fix(ci): support external contributors in Claude workflows

[thomhurst]

Summary

• allow Claude issue triage and pull request reviews for contributors without repository write access
• pass the scoped GITHUB_TOKEN explicitly and opt in via allowed_non_write_users
• isolate untrusted issue/PR content behind pinned-target helper scripts, minimal permissions, and narrow tool allowlists
• port the fixes from TUnit #6720 and TUnit #6722

Validation

• actionlint 1.7.12 (both workflows)
• PyYAML parse (both workflows)
• bash -n (both helper scripts)
• helper behavior checks for pinned targets, valid forwarding, invalid-label rejection, and empty-comment rejection

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: d37033b2-7956-4d1c-b403-2f96868771cc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR enables Claude review and issue-triage workflows for external contributors while constraining repository writes to target-pinned helper scripts.

• Moves PR review to pull_request_target and isolates the untrusted head under pr-head/.
• Adds a manually dispatchable PR-review path with narrow read-oriented tooling.
• Adds issue triage with restricted label and comment operations.
• Passes scoped GitHub tokens explicitly and permits non-write users.
• One supply-chain hardening gap remains: the secret-bearing Claude action is referenced by a mutable tag.

Confidence Score: 4/5

The PR appears safe to merge after considering its constrained write paths, with a non-blocking recommendation to pin the privileged Claude action to an immutable commit.

The helper scripts pin all writes to the triggering issue or pull request, the untrusted checkout is not executed, and permissions are narrow; the remaining concern is supply-chain hardening for the mutable action reference that receives secrets and write-scoped tokens.

Files Needing Attention: .github/workflows/claude-code-review.yml, .github/workflows/claude-issue-triage.yml

Security Review

The target-pinned helper scripts and minimal token scopes constrain prompt-driven writes, but both privileged workflows execute a mutable anthropics/claude-code-action@v1 reference with direct access to OAuth and write-scoped GitHub tokens. Pinning that action to a reviewed full commit SHA would make this trust boundary immutable.

Important Files Changed

Filename	Overview
.github/workflows/claude-code-review.yml	Introduces external-contributor PR review through pull_request_target, isolated head checkout, scoped permissions, and a constrained posting helper; the secret-bearing Claude action remains mutable.
.github/workflows/claude-issue-triage.yml	Adds issue triage for untrusted reporters with minimal permissions and narrow tooling, but also invokes the privileged Claude action through a mutable tag.
.github/scripts/pr-review-comment.sh	Safely pins review comments to the workflow-provided repository and PR number and rejects blank bodies.
.github/scripts/triage-issue.sh	Restricts issue writes to labels and comments on the environment-pinned issue, with validation for label-list input.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  U[External issue or pull request] --> W[GitHub Actions workflow]
  W --> A[Claude action]
  A --> R[Read-only gh, git, and file tools]
  A --> H[Target-pinned helper]
  H --> T[Triggering issue or pull request]
  W --> P[Scoped GitHub token]
  P --> A
  S[Claude OAuth secret] --> A
  M[Mutable action tag] -. supply-chain boundary .-> A

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): support external contributors" | Re-trigger Greptile}

[greptile-apps]

Mutable Privileged Action

Both privileged workflows run anthropics/claude-code-action@v1 through a mutable tag. If that tag is compromised or repointed, the changed action code would run before the model-facing tool restrictions apply and would directly receive CLAUDE_CODE_OAUTH_TOKEN plus a GITHUB_TOKEN with pull-request or issue write access. This is a non-blocking supply-chain hardening concern; pin the action to a reviewed full commit SHA in this workflow and .github/workflows/claude-issue-triage.yml.

How this was verified: The action invocation receives both secrets directly while its job grants repository write permissions, and the @v1 reference does not identify immutable code.