ci: respond to PR comments via claude-code-action on the Max plan

[etrobert-bot]

Adds a workflow so any human comment or review on a PR is automatically addressed or answered — no @claude mention needed. This runs on the Claude Max subscription (via CLAUDE_CODE_OAUTH_TOKEN), not API credits, so it consumes plan capacity you've already paid for.

How it works

• Triggers on issue_comment, pull_request_review_comment, and pull_request_review (submitted).
• Runs anthropics/claude-code-action@v1 with an explicit prompt: read the comment in context, then push a fix to the PR branch (for change requests/suggestions) or reply (for questions). Follows the repo's Conventional Comments convention. Never merges — a human still reviews and merges.
• Loop-guarded twice: the job if skips sender.type == 'Bot', and exclude_comments_by_actor ignores Claude's own replies. Per-PR concurrency group prevents pile-ups.

⚠️ Required setup before this works (repo-admin only — etrobert, not the bot)

1. Generate a token on your Max account: run claude setup-token locally (opens an OAuth flow, prints a long-lived token).
2. Add it as a repo secret named CLAUDE_CODE_OAUTH_TOKEN (Settings → Secrets and variables → Actions).
3. Install the Claude GitHub App on the repo (https://github.com/apps/claude) so commits Claude pushes re-trigger the Nix CI workflow. (Without the app it falls back to GITHUB_TOKEN; commits then won't re-run CI.)

Until the secret exists the workflow runs but the action step fails auth — harmless, just no-ops.

Trade-offs to be aware of

• Quota: every qualifying comment spawns an agent run drawing from your Max limits, which can compete with interactive Claude Code usage in the same 5-hour window. (source)
• Scope: this responds to all human comments. To make it @claude-only later, drop the prompt and add trigger_phrase: "@claude".
• GitHub Actions minutes: runs on GitHub-hosted ubuntu-latest.

Verified locally: actionlint clean, nix fmt . -- --ci reports 0 changed.

🤖 Generated with Claude Code