[nealrichardson]

No description provided.

[posit-connect-projects]

Claude finished @nealrichardson's task in 34s —— View job

---

Review: ci: require write permissions to trigger claude workflow

• Gather context and read the diff
• Review changes
• Post review feedback

---

The change adds a permission gate as the first step in the Claude workflow, ensuring only collaborators with write or admin permission can trigger it. This is a sensible security measure to prevent unauthorized users from invoking Claude on the repo.

Looks good. A few minor observations:

1. Trailing whitespace (line 43): There's a trailing blank space after the closing of the permission check step. Cosmetic only.

2. pull_request trigger path: The existing pull_request trigger on paths: ['.github/workflows/claude.yml'] (lines 12–15) fires on any PR that touches this file, regardless of who opened it. The new permission check correctly gates this too, which is the right call — without it, any fork PR modifying claude.yml would trigger the workflow and run Claude. Good.

3. github.actor on comment-triggered events: On issue_comment and pull_request_review_comment events, github.actor is the commenter, which is what you want here (the person who typed @claude). This is correct.

4. API error handling: If github.actor is not a collaborator at all (e.g., a random commenter on a public repo), the gh api .../collaborators/.../permission call will return a 404 rather than a permission level. The gh CLI will print an error and the $PERMISSION variable will be empty, which won't match admin or write, so the step will still fail with exit 1 — but the error message will say the actor has '' permission, which is a bit confusing. A minor UX improvement would be to handle the 404 case explicitly, but this is not a blocker.

Overall this is a clean, well-placed guard. Ship it.

---

[github-actions]

Preview deployed to Connect (localhost:3942): http://localhost:3942/connect/#/apps/aba51c6a-1200-4785-9723-614527454956/draft/8

Deployed from commit 6c79080.

[github-actions]

Cleaned up 1 preview bundle(s) on http://localhost:3942: 8

[github-actions]

Preview deployed to Connect (localhost:3940): http://localhost:3940/connect/#/apps/e673300a-611c-4434-a807-f296f3f982f4/draft/8

Deployed from commit 6c79080.

[github-actions]

Cleaned up 1 preview bundle(s) on http://localhost:3940: 8

[github-actions]

Preview deployed to Connect (localhost:3941): http://localhost:3941/connect/#/apps/7d41a13e-1ef9-4962-a05b-e182e4042c13/draft/8

Deployed from commit 6c79080.

[github-actions]

Cleaned up 1 preview bundle(s) on http://localhost:3941: 8