From 737cb592d933be30624e647068710c059d038268 Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Thu, 30 Jul 2026 18:30:57 -0500 Subject: [PATCH 1/2] Restrict @claude mention trigger to jnasbyupgrade MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit claude.yml (the @claude mention responder) had no actor check at all — any GitHub user or bot could comment/open an issue containing "@claude" and it would actually execute using the org's Claude Code OAuth token and a repo-scoped GITHUB_TOKEN. claude-code-review.yml already gated on the PR head owner; this brings the mention-trigger workflow in line by requiring github.actor == 'jnasbyupgrade'. --- .github/workflows/claude.yml | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 9c9cdb6..37c544b 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -14,11 +14,20 @@ on: # serializing would only delay responses and cancelling would drop them. jobs: claude: + # SECURITY: gated to github.actor == 'jnasbyupgrade' so only that account + # can invoke Claude via @claude mentions. Without this, any GitHub user + # (or bot) commenting/opening an issue containing "@claude" would cause + # this job to run using the org's Claude Code OAuth token and a + # repo-scoped GITHUB_TOKEN. To add more trusted accounts, extend the + # actor check. if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + github.actor == 'jnasbyupgrade' && + ( + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + ) runs-on: ubuntu-latest timeout-minutes: 30 permissions: From 4b52f6315279d69ed327a0232e7d71d8edde0e9c Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Thu, 30 Jul 2026 18:38:55 -0500 Subject: [PATCH 2/2] Trim SECURITY comment on the @claude actor check Condense to what's needed: this gates @claude to a single trusted account rather than just matching comment text. --- .github/workflows/claude.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 37c544b..9a08bbb 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -14,12 +14,8 @@ on: # serializing would only delay responses and cancelling would drop them. jobs: claude: - # SECURITY: gated to github.actor == 'jnasbyupgrade' so only that account - # can invoke Claude via @claude mentions. Without this, any GitHub user - # (or bot) commenting/opening an issue containing "@claude" would cause - # this job to run using the org's Claude Code OAuth token and a - # repo-scoped GITHUB_TOKEN. To add more trusted accounts, extend the - # actor check. + # SECURITY: restricts @claude to a single trusted account, not just + # matching comment text — otherwise anyone could trigger this job. if: | github.actor == 'jnasbyupgrade' && (