Claude commit analysis on demand (workflow_dispatch)

Runs in GitHub Actions on your Claude Pro or Max plan through an OAuth token from claude setup-token. No API credits.

Set up the "Claude commit analysis on demand (workflow_dispatch)" GitHub workflow from AgentFlows (https://agentflows.sh/flows/claude-code-action-manual-code-analysis) so it runs on my Claude Pro or Max subscription instead of API credits.

Install these agent skills first. Download each SKILL.md from its source (respect its license) into .claude/skills/<name>/SKILL.md, or wherever this agent loads skills from:
- Code review: https://github.com/anthropics/knowledge-work-plugins/blob/main/engineering/skills/code-review/SKILL.md (Apache-2.0), notes at https://agentflows.sh/skills/code-review

Save this file as .github/workflows/claude-code-action-manual-code-analysis.yml:

```yaml
name: Claude Commit Analysis

on:
  workflow_dispatch:
    inputs:
      analysis_type:
        description: "Type of analysis to perform"
        required: true
        type: choice
        options:
          - summarize-commit
          - security-review
        default: "summarize-commit"

jobs:
  analyze-commit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: write
      id-token: write

    steps:
      - name: Checkout repository
        uses: actions/checkout@v6
        with:
          fetch-depth: 2 # Need at least 2 commits to analyze the latest

      - name: Run Claude Analysis
        uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          prompt: |
            REPO: ${{ github.repository }}
            BRANCH: ${{ github.ref_name }}

            Analyze the latest commit in this repository.

            ${{ github.event.inputs.analysis_type == 'summarize-commit' && 'Task: Provide a clear, concise summary of what changed in the latest commit. Include the commit message, files changed, and the purpose of the changes.' || '' }}

            ${{ github.event.inputs.analysis_type == 'security-review' && 'Task: Review the latest commit for potential security vulnerabilities. Check for exposed secrets, insecure coding patterns, dependency vulnerabilities, or any other security concerns. Provide specific recommendations if issues are found.' || '' }}
```

It authenticates with CLAUDE_CODE_OAUTH_TOKEN. Tell me to run `claude setup-token` in my own terminal to create it, then run `gh secret set CLAUDE_CODE_OAUTH_TOKEN` and let me paste it. Never write the token into a file.

It runs on: workflow_dispatch (manual: summarize-commit or security-review). Runs count against my subscription's usage limits, and GitHub Actions minutes still apply.

Show me the diff, then commit on a new branch and open a pull request.