its-consulting/ralph-claude-code
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(ci): use pull_request_target for fork PR reviews

Browse source 
Switch both review workflows from pull_request to pull_request_target
so they run with base repo permissions and can access secrets when
reviewing fork PRs.

Changes:
- claude-code-review.yml: pull_request → pull_request_target
- opencode-review.yml: pull_request → pull_request_target
- Both now explicitly checkout PR head commit for review
- Added security comments explaining the approach

This allows the workflows to run successfully after maintainer approval
for external contributor PRs.
This commit is contained in:
Test User 2026-01-30 08:09:49 -07:00
parent 328294847d
commit a024830127
2 changed files with 14 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
.github/workflows/claude-code-review.yml vendored
View file

@ -1,7 +1,10 @@
name: Claude Code Review name: Claude Code Review
on: on:
pull_request: # Using pull_request_target to run with base repo permissions (access to secrets)
# This allows the workflow to run for fork PRs after maintainer approval
# Security: This workflow only READS PR code for review, it does NOT execute it
pull_request_target:
types: [opened, synchronize] types: [opened, synchronize]
# Skip review for documentation and config-only changes # Skip review for documentation and config-only changes
paths-ignore: paths-ignore:
@ -32,13 +35,15 @@ jobs:
deletions=${{ github.event.pull_request.deletions }} deletions=${{ github.event.pull_request.deletions }}
total=$((additions + deletions)) total=$((additions + deletions))
echo "total=$total" >> $GITHUB_OUTPUT echo "total=$total" >> $GITHUB_OUTPUT
- name: Checkout repository - name: Checkout PR code for review
# Only review substantial changes (5+ files OR 20+ lines changed) # Only review substantial changes (5+ files OR 20+ lines changed)
if: | if: |
github.event.pull_request.changed_files >= 5 || github.event.pull_request.changed_files >= 5 ||
steps.calc.outputs.total >= 20 steps.calc.outputs.total >= 20
uses: actions/checkout@v4 uses: actions/checkout@v4
with: with:
# Checkout the PR head commit (pull_request_target defaults to base branch)
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 1 fetch-depth: 1
- name: Run Claude Code Review - name: Run Claude Code Review

9
.github/workflows/opencode-review.yml vendored
View file

@ -1,7 +1,10 @@
name: OpenCode PR Review name: OpenCode PR Review
on: on:
pull_request: # Using pull_request_target to run with base repo permissions (access to secrets)
# This allows the workflow to run for fork PRs after maintainer approval
# Security: This workflow only READS PR code for review, it does NOT execute it
pull_request_target:
types: [opened, synchronize] types: [opened, synchronize]
# Skip review for documentation and config-only changes # Skip review for documentation and config-only changes
# Exclude this workflow file to prevent self-triggering loops # Exclude this workflow file to prevent self-triggering loops
@ -35,13 +38,15 @@ jobs:
total=$((additions + deletions)) total=$((additions + deletions))
echo "total=$total" >> $GITHUB_OUTPUT echo "total=$total" >> $GITHUB_OUTPUT
- name: Checkout repository - name: Checkout PR code for review
# Only review substantial changes (5+ files OR 20+ lines changed) # Only review substantial changes (5+ files OR 20+ lines changed)
if: | if: |
github.event.pull_request.changed_files >= 5 || github.event.pull_request.changed_files >= 5 ||
steps.calc.outputs.total >= 20 steps.calc.outputs.total >= 20
uses: actions/checkout@v6 uses: actions/checkout@v6
with: with:
# Checkout the PR head commit (pull_request_target defaults to base branch)
ref: ${{ github.event.pull_request.head.sha }}
fetch-depth: 1 fetch-depth: 1
persist-credentials: false persist-credentials: false