fix(ci): support external contributors in Claude workflows

[thomhurst]

Summary

• allow Claude issue triage and pull request reviews for contributors without repository write access
• pass the scoped GITHUB_TOKEN explicitly and opt in via allowed_non_write_users
• isolate untrusted issue/PR content behind pinned-target helper scripts, minimal permissions, and narrow tool allowlists
• port the fixes from TUnit #6720 and TUnit #6722

Validation

• actionlint 1.7.12 (both workflows)
• PyYAML parse (both workflows)
• bash -n (both helper scripts)
• helper behavior checks for pinned targets, valid forwarding, invalid-label rejection, and empty-comment rejection

Setup required

This repository does not currently expose a CLAUDE_CODE_OAUTH_TOKEN Actions secret. Add it before expecting either workflow to run successfully.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 1611a4b1-a221-4f0d-9100-1c7b02aa3a51

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}