From 56e8fe272eb4eb0e131ee73f7c9d62f90ca4e548 Mon Sep 17 00:00:00 2001 From: Chris Hager Date: Thu, 29 Jan 2026 09:31:04 +0100 Subject: [PATCH] CI: Restrict Claude Code triggers to users with write-access --- .github/workflows/claude.yaml | 24 ++++++++++++++++-------- 1 file changed, 16 insertions(+), 8 deletions(-) diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml index a21cf17..48f07bf 100644 --- a/.github/workflows/claude.yaml +++ b/.github/workflows/claude.yaml @@ -20,7 +20,7 @@ jobs: # Auto-review for same-repo PRs claude-review: if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository - runs-on: ubuntu-latest + runs-on: warp-ubuntu-latest-x64-8x steps: - uses: actions/checkout@v6 with: @@ -55,8 +55,9 @@ jobs: if: | github.event_name == 'issue_comment' && github.event.issue.pull_request && - contains(github.event.comment.body, '@claude review') - runs-on: ubuntu-latest + contains(github.event.comment.body, '@claude review') && + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) + runs-on: warp-ubuntu-latest-x64-8x steps: - uses: actions/checkout@v6 with: @@ -91,13 +92,20 @@ jobs: - Only use inline comments for problems, not praise. # General interactive mode - responds to @claude mentions (but NOT review requests on PRs) + # Restricted to users with write access (OWNER, MEMBER, COLLABORATOR) claude-response: if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && !contains(github.event.comment.body, '@claude review')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && !contains(github.event.comment.body, '@claude review')) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && !contains(github.event.review.body, '@claude review')) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) - runs-on: ubuntu-latest + ( + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) || + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association) || + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association) + ) && ( + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) || + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && !contains(github.event.comment.body, '@claude review')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && !contains(github.event.review.body, '@claude review')) + ) + runs-on: warp-ubuntu-latest-x64-8x steps: - uses: actions/checkout@v6 with: