Fix Claude workflow spam prevention #1779
Conversation
WalkthroughAdds an extra guard in .github/workflows/claude.yml to skip workflow runs when the actor is claude[bot] for issue_comment, pull_request_review_comment, and pull_request_review events. The issues trigger is unchanged. Changes
Sequence Diagram(s)sequenceDiagram
autonumber
participant GH as GitHub Events
participant WF as Workflow: claude.yml
participant Jobs as Jobs
rect rgba(223,239,255,0.5)
note over GH,WF: Event triggers
GH->>WF: issue_comment / pr_review_comment / pr_review
alt actor == "claude[bot]"
WF-->>GH: Skip (if-condition false)
else other actor
WF->>Jobs: Run jobs
end
end
GH->>WF: issues
note over WF,Jobs: Unchanged behavior
WF->>Jobs: Run jobs
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches🧪 Generate unit tests
Tip 👮 Agentic pre-merge checks are now available in preview!Pro plan users can now enable pre-merge checks in their settings to enforce checklists before merging PRs.
Please see the documentation for more information. Example: reviews:
pre_merge_checks:
custom_checks:
- name: "Undocumented Breaking Changes"
mode: "warning"
instructions: |
Pass/fail criteria: All breaking changes to public APIs, CLI flags, environment variables, configuration keys, database schemas, or HTTP/GraphQL endpoints must be documented in the "Breaking Change" section of the PR description and in CHANGELOG.md. Exclude purely internal or private changes (e.g., code not exported from package entry points or explicitly marked as internal).Please share your feedback with us on this Discord post. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Code Review for PR #1779: Fix Claude workflow spam preventionSummaryThis PR addresses two main areas:
✅ Strengths1. Workflow Fix
2. Copyright Headers
🔍 Observations & Suggestions1. Performance & Security
2. Test Coverage
3. Best Practices
4. Minor Improvements
🎯 Potential IssuesNone identified. The changes are focused and address the stated problem effectively. 📋 Verification Checklist
Verdict: APPROVED ✅This is a well-executed fix that solves the feedback loop issue while also improving code documentation through copyright headers. The changes are minimal, focused, and carry no risk to existing functionality. The spam prevention fix is particularly important as it prevents potential resource exhaustion and unnecessary CI runs. Great work on identifying and fixing this issue promptly! |
Prevents feedback loop where Claude Code Review comments trigger the interactive Claude workflow, causing spam comments. The interactive workflow should only trigger on human @claude mentions, not bot comments. Fixes workflow spam issue seen in PR #1776. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
ihabadham
force-pushed
the
fix/claude-workflow-spam-prevention
branch
from
09a9429 to
461e2f8
Compare
Code ReviewSummaryThis PR addresses a critical issue with the Claude workflow that could cause feedback loops when the Claude bot mentions itself in comments. The fix is simple and effective. ✅ Strengths
🔍 Areas for Improvement
🐛 Potential IssuesThe condition for 'issues' event (line 19) lacks the same user check. This could lead to:
💡 SuggestionsConsider extracting the bot check into a reusable expression for the issues event: (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && github.event.issue.user.login != 'claude[bot]')✅ Security AssessmentNo security concerns identified. The change appropriately restricts workflow execution. Performance ConsiderationsThe additional conditions have negligible performance impact as they're simple string comparisons evaluated at workflow start. Overall AssessmentGood fix that addresses the immediate problem. However, please consider:
Recommendation: Approve with minor changes - specifically adding the user check to the issues event type to ensure complete spam prevention. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (3)
.github/workflows/claude.yml (3)
16-19: Prefer a single, top‑level actor guard and null‑safe review body checkReduce duplication and decouple from payload shape by gating once on
github.actor, and makereview.bodynull‑safe. Behavior is unchanged but more robust.Proposed diff:
- if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.login != 'claude[bot]') || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.login != 'claude[bot]') || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && github.event.review.user.login != 'claude[bot]') || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + if: | + github.actor != 'claude[bot]' && ( + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body || '', '@claude')) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + )Please confirm the bot’s exact login is
claude[bot]in your audit logs. If it differs, update the string accordingly.
19-19: Do you also want to suppress runs for issues opened by Claude?Currently, a new issue that includes “@claude” in the title/body will still trigger the workflow even if opened by Claude. If the goal is to fully prevent self‑trigger loops, extend the actor guard to the issues case as well (the refactor above already covers this). If this is intentional, ignore.
