci): add Claude Code Action workflows with CLAUDE.md and lerobot-specific review config~~ feat(ci): add Claude Code Action with lerobot-specific config Apr 8, 2026

s1lent4gnt reviewed Apr 8, 2026

View reviewed changes

fix(ci): downgrade contents permission to read in claude.yml

63dedac

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

imstevenpmwork reviewed Apr 9, 2026

View reviewed changes

imstevenpmwork closed this Apr 9, 2026

Conversation

pkooij commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

pkooij commented Apr 8, 2026

Uh oh!

s1lent4gnt Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

pkooij Apr 8, 2026

Choose a reason for hiding this comment

Uh oh!

imstevenpmwork commented Apr 9, 2026

Uh oh!

claude bot commented Apr 9, 2026

Uh oh!

imstevenpmwork commented Apr 9, 2026

Uh oh!

claude bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Comparing PR #3323 vs PR #3332

Scope

Security approach

Other differences

Summary

Uh oh!

haixuanTao commented Apr 9, 2026

Uh oh!

imstevenpmwork Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

imstevenpmwork Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

imstevenpmwork commented Apr 9, 2026

Uh oh!

claude bot commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

imstevenpmwork commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

pkooij commented Apr 8, 2026 •

edited

Loading

claude bot commented Apr 9, 2026 •

edited

Loading

claude bot commented Apr 9, 2026 •

edited

Loading