surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| @@ -1,0 +1,47 @@ | ||
| 1 | +name: Non-write Users Check | |
| 2 | +on: | |
| 3 | + pull_request: | |
| 4 | + paths: | |
| 5 | + - ".github/**" | |
| 6 | + | |
| 7 | +permissions: | |
| 8 | + contents: read | |
| 9 | + pull-requests: write | |
| 10 | + | |
| 11 | +jobs: | |
| 12 | + allowed-non-write-check: | |
| 13 | + runs-on: ubuntu-latest | |
| 14 | + env: | |
| 15 | + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| 16 | + steps: | |
| 17 | + - run: | | |
| 18 | + DIFF=$(gh pr diff "$PR_NUMBER" -R "$REPO" || true) | |
| 19 | + | |
| 20 | + if ! echo "$DIFF" | grep -qE '^diff --git a/\.github/.*\.ya?ml'; then | |
| 21 | + exit 0 | |
| 22 | + fi | |
| 23 | + | |
| 24 | + MATCHES=$(echo "$DIFF" | grep "^+.*allowed_non_write_users" || true) | |
| 25 | + | |
| 26 | + if [ -z "$MATCHES" ]; then | |
| 27 | + exit 0 | |
| 28 | + fi | |
| 29 | + | |
| 30 | + EXISTING=$(gh pr view "$PR_NUMBER" -R "$REPO" --json comments --jq '.comments[].body' \ | |
| 31 | + | grep -c "<!-- non-write-users-check -->" || true) | |
| 32 | + | |
| 33 | + if [ "$EXISTING" -gt 0 ]; then | |
| 34 | + exit 0 | |
| 35 | + fi | |
| 36 | + | |
| 37 | + gh pr comment "$PR_NUMBER" -R "$REPO" --body '<!-- non-write-users-check --> | |
| 38 | + **`allowed_non_write_users` detected** | |
| 39 | + | |
| 40 | + This PR adds or modifies `allowed_non_write_users`, which allows users without write access to trigger Claude Code Action workflows. This can introduce security risks. | |
| 41 | + | |
| 42 | + If this is a new flow, please make sure you actually need `allowed_non_write_users`. If you are editing an existing workflow, double check that you are not adding new Claude permissions which might lead to a vulnerability. | |
| 43 | + | |
| 44 | + See existing workflows in this repo for safe usage examples, or contact the AppSec team.' | |
| 45 | + env: | |
| 46 | + PR_NUMBER: ${{ github.event.pull_request.number }} | |
| 47 | + REPO: ${{ github.repository }} |