The OIDC token exchange fails with pull_request_target events.
Provide explicit github_token to fix authentication.
Also upgrade to pull-requests: write for posting comments.
Switch both review workflows from pull_request to pull_request_target
so they run with base repo permissions and can access secrets when
reviewing fork PRs.
Changes:
- claude-code-review.yml: pull_request → pull_request_target
- opencode-review.yml: pull_request → pull_request_target
- Both now explicitly checkout PR head commit for review
- Added security comments explaining the approach
This allows the workflows to run successfully after maintainer approval
for external contributor PRs.
Add concurrency control to all review workflows:
- opencode-review.yml: Cancel in-progress for same PR
- claude-code-review.yml: Cancel in-progress for same PR
- claude.yml: Cancel in-progress for same issue/PR
This prevents duplicate reviews when PRs are updated rapidly
or multiple comments are posted in quick succession.
Co-authored-by: Test User <test@example.com>
