fix(workflows): require trusted author for @claude trigger#1503
Open
NickNojiri wants to merge 1 commit into
Open
fix(workflows): require trusted author for @claude trigger#1503NickNojiri wants to merge 1 commit into
NickNojiri wants to merge 1 commit into
Conversation
The example workflows (examples/claude.yml, examples/claude-wif.yml) and this repo's own CI workflow (.github/workflows/claude.yml) gate on the trigger phrase alone: any actor whose comment, review, or issue body contains "@claude" starts the job, regardless of who posted it or whether it was a bot. Add an author_association check (OWNER/MEMBER/COLLABORATOR) and exclude bot senders, so the job itself does not start for untrusted or automated triggers rather than relying solely on the checks that run inside the action.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Related to #1481 and #1445. While looking into those, I found the specific
files with the gap they describe:
examples/claude.yml,examples/claude-wif.yml,and this repo's own
.github/workflows/claude.ymlall gate theclaudejobpurely on trigger-phrase presence (
contains(github.event.comment.body, '@claude')),with no check on who authored the comment/review/issue.
Note: I checked
docs/usage.mdand the/install-github-appcommand mentionedin #1481 — the former doesn't contain a trigger
if:example, and the latterlives in the separate
claude-codeCLI repo, so neither was in scope here. Ialso confirmed the action's own runtime checks (
checkHumanActor,checkWritePermissions) already reject bot/non-writer actors before Claudeexecutes — so this isn't closing an exploit, it's a fail-fast improvement:
the job no longer spins up a runner at all for an untrusted trigger, and the
example templates people copy now demonstrate the safer pattern by default.
Changes
Add to the
if:condition in all three files:github.event.sender.type != 'Bot'contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), <event>.author_association)per event type (comment/review/issue), matching the field each event
actually populates
Testing
bun test— 770 pass, 0 fail (no test changes needed; these are workflow configs)bun run typecheck/bun run format:check— clean