13-21: Add concurrency to prevent duplicate/overlapping runs per comment/reviewThis further reduces spam by ensuring only one run per source event executes if multiple triggers occur close together.
Suggested snippet (add under
jobs.claude:):concurrency: group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.comment.id || github.event.review.id || github.event.issue.id || github.run_id }} cancel-in-progress: true
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/claude.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (5)
- GitHub Check: dummy-app-integration-tests (newest)
- GitHub Check: dummy-app-integration-tests (oldest)
- GitHub Check: rspec-package-tests (newest)
- GitHub Check: build
- GitHub Check: rspec-package-tests (oldest)
Code Review for PR #1779: Fix Claude workflow spam prevention✅ Overall AssessmentThis is a well-targeted fix that addresses the feedback loop issue by preventing the Claude bot from triggering its own workflow. The implementation is clean and follows best practices. 🎯 Code Quality & Best Practices
🐛 Potential Issues
⚡ Performance Considerations
🔒 Security Concerns
🧪 Test Coverage
📝 Suggestions for Improvement
✨ SummaryThis is a straightforward and effective fix for issue #1776. The implementation correctly prevents the Claude bot from triggering workflows on its own activity while maintaining functionality for human interactions. Ready to merge after verifying the bot username format. Great work on identifying and fixing this issue quickly! 🚀 |
Code ReviewSummaryThis PR addresses issue #1776 by preventing the Claude bot from triggering itself in an infinite loop. The solution adds conditions to check if the comment author is 'claude[bot]' before triggering the workflow. ✅ Strengths
🔍 Observations & Suggestions1. Bot Username FormatThe condition checks for 'claude[bot]' but GitHub bot usernames typically use square brackets. Please verify this is the correct format for your Claude bot. You might want to consider:
2. Missing Test CoverageWhile this is a workflow file that's harder to unit test, consider:
3. Security Consideration✅ Good: The change doesn't introduce any new permissions or security concerns. It actually improves security by preventing potential abuse through feedback loops. 4. Performance Impact✅ Positive: This will reduce unnecessary workflow runs, saving CI resources and reducing noise in the repository. 5. Edge Cases to Consider
📋 Recommendations
VerdictApproved with suggestions ✅ This is a good, focused fix that addresses the immediate problem. The implementation is clean and follows the existing pattern in the workflow file. Once you've verified the bot username format, this should effectively prevent the feedback loop issue. |
Code Review: Fix Claude Workflow Spam Prevention🎯 SummaryThis PR correctly addresses the feedback loop issue where the Claude bot's own comments were triggering the workflow again, creating a spam situation. The solution is simple and effective. ✅ Strengths
🔍 Code Quality & Best PracticesThe implementation is clean and follows GitHub Actions best practices. The conditions are readable and maintainable. 🐛 Potential Issues
🚀 Performance ConsiderationsThis change will reduce unnecessary workflow runs, which is good for:
🔐 Security ConcernsNo security issues identified. The change actually improves security posture by preventing potential abuse through bot loops. 🧪 Test Coverage RecommendationsWhile this is a workflow configuration change that doesn't require traditional unit tests, consider:
📝 Suggestions for Improvement
✅ ApprovalThis is a solid fix that addresses the immediate problem effectively. The implementation is correct and should resolve the spam issue described in #1776. Recommendation: Ready to merge after verifying the exact bot username format matches 'claude[bot]'. |
Code Review for PR #1779: Fix Claude workflow spam prevention✅ Overall AssessmentThis is a well-targeted and effective fix for preventing the Claude bot from triggering its own workflow, which was causing the feedback loop issue described in #1776. Strengths
🔍 Areas for Consideration
💡 Suggestions for Improvement
✅ Security & Performance
📋 Testing Recommendations
Verdict: APPROVED ✅This is a clean, effective fix that solves the immediate feedback loop problem. The implementation follows best practices and carries no risk to existing functionality. Great work on quickly identifying and addressing this issue! Note: Consider adding the user check to the 'issues' event as well for complete spam prevention coverage. |
Code Review for PR #1779: Fix Claude workflow spam prevention🎯 SummaryThis PR correctly addresses the feedback loop issue where the Claude bot could trigger itself, causing spam comments. The solution adds user login checks to prevent the bot from responding to its own comments. ✅ Strengths
🔍 Issues & Recommendations1. Inconsistent Bot Name Pattern 🚨The PR uses 'claude[bot]' but should verify this matches the actual bot username. GitHub Apps typically have names like 'app-name[bot]'. Recommendation: Verify the exact bot username format in your GitHub organization. You might need to check for both patterns:
