fix(ci): run code review on pull requests from forks

[thomhurst]

Follow-up to #6720 (which fixed the same class of breakage for Issue Triage). Different root cause, though.

Root cause

claude-review fails on every fork PR — e.g. #6677:

error: Error message: Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable
Attempt 3 failed: Could not fetch an OIDC token. Did you remember to add `id-token: write`?

id-token: write is declared. The problem is that for pull_request events raised from a fork, GitHub ignores the permissions: block. From that run's own log:

Declared	Actually granted
contents: write	Contents: read
pull-requests: write	PullRequests: read
statuses: write	Statuses: read
id-token: write	no OIDC token minted

Secrets are withheld too, so secrets.CLAUDE_CODE_OAUTH_TOKEN is empty. The job cannot authenticate, and could not have posted a review even if it had. This is a platform constraint, not a misconfiguration — it can only be fixed by changing the trigger.

Fix

Switch to pull_request_target, which runs in base-repository context and so has secrets, OIDC and real permissions.

That inverts the trust model: the PR diff becomes untrusted input to a job that holds write scope. Hardening accordingly:

• Permissions cut to contents: read + pull-requests: write. The old contents: write / checks: write / statuses: write / issues: write were inert under the old trigger but would be real under this one.
• Untrusted code is never the working directory. Base ref at the workspace root, PR head into pr-head/ with persist-credentials: false, exposed via --add-dir — the pattern from the action's security docs.
• github_token + allowed_non_write_users: "*", since the actor is the fork author and never has write access.
• One write path only: .github/scripts/pr-review-comment.sh takes the PR number from the environment rather than an argument (cannot be retargeted) and the body as an argument rather than a path (no file on the runner can be turned into a public comment). Capped at 2 calls via CLAUDE_CODE_SCRIPT_CAPS.
• --allowedTools narrowed from bare Bash,Read,Glob,Grep,WebFetch,WebSearch to Read/Glob/Grep, read-only gh pr and git commands, and that helper. WebFetch/WebSearch are dropped — with untrusted content in context they're an exfiltration channel.
• Prompt states the diff and pr-head/ are data, not instructions.

Residual risk: an injected instruction in a fork diff could cause an unwanted comment on that same PR. Bounded to pull-requests: write, with no code access.

Verification

pull_request_target workflows run from the base branch, so this PR's own claude-review check still executes the old file and will still fail. The change can only be verified on the next fork PR after merge.

https://claude.ai/code/session_01UGaA2Fjvb2F3iYAz2rifM8

Summary by CodeRabbit

• Chores
  • Added automated tooling to publish pull request review comments when a valid message is provided.
  • Improved the pull request review workflow with more restricted permissions and controlled access to repository changes.
  • Strengthened safeguards around untrusted pull request content and limited automated review actions to approved operations.
  • Automated reviews now use a consistent comment-posting process and can inspect relevant pull request and repository information.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: ec8c1d52-6543-4276-b235-f42087a5e748

📥 Commits

Reviewing files that changed from the base of the PR and between 384d822 and 13de7e8.

📒 Files selected for processing (2)

• .github/scripts/pr-review-comment.sh
• .github/workflows/claude-code-review.yml

Included review availability: Your plan provides up to 8 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR adds a validated PR comment helper. The review workflow now uses pull_request_target, separate trusted and untrusted checkouts, reduced permissions, capped script usage, explicit token settings, and restricted Claude Code tools.

Changes

Secure PR review workflow

Layer / File(s)	Summary
Review comment helper .github/scripts/pr-review-comment.sh	The script requires PR_NUMBER and GH_REPO, rejects empty comment bodies, and posts the body with gh pr comment.
Workflow context and checkout .github/workflows/claude-code-review.yml	The workflow uses pull_request_target, limits permissions to contents: read and pull-requests: write, caps helper usage, and checks out the base and PR head separately.
Review execution and tool restrictions .github/workflows/claude-code-review.yml	The review step receives PR identifiers and a scoped token. The prompt marks PR content as untrusted and requires the helper script. claude_args permits read operations, selected gh and git commands, and the helper script only.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 13de7

This change enables fork PR reviews while limiting repository access and constraining comments to the triggering pull request. No current merge-blocking risk is identified.

Sequence Diagram(s)

sequenceDiagram
  participant GitHub_Actions
  participant Claude_Code_Review
  participant pr_head
  participant pr_review_comment_sh
  participant gh
  GitHub_Actions->>Claude_Code_Review: provide PR_NUMBER, GH_REPO, and scoped token
  Claude_Code_Review->>gh: read PR view and diff
  Claude_Code_Review->>pr_head: read PR head
  Claude_Code_Review->>pr_review_comment_sh: submit review markdown
  pr_review_comment_sh->>gh: post comment to triggering pull request

Loading

Poem

A rabbit reads each line,
The patch grows clear beneath the moon,
Small changes hop in place,
Tests guard the garden path,
Reviews bloom before the dawn.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling CI code review for pull requests from forks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/claude-review-fork-prs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Greptile Summary

This PR changes Claude review execution to pull_request_target so fork pull requests receive the required authentication and comment permissions. It also separates the trusted base checkout from the PR head, narrows permissions and tools, and introduces a fixed-target comment helper.

• Adds a dedicated helper that posts only to the triggering pull request.
• Restricts the workflow token to repository reads and pull-request writes.
• Checks out fork content under pr-head/ for review.
• The remaining --add-dir configuration discovery and persisted base credential create a token-disclosure path that should be closed before merging.

Confidence Score: 3/5

The PR is not safe to merge until untrusted added-directory configuration is disabled and the base checkout stops persisting its write-capable credential.

Fork-controlled Claude skills can be loaded from pr-head and direct unrestricted file reads toward the persisted workflow token, which can then be exposed through the allowed public-comment path.

Files Needing Attention: .github/workflows/claude-code-review.yml

Security Review

A fork can add Claude skills or commands under pr-head/.claude/, which are discovered through --add-dir. Those instructions can reach the base checkout's persisted, pull-request-write credential through unrestricted file reads and publish it using the permitted comment helper.

Important Files Changed

Filename	Overview
.github/workflows/claude-code-review.yml	Moves reviews to a hardened pull_request_target workflow, but added-directory configuration discovery can combine with the persisted base credential to disclose the write-capable token.
.github/scripts/pr-review-comment.sh	Adds a narrowly targeted, quoted helper that rejects empty bodies and posts only to the repository and pull request supplied by trusted workflow environment variables.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Fork[Untrusted fork PR] --> Skill[pr-head/.claude skill or command]
  Skill --> AddDir[--add-dir pr-head]
  AddDir --> Agent[Privileged review agent]
  Checkout[Base checkout] --> Token[Persisted GITHUB_TOKEN]
  Token --> Read[Unrestricted Read]
  Agent --> Read
  Read --> Helper[PR comment helper]
  Helper --> Public[Public PR comment]

Loading

_{Reviews (1): Last reviewed commit: "fix(ci): run code review on pull request..." | Re-trigger Greptile}

[greptile-apps]

Untrusted skills expose credentials

Passing the untrusted pr-head directory through --add-dir causes Claude Code to load PR-controlled .claude/skills/ and .claude/commands/. The base checkout also persists the write-capable GITHUB_TOKEN, and unrestricted Read can access its runner-owned credential file. A fork can therefore supply instructions that make the agent read the token and publish it through the permitted comment helper. Disable project configuration discovery for the added directory and set persist-credentials: false on the base checkout.

How this was verified: The configured Claude version loads skills from added directories, while the base checkout stores its pull-request-write token in an OS-readable runner file and the comment helper publishes model-provided text verbatim.