From 6304e1df11f5a50d72d9d1dc837c448b7b7deca1 Mon Sep 17 00:00:00 2001
From: Andrew Rich <676392+smartwatermelon@users.noreply.github.com>
Date: Thu, 26 Mar 2026 15:11:25 -0700
Subject: [PATCH] fix: add permissions to usage example and permission
 validation step

Add required permissions block to the caller workflow example so new
consumers get it right. Add early permission check that fails fast
with a clear error instead of opaque startup_failure when the caller
doesn't grant the needed scopes. Also fix pre-existing shell injection
warning by moving PR_NUMBER to env var in verdict check step.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 .github/workflows/claude-blocking-review.yml | 21 +++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/claude-blocking-review.yml b/.github/workflows/claude-blocking-review.yml
index ab7a44a..e35dc7b 100644
--- a/.github/workflows/claude-blocking-review.yml
+++ b/.github/workflows/claude-blocking-review.yml
@@ -5,6 +5,12 @@ name: Claude Blocking Review
 #
 # Usage in a caller workflow:
 #
+#   permissions:
+#     contents: read
+#     pull-requests: write
+#     issues: write
+#     id-token: write
+#
 #   jobs:
 #     claude-review:
 #       uses: YOUR_ORG/github-workflows/.github/workflows/claude-blocking-review.yml@v1
@@ -68,6 +74,19 @@ jobs:
         with:
           fetch-depth: 1
 
+      - name: Verify caller permissions
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+        run: |
+          if ! gh api "repos/${REPO}/pulls/${PR_NUMBER}" --silent 2>/dev/null; then
+            echo "::error::Permission check failed."
+            echo "::error::The caller workflow must declare top-level permissions:"
+            echo "::error::  contents: read, pull-requests: write, issues: write, id-token: write"
+            exit 1
+          fi
+
       - name: Validate inputs
         env:
           MODEL: ${{ inputs.model }}
@@ -204,8 +223,8 @@ jobs:
         if: always()
         env:
           GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ inputs.pr_number }}
         run: |
-          PR_NUMBER="${{ inputs.pr_number }}"
 
           # Escape hatch: [skip-claude-review: reason] in PR body bypasses enforcement
           PR_BODY=$(gh pr view "$PR_NUMBER" --json body -q .body 2>/dev/null || echo "")