mirror/tinyusb
3
0
Fork 0
mirror of https://github.com/hathach/tinyusb.git synced 2026-08-18 11:02:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

ci: re-enable Claude PR review and harden auth/permissions

Browse Source 
- claude-code-review.yml: re-enable (drop `if: false`); switch from
    pull_request_target to pull_request so fork PRs never receive the
    OAuth token (avoids prompt-injection token leak). Auto-review on
    open/synchronize/reopen/ready_for_review, skip drafts, sticky comment.
  - claude.yml: grant contents/pull-requests/issues write so @claude can
    reply and push fixes; @claude is the on-demand path for fork PRs.
This commit is contained in:
hathach
2026-06-01 23:51:41 +07:00
parent 95d11a8a7a
commit 87f9cc01cf
2 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
.github/workflows/claude-code-review.yml vendored
View File

@ -1,18 +1,27 @@
name: Claude Code Review
on:
pull_request_target:
types: [opened, synchronize, ready_for_review, reopened]
pull_request:
# opened/reopened/ready_for_review -> first auto review
# synchronize -> auto re-review on new pushes
#
# NOTE: pull_request (not _target) means fork PRs from non-write-access
# contributors get NO token, so they are not auto-reviewed -> use @claude
# on those. Same-repo branches (yours or write-access contributors) get
# full auto-review safely.
types: [opened, synchronize, reopened, ready_for_review]
jobs:
claude-review:
if: false
# Skip drafts; review real PRs only
if: github.event.pull_request.draft == false
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
issues: read
id-token: write
actions: read # Required for Claude to read CI results on PRs
steps:
- name: Checkout repository
@ -28,5 +37,7 @@ jobs:
plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
# Reuse one comment instead of posting a new one each push
use_sticky_comment: true
claude_args: '--max-turns 20'
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://code.claude.com/docs/en/cli-reference for available options

6
.github/workflows/claude.yml vendored
View File

@ -19,9 +19,9 @@ jobs:
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: read
issues: read
contents: write # allow Claude to push commits/branches when asked
pull-requests: write # allow Claude to comment on / update PRs
issues: write # allow Claude to comment on / update issues
id-token: write
actions: read # Required for Claude to read CI results on PRs
steps: