From a02483012760bd2661b7680edd9f517429aa2e96 Mon Sep 17 00:00:00 2001
From: Test User <test@example.com>
Date: Fri, 30 Jan 2026 08:09:49 -0700
Subject: [PATCH] fix(ci): use pull_request_target for fork PR reviews
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch both review workflows from pull_request to pull_request_target
so they run with base repo permissions and can access secrets when
reviewing fork PRs.

Changes:
- claude-code-review.yml: pull_request → pull_request_target
- opencode-review.yml: pull_request → pull_request_target
- Both now explicitly checkout PR head commit for review
- Added security comments explaining the approach

This allows the workflows to run successfully after maintainer approval
for external contributor PRs.
---
 .github/workflows/claude-code-review.yml | 9 +++++++--
 .github/workflows/opencode-review.yml    | 9 +++++++--
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 261c4d5..e3d5f32 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -1,7 +1,10 @@
 name: Claude Code Review
 
 on:
-  pull_request:
+  # Using pull_request_target to run with base repo permissions (access to secrets)
+  # This allows the workflow to run for fork PRs after maintainer approval
+  # Security: This workflow only READS PR code for review, it does NOT execute it
+  pull_request_target:
     types: [opened, synchronize]
     # Skip review for documentation and config-only changes
     paths-ignore:
@@ -32,13 +35,15 @@ jobs:
           deletions=${{ github.event.pull_request.deletions }}
           total=$((additions + deletions))
           echo "total=$total" >> $GITHUB_OUTPUT
-      - name: Checkout repository
+      - name: Checkout PR code for review
         # Only review substantial changes (5+ files OR 20+ lines changed)
         if: |
           github.event.pull_request.changed_files >= 5 ||
           steps.calc.outputs.total >= 20
         uses: actions/checkout@v4
         with:
+          # Checkout the PR head commit (pull_request_target defaults to base branch)
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
 
       - name: Run Claude Code Review
diff --git a/.github/workflows/opencode-review.yml b/.github/workflows/opencode-review.yml
index e8dea3b..dc09a94 100644
--- a/.github/workflows/opencode-review.yml
+++ b/.github/workflows/opencode-review.yml
@@ -1,7 +1,10 @@
 name: OpenCode PR Review
 
 on:
-  pull_request:
+  # Using pull_request_target to run with base repo permissions (access to secrets)
+  # This allows the workflow to run for fork PRs after maintainer approval
+  # Security: This workflow only READS PR code for review, it does NOT execute it
+  pull_request_target:
     types: [opened, synchronize]
     # Skip review for documentation and config-only changes
     # Exclude this workflow file to prevent self-triggering loops
@@ -35,13 +38,15 @@ jobs:
           total=$((additions + deletions))
           echo "total=$total" >> $GITHUB_OUTPUT
 
-      - name: Checkout repository
+      - name: Checkout PR code for review
         # Only review substantial changes (5+ files OR 20+ lines changed)
         if: |
           github.event.pull_request.changed_files >= 5 ||
           steps.calc.outputs.total >= 20
         uses: actions/checkout@v6
         with:
+          # Checkout the PR head commit (pull_request_target defaults to base branch)
+          ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
           persist-credentials: false