CI: Restrict Claude Code triggers to users with write-access (#874)

Author: metachris

.github/workflows/claude.yaml

@@ -20,9 +20,9 @@ jobs:
   # Auto-review for same-repo PRs
   claude-review:
     if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository
-    runs-on: ubuntu-latest
+    runs-on: warp-ubuntu-latest-x64-8x
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
       - uses: anthropics/claude-code-action@v1
@@ -36,30 +36,30 @@ jobs:
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.pull_request.number }}
 
-            Act as a code reviewer for this pull request. Focus your review on:
+            Review this PR. Focus on:
             - Overall code quality and adherence to best practices
             - Possible bugs, edge cases, or logical errors
             - Security concerns or unsafe patterns
-            - Performance characteristics and potential optimizations
+            - Performance characteristics, issues and potential optimizations
 
-            Provide thorough, actionable feedback, and use inline comments for any line-specific issues you identify.
+            Be concise. Only comment on issues that need attention - no praise or positive comments.
 
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for summary or top-level feedback on the PR.
-            Use `mcp__github_inline_comment__create_inline_comment` to annotate specific code issues inline.
-            Only post GitHub comments - don't submit review text as messages.
-            Use top-level comments for general observations or praise.
+            Notes:
+            - The PR branch is already checked out in the current working directory.
+            - Use `gh pr comment` for summary or top-level feedback on the PR.
+            - Use `mcp__github_inline_comment__create_inline_comment` to annotate specific code issues inline.
+            - Only use inline comments for problems, not praise.
 
   # Manual review triggered by "@claude review" comment (works for forks too)
   claude-manual-review:
     if: |
       github.event_name == 'issue_comment' &&
       github.event.issue.pull_request &&
-      contains(github.event.comment.body, '@claude review')
-    runs-on: ubuntu-latest
+      contains(github.event.comment.body, '@claude review') &&
+      contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)
+    runs-on: warp-ubuntu-latest-x64-8x
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
       - name: Checkout PR branch
@@ -77,31 +77,37 @@ jobs:
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ github.event.issue.number }}
 
-            Act as a code reviewer for this pull request. Focus your review on:
+            Review this PR. Focus on:
             - Overall code quality and adherence to best practices
             - Possible bugs, edge cases, or logical errors
             - Security concerns or unsafe patterns
-            - Performance characteristics and potential optimizations
-
-            Provide thorough, actionable feedback, and use inline comments for any line-specific issues you identify.
+            - Performance characteristics, issues and potential optimizations
 
-            Note: The PR branch is already checked out in the current working directory.
+            Be concise. Only comment on issues that need attention - no praise or positive comments.
 
-            Use `gh pr comment` for summary or top-level feedback on the PR.
-            Use `mcp__github_inline_comment__create_inline_comment` to annotate specific code issues inline.
-            Only post GitHub comments - don't submit review text as messages.
-            Use top-level comments for general observations or praise.
+            Notes:
+            - The PR branch is already checked out in the current working directory.
+            - Use `gh pr comment` for summary or top-level feedback on the PR.
+            - Use `mcp__github_inline_comment__create_inline_comment` to annotate specific code issues inline.
+            - Only use inline comments for problems, not praise.
 
   # General interactive mode - responds to @claude mentions (but NOT review requests on PRs)
+  # Restricted to users with write access (OWNER, MEMBER, COLLABORATOR)
   claude-response:
     if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && !contains(github.event.comment.body, '@claude review')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && !contains(github.event.comment.body, '@claude review')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && !contains(github.event.review.body, '@claude review')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-    runs-on: ubuntu-latest
+      (
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) ||
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association) ||
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association)
+      ) && (
+        (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) ||
+        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && !contains(github.event.comment.body, '@claude review')) ||
+        (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && !contains(github.event.review.body, '@claude review'))
+      )
+    runs-on: warp-ubuntu-latest-x64-8x
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           fetch-depth: 1
       - name: Checkout PR branch (if on a PR)
@@ -114,4 +120,4 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           claude_args: |
             --model opus \
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr create:*),Bash(git checkout:*),Bash(git add:*),Bash(git commit:*),Bash(git push:*),Bash(git branch:*),Edit,Write,MultiEdit"
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr create:*),Bash(git checkout:*),Bash(git add:*),Bash(git commit:*),Bash(git push:*),Bash(git branch:*),Edit,Write,MultiEdit"