2. Missing Updates to claude-code-review.yml
|
Code Review for PR #1779: Fix Claude workflow spam prevention✅ SummaryThis PR successfully addresses the feedback loop issue that was causing the Claude bot to spam comments. The solution is clean, targeted, and follows best practices. 📋 Review AreasCode Quality and Best Practices ✅
Potential Bugs or Issues
|
Code Review for PR #1779: Fix Claude workflow spam preventionSummaryThis PR addresses a critical feedback loop issue where the Claude bot could trigger itself repeatedly, causing spam comments. The fix adds a check to prevent the workflow from running when triggered by the Claude bot itself. Strengths
Code Quality & Best PracticesThe implementation follows GitHub Actions best practices by using the built-in github.event context correctly. The condition checks are clear and maintainable. Potential IssuesBot username inconsistency: The check uses 'claude[bot]' but different bot installations might have variations like:
Consider using a more flexible pattern or confirming the exact bot username in your repository. Suggestions for Improvement
Security ConsiderationsNo security concerns identified. The change appropriately restricts workflow execution without introducing new attack vectors. Test CoverageWhile this workflow change doesn't require traditional unit tests, consider:
Overall AssessmentApproved ✅ - This is a clean, focused fix that addresses the spam issue effectively. The implementation is straightforward and follows GitHub Actions best practices. With the minor improvements suggested above (especially verifying the exact bot username), this should resolve the feedback loop problem. |
Code Review for PR #1779: Fix Claude Workflow Spam Prevention✅ Overall AssessmentThis is a well-targeted fix that effectively addresses the feedback loop issue described in #1776. The solution is simple, focused, and follows GitHub Actions best practices. Strengths
🔍 Areas for Consideration
Performance & Security
Test Coverage
📋 PR Checklist Items
Verdict: APPROVED ✅This is an effective fix that addresses the immediate problem. Once you verify the bot username format and consider adding protection for the issues event, this will completely resolve the spam issue. Great work on quickly identifying and fixing this issue! 🚀 |
Pull Request ReviewThank you for addressing the Claude bot spam prevention issue! Here's my review of the changes: ✅ Code Quality AssessmentThe implementation is clean and follows best practices for GitHub Actions workflows. The solution directly addresses the root cause of the feedback loop by checking the comment author's username. 🔍 Technical AnalysisWhat's Fixed:
Implementation Details:
|
Code Review for PR #1779: Fix Claude workflow spam preventionSummaryThis PR addresses an important issue preventing feedback loops where the Claude bot's own comments trigger workflow re-runs. The implementation is clean and follows best practices. ✅ Strengths
🔍 Observations & Suggestions1. Security ConsiderationThe check uses 2. Performance Impact✅ No performance concerns - these checks are evaluated at workflow trigger time and add negligible overhead. 3. Test CoverageWhile GitHub workflow testing is challenging, consider:
4. Edge CasesThe implementation correctly handles all current trigger points. One consideration:
📝 Minor SuggestionsConsider adding a comment above the condition block explaining the purpose: jobs:
claude:
# Prevent feedback loops by ignoring events triggered by the Claude bot itself
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && github.event.comment.user.login != 'claude[bot]') ||
...✅ ApprovalThis is a well-crafted fix that solves the spam issue effectively. The changes are minimal, targeted, and maintain the existing functionality for human interactions. The implementation follows GitHub Actions best practices. No bugs or security issues identified. The solution appropriately addresses the feedback loop problem described in the PR summary. Great work on identifying and fixing this issue! 🚀 |
Code Review for PR #1779: Fix Claude workflow spam preventionOverall Assessment ✅This PR effectively addresses the feedback loop issue from #1776. The solution correctly prevents the Claude bot from triggering workflows when it comments on PRs, which should eliminate the spam problem. Code Quality & Best Practices ✅
Potential Issues & Considerations
|
Code Review for PR #1779: Fix Claude workflow spam preventionSummaryThis PR successfully addresses the feedback loop issue that was causing the Claude bot to spam comments by adding user login checks to prevent the bot from triggering its own workflow. Code Quality & Best Practices ✅The implementation follows GitHub Actions best practices:
Potential Issues
|
Pull Request Review: Fix Claude workflow spam prevention✅ Overall AssessmentThis PR successfully addresses the feedback loop issue causing spam comments from the Claude bot. The solution is simple, effective, and correctly implemented. Code Quality and Best Practices ⭐⭐⭐⭐⭐
