Fix security and permissions in Claude workflow files#2
Merged
Conversation
Copilot
AI
changed the title
[WIP] Add Claude Code GitHub workflow
Fix security and permissions in Claude workflow files
Jan 30, 2026
There was a problem hiding this comment.
Pull request overview
Updates the Claude-related GitHub Actions workflows to reduce unauthorized triggering risk and adjust token permissions to match intended functionality when interacting with PRs/issues.
Changes:
- Added
author_associationgating so@claudetriggers only run forOWNER,MEMBER, orCOLLABORATOR. - Added a non-fork guard to the PR code-review workflow to avoid running when secrets wouldn’t be available.
- Updated workflow formatting/style to align with existing repository workflow conventions (
---+ quoted"on"), and adjusted permissions towritewhere needed.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| .github/workflows/claude.yml | Adds association-based trigger restrictions and updates job token permissions for Claude’s repo interactions. |
| .github/workflows/claude-code-review.yml | Adds fork guard and updates PR permissions to allow the workflow to post/update PR review output. |
- Add author trust check to claude.yml (OWNER/MEMBER/COLLABORATOR only) - Update permissions to write for contents, PRs, and issues in claude.yml - Add YAML document header and quote 'on' key for consistency - Add fork guard to claude-code-review.yml to skip when secrets unavailable - Update permissions to write for pull-requests in claude-code-review.yml Co-authored-by: zircote <307960+zircote@users.noreply.github.com>
zircote
force-pushed
the
copilot/sub-pr-1
branch
from
cacb81f to
1f9f340
Compare
zircote
changed the base branch from
add-claude-github-actions-1769740011136
to
main
Code reviewNo issues found. Checked for bugs and CLAUDE.md compliance. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds author association security checks to the Claude Code workflow (
claude.yml):@claudetriggers toOWNER,MEMBER, orCOLLABORATORonlycontents,pull-requests,issuesfromreadtowriteto enable stated functionalityonkey, yamllint complianceThe
claude-code-review.ymlsecurity fixes (fork guard, write permissions) were applied directly tomainin commit 8d87d3b to unblock OIDC validation for this PR.