Motivation

• The Claude workflow could be started by any issue or PR comment containing @claude, and recent changes moved that job to the public self-hosted runner pool which exposes long-lived fleet credentials and secrets to untrusted actors.
• To close this critical attack surface, comment-driven executions must be limited to trusted repository actors while preserving manual runs.
• Add an automated regression to prevent reintroducing the unauthenticated trigger in future changes.

Description

• Updated .github/workflows/claude.yml to require author_association to be one of OWNER, MEMBER, or COLLABORATOR for issue_comment, pull_request_review_comment, and pull_request_review triggers while keeping workflow_dispatch intact.
• The if condition now checks contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event...author_association) alongside the @claude body checks.
• Added a regression test in test/workflow.test.ts that parses the workflow and asserts the new author-association guard and that untrusted association strings like FIRST_TIME_CONTRIBUTOR, CONTRIBUTOR, and NONE are not present.

Testing

• Ran the workflow unit tests with pnpm test -- test/workflow.test.ts, and the test suite passed.
• Ran the project typecheck/lint with pnpm lint (TypeScript --noEmit) and it completed successfully.
• The new test exercises the claude.yml condition and verifies the presence of the author-association guards.

Codex Task