Northern_Lights/cherry-studio
1
0
Fork 0
mirror of https://github.com/CherryHQ/cherry-studio.git synced 2026-01-05 12:29:44 +08:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

workflows: restrict Claude triggers to collaborators/members/owners and fix fork PR reviews (#9924)

Browse Source 
* workflows: restrict Claude triggers to collaborators/members/owners and fix fork PR reviews

- claude.yml: gate by author_association in [COLLABORATOR, MEMBER, OWNER]
- claude-code-review.yml: use pull_request_target, add pull-requests: write and id-token: write to enable OIDC + commenting on forks

* fix(workflows): remove 'reopened' and 'assigned' types from triggers
This commit is contained in:
LiuVaayne 2025-09-05 13:12:15 +08:00 committed by GitHub
parent e3afab765d
commit 96d41ae8f6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 21 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/claude-code-review.yml vendored
View File

@ -1,7 +1,9 @@
name: Claude Code Review name: Claude Code Review
on: on:
pull_request: # Use pull_request_target so the workflow runs in the context of the base repository.
# This allows OIDC and the ability to comment on PRs from forks safely.
pull_request_target:
types: [opened, synchronize] types: [opened, synchronize]
# Optional: Only run on specific file changes # Optional: Only run on specific file changes
# paths: # paths:
@ -21,9 +23,10 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions: permissions:
contents: read contents: read
pull-requests: read pull-requests: write
issues: read issues: read
id-token: write id-token: write
actions: read
steps: steps:
- name: Checkout repository - name: Checkout repository
@ -51,4 +54,3 @@ jobs:
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options
claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"' claude_args: '--allowed-tools "Bash(gh issue view:*),Bash(gh search:*),Bash(gh issue list:*),Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr list:*)"'

22
.github/workflows/claude.yml vendored
View File

@ -6,17 +6,28 @@ on:
pull_request_review_comment: pull_request_review_comment:
types: [created] types: [created]
issues: issues:
types: [opened, assigned] types: [opened]
pull_request_review: pull_request_review:
types: [submitted] types: [submitted]
jobs: jobs:
claude: claude:
if: | if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || (github.event_name == 'issue_comment'
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || && contains(github.event.comment.body, '@claude')
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || && contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.comment.author_association))
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) ||
(github.event_name == 'pull_request_review_comment'
&& contains(github.event.comment.body, '@claude')
&& contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.comment.author_association))
||
(github.event_name == 'pull_request_review'
&& contains(github.event.review.body, '@claude')
&& contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.review.author_association))
||
(github.event_name == 'issues'
&& (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))
&& contains(fromJSON('["COLLABORATOR","MEMBER","OWNER"]'), github.event.issue.author_association))
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions: permissions:
contents: read contents: read
@ -47,4 +58,3 @@ jobs:
# See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md
# or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options # or https://docs.anthropic.com/en/docs/claude-code/sdk#command-line for available options
# claude_args: '--model claude-opus-4-1-20250805 --allowed-tools Bash(gh pr:*)' # claude_args: '--model claude-opus-4-1-20250805 --allowed-tools Bash(gh pr:*)'