ci: forward approved users to Claude review (#2078)

.github/scripts/claude-code-review-workflow-contract_test.py

@@ -0,0 +1,28 @@
+#!/usr/bin/env python3
+"""Contract tests for the Claude Code fork-review workflow."""
+
+from pathlib import Path
+import unittest
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+WORKFLOW = REPO_ROOT / ".github" / "workflows" / "claude-code-review.yml"
+ALLOWED_USERS_INPUT = "allowed_non_write_users: ${{ github.event.pull_request.user.login }}"
+
+
+class ClaudeCodeReviewWorkflowContractTest(unittest.TestCase):
+    def test_fork_review_forwards_allowlist_to_claude_action(self) -> None:
+        workflow = WORKFLOW.read_text(encoding="utf-8")
+        _, separator, fork_job = workflow.partition("  claude-review-fork:")
+
+        self.assertTrue(separator, "Claude fork-review job is missing")
+        self.assertIn(
+            ALLOWED_USERS_INPUT,
+            fork_job,
+            "fork review must forward its job-authorized pull request author "
+            "to Claude's allowed_non_write_users input",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

.github/workflows/claude-code-review.yml

@@ -153,6 +153,10 @@ jobs:
           # enough for the action to post review comments. Author will be
           # github-actions[bot] on this path.
           github_token: ${{ secrets.GITHUB_TOKEN }}
+          # The job gate above approves this fork author through either the
+          # repository allowlist or a maintainer's safe-to-review label. Pass
+          # that approved actor through Claude's independent permission gate.
+          allowed_non_write_users: ${{ github.event.pull_request.user.login }}
           track_progress: ${{ github.event.action != 'labeled' }}
           allowed_bots: "*"
           prompt: |

.github/workflows/lint-action-pinning.yml

@@ -7,6 +7,7 @@ on:
       - ".github/workflows/**"
       - ".github/scripts/lint-action-pinning.py"
       - ".github/scripts/lint-action-pinning_test.py"
+      - ".github/scripts/claude-code-review-workflow-contract_test.py"
       - ".github/scripts/collect-macos-desktop-diagnostics.sh"
       - ".github/scripts/release-workflow-contract_test.py"
       - ".github/release-signing-key.asc"
@@ -17,6 +18,7 @@ on:
       - ".github/workflows/**"
       - ".github/scripts/lint-action-pinning.py"
       - ".github/scripts/lint-action-pinning_test.py"
+      - ".github/scripts/claude-code-review-workflow-contract_test.py"
       - ".github/scripts/collect-macos-desktop-diagnostics.sh"
       - ".github/scripts/release-workflow-contract_test.py"
       - ".github/release-signing-key.asc"
@@ -44,6 +46,9 @@ jobs:
       - name: Test action-pinning lint
         run: python3 .github/scripts/lint-action-pinning_test.py
 
+      - name: Test Claude Code review workflow contract
+        run: python3 .github/scripts/claude-code-review-workflow-contract_test.py
+
       - name: Test release workflow contract
         run: python3 .github/scripts/release-workflow-contract_test.py