Add comment-triggered code review for PRs from forks - #95
Merged
Conversation
claude-code-review.yml can't work for fork PRs: pull_request events from forks never receive an OIDC token at all (GitHub never sets ACTIONS_ID_TOKEN_REQUEST_URL for them, regardless of id-token: write - confirmed on PR #77, run 30686460528/job/91333167166), and switching to pull_request_target doesn't help either since Anthropic's token-exchange endpoint rejects OIDC tokens minted under that event (#89, anthropics/claude-code-action#713). issue_comment is subject to neither restriction. Add a workflow, gated to OWNER/MEMBER/COLLABORATOR commenters, that a maintainer can trigger with "@claude review" on any PR - fork or not - to get the same review claude-code-review.yml gives same-repo PRs.
Contributor
|
This was referenced Aug 1, 2026
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
claude-code-review.yml(fixed for same-repo PRs across Revert claude-review to the pull_request trigger #89/Restore pull-requests: write for claude-review #91/Allow claude-review to actually post its comment/inline review #92/Temporarily enable show_full_output on claude-review (diagnostic) #93/Match claude-review's allowed-tools to the plugin's own frontmatter #94) structurally cannot review PRs from forks, no matter how it's configured:pull_requesttrigger never receives an OIDC token for fork PRs at all — GitHub doesn't setACTIONS_ID_TOKEN_REQUEST_URLfor those runs regardless ofid-token: write. Confirmed on PR #77, run 30686460528/job/91333167166:pull_request_target(which does get OIDC tokens for forks) doesn't help either — that's exactly what Revert claude-review to the pull_request trigger #89 moved away from, because Anthropic's token-exchange endpoint rejects OIDC tokens minted under that event (anthropics/claude-code-action#713).claude-review-comment.yml, triggered byissue_commentinstead. That event isn't subject to either restriction (notpull_requestfrom a fork, notpull_request_target), so it works for any PR, fork or not.github.event.comment.author_associationtoOWNER/MEMBER/COLLABORATOR— comment-triggered workflows aren't covered by the "require approval for first-time contributors" setting that gates forkpull_requestruns, so this keeps it to trusted maintainers rather than any commenter.refs/pull/<n>/head, which GitHub mirrors into the base repo for every PR (including forks) — no fork credentials needed.code-reviewplugin with the sameclaude_argsallowlist asclaude-code-review.yml, so the review itself behaves identically.@claude reviewon the PR (e.g. Add Elaine Wang profile to team page #77).Test plan
@claude reviewon a fork PR (e.g. Add Elaine Wang profile to team page #77) and confirm a real review comment appearsGenerated by Claude Code