@@ -19,11 +19,24 @@ jobs:
1919 issues: write
2020 id-token: write
2121 steps:
22- # Set environment variables for Claude Code Action
23- - name : Set up environment
22+ - name: Check authorization
23+ id: auth-check
2424 run: |
25- echo "OVERRIDE_GITHUB_TOKEN=${{ secrets.CLAUDE_PAT_TOKEN }}" >> $GITHUB_ENV
26- echo "Setting up PAT token for Claude Code Action"
25+ # Get the comment author
26+ COMMENT_AUTHOR="${{ github.event.comment.user.login }}"
27+ echo "Comment author: $COMMENT_AUTHOR"
28+
29+ # List of authorized users from CODEOWNERS
30+ AUTHORIZED_USERS=$(cat .github/CODEOWNERS | grep !!claudecode | cut -d' ' -f3-)
31+
32+ # Check if user is authorized
33+ if echo "$AUTHORIZED_USERS" | grep -w "$COMMENT_AUTHOR" > /dev/null; then
34+ echo "User $COMMENT_AUTHOR is authorized"
35+ echo "authorized=true" >> $GITHUB_OUTPUT
36+ else
37+ echo "User $COMMENT_AUTHOR is not authorized to trigger Claude workflows"
38+ echo "authorized=false" >> $GITHUB_OUTPUT
39+ fi
2740
2841 # Simply checking out the repository is sufficient
2942 - name: Checkout code
3346
3447 # If running on a PR comment, we need to explicitly check out the PR branch
3548 - name: Checkout PR branch if needed
36- if : github.event.issue.pull_request
49+ if: github.event.issue.pull_request && steps.auth-check.outputs.authorized == 'true'
3750 run: |
3851 # Get the PR number from the issue object
3952 PR_NUMBER="${{ github.event.issue.number }}"
@@ -53,14 +66,17 @@ jobs:
5366 GITHUB_TOKEN: ${{ secrets.CLAUDE_PAT_TOKEN }}
5467
5568 - name: Claude PR Creation
69+ if: steps.auth-check.outputs.authorized == 'true'
5670 uses: anthropics/claude-code-action@beta
5771 with:
5872 # Your Anthropic API key
5973 anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
6074
75+ # GitHub token for API access
76+ github_token: ${{ secrets.CLAUDE_PAT_TOKEN }}
77+
6178 # Explicitly set the trigger phrase
6279 trigger_phrase: "@claude"
63- # Note: Token is provided via OVERRIDE_GITHUB_TOKEN environment variable
6480
6581 # Timeout for execution (longer for PR creation)
6682 timeout_minutes: 30
0 commit comments