ci: skip the automatic Claude review on fork PRs - #36
Merged
Conversation
GitHub doesn't expose repo secrets (CLAUDE_CODE_OAUTH_TOKEN) to PRs from forks, so the review action can't authenticate and the job always fails — a spurious red check on every external contribution (e.g. #35). Gate the job to same-repo PRs (head.repo.full_name == the repo) so fork PRs skip it cleanly instead. External PRs are still reviewable on demand: the maintainer comments "@claude", which runs claude.yml on issue_comment in the base-repo context where the secret is available (and is locked to prashar32).
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
GitHub doesn't pass repository secrets to workflows triggered by PRs from forks, so
CLAUDE_CODE_OAUTH_TOKENis unavailable and theClaude PR Reviewaction fails to fetch a token — every external contribution gets a spurious redreviewcheck (seen on #35). It's not a required check, but it's noise and looks like the PR is broken.Change
Gate the
reviewjob to same-repo PRs:Fork PRs now skip the job (grey/neutral) instead of failing it.
Reviewing external PRs is unchanged
On-demand review still works on any PR, including forks: the maintainer comments
@claude, which runsclaude.ymlonissue_comment— that event runs in the base-repo context where the secret is available, and the job is already locked toprashar32.No required-check or behavior change for same-repo PRs.