[infra] - gate claude.yml on github.repository_owner instead of a hardcoded login#654
Merged
Merged
Conversation
…a literal claude.yml's sole authorization guard on a pull-requests:write + issues:write workflow hardcoded `github.event.comment.user.login == 'CGFixIT'`, while the sibling automation (codex.yml:20, pr-review.yml:39) uses the dynamic `github.repository_owner`. A handle rename or repo transfer silently breaks (or, if the old handle is re-registered by someone else, weakens) the literal guard. Mirror the repo's own established pattern. Failure mode stays fail-safe: a non-owner comment simply doesn't run the workflow. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0138hmScu3tFU4v1jzvFUwVT
cgfixit
force-pushed
the
claude/cyclaw-optimize-claude-yml-owner
branch
from
July 26, 2026 01:27
8291f50 to
5e5afb1
Compare
cgfixit
marked this pull request as ready for review
July 26, 2026 01:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes
Phase 2 security-scan finding (CI, low severity).
.github/workflows/claude.yml's sole authorization guard on apull-requests: write+issues: writeworkflow hardcodedgithub.event.comment.user.login == 'CGFixIT', whereas the sibling automation uses the dynamic owner:codex.yml:20:github.event.comment.user.login == github.repository_ownerpr-review.yml:39:github.event.pull_request.user.login == github.repository_ownerMirror that established repo pattern (one line). A handle rename or repo transfer silently breaks the literal guard — or, if the old
CGFixIThandle is later re-registered by someone else, weakens it (that account could then trigger a write-capable workflow).github.repository_owneralways resolves to the current owner.Invariant / Governance Impact: None — CI auth-guard hardening; it tightens the guard's future-safety and its failure mode stays fail-safe (a non-owner
@claudecomment simply doesn't run the job). Same canonical-case string for the owner, so no behavior change today.Types of changes
Scope note: Infrastructure / CI only (one line).
Benefits / why
codex.ymlandpr-review.ymlalready guard themselves.Risks to monitor
github.repository_ownerbecomes the org login; the guard would then admit anyone commenting as that org context — revisit the condition (addgithub.actor/triggering_actorchecks likecodex.yml:21-22) if ownership model changes. Not a concern for the current single-owner repo.Further comments
Verified:
claude.ymlparses (yaml.safe_load); the new condition is byte-identical in form tocodex.yml's working guard. No shared files with any other open PR.🤖 Generated with Claude Code
https://claude.ai/code/session_0138hmScu3tFU4v1jzvFUwVT
Generated by Claude Code