Skip to content

Gate the @claude mention workflow on the operator #145

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yihanzhu merged 2 commits into from
Aug 27, 2026
Merged

Gate the @claude mention workflow on the operator #145

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
13dd816
Gate the @claude mention workflow on the operator
Aug 27, 2026
d4c8b72
Gate issue events on the issue's author, not just the actor
Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,28 @@
name: Claude Code

# Answers @claude mentions on issues and PRs.
#
# ACTOR GATE — this repo is public, so without it any passer-by could spend the
# operator's subscription by writing "@claude" in a comment. Both actors are
# checked, the same rule every job in this repo follows: on a re-run
# github.actor stays whoever started the original run, and the person who
# pressed re-run appears only in github.triggering_actor, so checking one alone
# lets a collaborator re-run someone else's job.
#
# AUTHOR GATE — the actor gate alone is not enough. It says who triggered the
# event, not who wrote the text the agent will then read. On `issues: assigned`
# the actor is the operator doing triage while the issue body belongs to
# whoever opened it, so a stranger's issue containing "@claude" plus
# instructions would run the moment it is assigned. Issue events therefore also
# require the ISSUE AUTHOR to be the operator. (Comment events need no separate
# check: there the actor IS the author.)
#
# Bots stay refused: the action rejects bot actors unless they are listed in
# allowed_bots, and no bot edge is opened here on purpose. A cross-vendor
# reviewer belongs in a review workflow that fires on every PR, not in a
# mention edge where one bot can spend the operator's quota by talking to
# another.

on:
issue_comment:
types: [created]
Expand All @@ -13,10 +36,16 @@ on:
jobs:
claude:
if: |
github.actor == 'yihanzhu' &&
github.triggering_actor == 'yihanzhu' &&
Comment on lines +39 to +40

@chatgpt-codex-connector chatgpt-codex-connector Bot Aug 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge [Security] Check who wrote an assigned issue

For the issues: assigned trigger, github.actor and github.triggering_actor identify the operator who assigned the issue, not the person who wrote its title or body. An outsider can therefore open an issue containing @claude and attacker-controlled instructions; if the operator later assigns that issue during normal triage, both new checks pass and Claude processes the outsider's text, spending quota despite this gate. Remove the assigned trigger or also require the issue author to be the operator.

Useful? React with 👍 / 👎.

(
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
(github.event_name == 'issues' &&
github.event.issue.user.login == 'yihanzhu' &&
(contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
)
runs-on: ubuntu-latest
permissions:
contents: read
Expand Down