Skip to content

Restriction of @claude mention - #175

Merged
MaryWylde merged 2 commits into
mainfrom
dev
Aug 11, 2026
Merged

Restriction of @claude mention#175
MaryWylde merged 2 commits into
mainfrom
dev

Conversation

@MaryWylde

@MaryWylde MaryWylde commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

No description provided.

MaryWylde and others added 2 commits August 11, 2026 12:20
@MaryWylde @claude
fix(ci): restrict @claude mention workflow to trusted authors
5f0d297 
This repo is public with issues enabled. The job only checked that the text
contained "@claude", so any GitHub user could trigger it by opening an issue.
Unlike a fork's pull_request run, `issues` and `issue_comment` events execute
in this repo's context and DO receive repository secrets, so those runs had
CLAUDE_CODE_OAUTH_TOKEN in the environment. And because the action executes
whatever instructions are in the comment that tagged it, reaching that token
needed no injection trick — just a comment.

Gates on author_association (OWNER / MEMBER / COLLABORATOR) per event, checked
against the account that actually triggered it. CONTRIBUTOR is excluded: it
only means someone had a commit merged once.

The check is deliberately not one shared OR across event types. On
issue_comment the payload carries both comment.author_association and
issue.author_association, so a flat OR would have let an untrusted account
comment on a trusted author's issue and pass.

Also:
- timeout-minutes: 15, so a wedged run cannot bill the subscription for the
  6h default.
- concurrency group per issue/PR, without cancel-in-progress — a superseded
  @claude task is still work someone asked for.
- drops id-token: write, which is only needed for OIDC federation and is dead
  weight on the static-token path.

No evidence of abuse: every run of this workflow to date was a legitimate
internal one, the most recent on 2026-06-23.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@MaryWylde
Merge pull request #174 from keepsimpleio/chore/gate-claude-mention-w…
4242572 
…orkflow

fix(ci): restrict @claude mention workflow to trusted authors
@github-actions

github-actions Bot commented Aug 11, 2026 •
edited
Loading

Copy link
Copy Markdown

Claude finished @MaryWylde's task in 1m 46s —— View job

Reviewing PR #175 — Restriction of @claude mention

  • Gather context (diff, workflow file)
  • Understand the request (code review of .github/workflows/claude.yml)
  • Review workflow changes for correctness/security
  • Post final review feedback

Summary

This PR gates the Claude Code workflow (.github/workflows/claude.yml) behind author_association checks, adds a per-issue/PR concurrency group, and adds a timeout-minutes: 15 cap. This is essentially the same change already merged into dev via #174 (commit 5f0d297), now being promoted to main.

Security fix is correct and well-reasoned. Previously the job triggered on any issue_comment/issues/pull_request_review* event whose body merely contained the text @claude — since this repo is public with issues enabled, issue_comment/issues run in the base-repo context and expose CLAUDE_CODE_OAUTH_TOKEN, so any outside user could trigger a run with attacker-controlled instructions. Gating on contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), ...) closes that.

Verified the gate logic per event type:

  • issue_comment / pull_request_review_comment / pull_request_review: checks the commenter's/reviewer's own author_association (not the issue/PR author's) — correctly avoids the flattened-OR trap called out in the inline comment (an untrusted commenter on a trusted user's thread would otherwise pass).
  • issues (opened/assigned): checks issue.author_association. For the assigned sub-event this still reflects the original issue author, so if an untrusted user opened an issue with @claude in the body, it correctly stays blocked even after a trusted member assigns it later — fails safe.
  • ${{ github.event.issue.number || github.event.pull_request.number }} correctly resolves for all four trigger event shapes (issue vs. PR-only events).

Minor, non-blocking observations:

  • permissions.id-token: write was dropped. Since the action authenticates via claude_code_oauth_token (not OIDC/cloud federation), this looks like a legitimate least-privilege cleanup rather than an oversight — worth a quick confirmation that nothing else in this workflow relied on the OIDC token, but nothing in the diff suggests it did.
  • Workflow-level concurrency (not job-level) means it's evaluated even for runs that will be skipped by the if: gate, but since gated-out runs complete almost immediately this isn't a meaningful DoS/starvation vector for legitimate queued requests.

No bugs, no AGENTS.md/CLAUDE.md convention violations (this is CI-only, no app code touched), and no changes to UX Core data. Looks good to merge.

@MaryWylde
MaryWylde merged commit e039bd3 into main Aug 11, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@MaryWylde