Potential Issues
|
Code Review for PR #1779: Fix Claude workflow spam prevention✅ Overall AssessmentThis is a well-targeted fix that addresses the feedback loop issue causing spam comments from the Claude bot. The solution is simple, effective, and correctly applied. 🎯 Code Quality & Best PracticesGood:
Suggestions:
🔍 Potential Issues
⚡ Performance Considerations
🔒 Security Concerns
🧪 Test Coverage RecommendationsWhile this is a CI configuration change that's difficult to unit test, consider:
📝 Additional Recommendations
✨ SummaryThis is a clean, effective fix for issue #1776. The implementation correctly prevents the Claude bot from triggering itself while preserving the intended functionality for human users. Once you verify the bot username format and consider the minor suggestions above, this is ready to merge. Great work on identifying and fixing this feedback loop issue! 🚀 |
Code Review for PR #1779: Fix Claude Workflow Spam Prevention✅ SummaryThis PR effectively addresses the feedback loop issue that was causing Claude bot to spam comments. The solution is simple, targeted, and follows best practices for preventing bot recursion in GitHub Actions. 🎯 Code Quality AssessmentStrengths:
Areas for Improvement:
🐛 Potential Issues
⚡ Performance Considerations
🔒 Security Concerns
📝 Recommendations
✅ VerdictAPPROVED - This is a well-targeted fix that addresses the core issue without introducing complexity. The change follows GitHub Actions best practices for preventing bot recursion. Great work on identifying and fixing this issue quickly! 🎉 |
Code Review for PR #1779: Fix Claude workflow spam prevention✅ Overall AssessmentGreat initiative to fix the spam loop issue! The solution is correct and addresses the root cause effectively. 📋 Review SummaryCode Quality & Best Practices ✅
Bug Analysis ✅
Performance Considerations ✅
Security Concerns ✅
|
Code Review for PR #1779: Fix Claude workflow spam prevention✅ Overall AssessmentThis is a well-targeted and effective fix that addresses the feedback loop issue described in #1776. The implementation is clean and follows GitHub Actions best practices. Strengths
🔍 Areas for Consideration
💡 Suggestions for Improvement
✅ Security & Performance
🧪 Test CoverageWhile this is a workflow configuration that doesn't require traditional unit tests, after merging please:
📋 PR Checklist Items
Verdict: APPROVED ✅This is a solid fix that effectively addresses the feedback loop issue. The implementation is correct and should resolve the spam problem. I recommend merging after:
Great work on identifying and fixing this issue promptly! 🚀 |
Code Review for PR #1779: Fix Claude workflow spam prevention✅ Overall AssessmentThis is a well-targeted fix that addresses the feedback loop issue where the Claude bot was triggering its own workflow. The implementation is clean and follows GitHub Actions best practices. 🎯 Code Quality & Best PracticesGood:
🐛 Potential IssuesNone identified. The condition properly checks for both:
This ensures the workflow only runs for human-initiated mentions. ⚡ Performance ConsiderationsPositive impact: This change will reduce unnecessary workflow runs, saving CI minutes and reducing noise in the Actions tab. 🔒 Security ConcernsNone. The change actually improves security posture by preventing potential abuse through automated triggering loops. 🧪 Test CoverageWhile this workflow change doesn't require traditional unit tests, consider:
💡 SuggestionsConsider adding a comment above the condition to explain the bot exclusion: # Exclude bot users to prevent feedback loops where the bot triggers its own workflow✔️ RecommendationApprove and merge. This is a straightforward, correct fix for the reported issue. The implementation properly prevents the feedback loop while maintaining all intended functionality for human users. |
Code Review for PR #1779: Fix Claude Workflow Spam Prevention✅ Overall AssessmentThis PR effectively addresses the feedback loop issue where the Claude bot was triggering its own workflow. The solution is simple, targeted, and follows GitHub Actions best practices. Strengths
🔍 Observations & Recommendations
💡 Enhanced Solution (optional)# Prevent feedback loops from bot's own activity
if: |
github.actor != 'claude[bot]' && (
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body || '', '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
)✅ Security & Performance Impact
Test CoverageWhile this workflow change doesn't require traditional unit tests, please verify after merging:
Verdict: APPROVED ✅This is a well-executed fix that solves the immediate problem. The only critical recommendation is to verify the bot username format and consider adding the same check to the |
|
I don't see why we should deviate from the standard workflow. |
Trying to address claude bot spamming #1776 with reviews
Summary
Fixes feedback loop causing spam comments from Claude bot.
Pull Request checklist
This change is
Summary by CodeRabbit