From 8cefe89fbf3ae3df6147ae3b026c566e351e1ef2 Mon Sep 17 00:00:00 2001 From: "[IKcoding-jp]" <[kensaku.ikeda04@gmail.com]> Date: Mon, 3 Aug 2026 09:45:43 +0900 Subject: [PATCH] =?UTF-8?q?chore:=20Claude=20=E3=83=AF=E3=83=BC=E3=82=AF?= =?UTF-8?q?=E3=83=95=E3=83=AD=E3=83=BC=E3=81=AE=E6=A8=A9=E9=99=90=E3=82=92?= =?UTF-8?q?=E5=AE=9F=E7=94=A8=E6=9C=80=E5=B0=8F=E9=99=90=E3=81=AB=E4=BF=AE?= =?UTF-8?q?=E6=AD=A3=E3=81=97=E6=97=A7=E3=83=95=E3=82=A1=E3=82=A4=E3=83=AB?= =?UTF-8?q?=E3=82=92=E5=89=8A=E9=99=A4?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - claude.yml: コラボレーター限定の authorize ジョブを復活し、 contents/pull-requests/issues を write に変更（read のみだとコメント投稿不可） - claude-code-review.yml: pull-requests を write に変更し、 secrets が渡らない fork PR では実行しないよう条件を追加 - 無効化されたまま残っていた claude.yml.disabled を削除 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01WWxo2ZpLgqp8pd54g9qF1f --- .github/workflows/claude-code-review.yml | 9 +-- .github/workflows/claude.yml | 39 ++++++++++-- .github/workflows/claude.yml.disabled | 78 ------------------------ 3 files changed, 38 insertions(+), 88 deletions(-) delete mode 100644 .github/workflows/claude.yml.disabled diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 25f4ad18..740a5aaf 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -12,16 +12,13 @@ on: jobs: claude-review: - # Optional: Filter by PR author - # if: | - # github.event.pull_request.user.login == 'external-contributor' || - # github.event.pull_request.user.login == 'new-developer' || - # github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR' + # fork からの PR では実行しない（secrets が渡らず失敗するため） + if: github.event.pull_request.head.repo.full_name == github.repository runs-on: ubuntu-latest permissions: contents: read - pull-requests: read + pull-requests: write # レビュー結果を PR にコメントするために必要 issues: read id-token: write diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index eb9719ec..13039116 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -11,7 +11,9 @@ on: types: [submitted] jobs: - claude: + # @claude を書いた本人がこのリポジトリへの書込権限を持つかを先に確認する。 + # claude ジョブは書込権限を持つため、第三者のコメントで起動させない。 + authorize: if: | (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || @@ -20,10 +22,39 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - pull-requests: read - issues: read + outputs: + trusted: ${{ steps.permission.outputs.trusted }} + steps: + - name: Check actor repository permission + id: permission + env: + GH_TOKEN: ${{ github.token }} + REPOSITORY: ${{ github.repository }} + ACTOR: ${{ github.actor }} + run: | + set -euo pipefail + + permission=$(gh api "repos/${REPOSITORY}/collaborators/${ACTOR}/permission" --jq '.permission' 2>/dev/null || echo none) + + case "$permission" in + admin|maintain|write) + echo "trusted=true" >> "$GITHUB_OUTPUT" + ;; + *) + echo "trusted=false" >> "$GITHUB_OUTPUT" + ;; + esac + + claude: + needs: authorize + if: needs.authorize.outputs.trusted == 'true' + runs-on: ubuntu-latest + permissions: + contents: write # ブランチ作成・push に必要 + pull-requests: write # PR の作成・コメント投稿に必要 + issues: write # Issue へのコメント投稿に必要 id-token: write - actions: read # Required for Claude to read CI results on PRs + actions: read # PR の CI 結果を読むために必要 steps: - name: Checkout repository uses: actions/checkout@v4 diff --git a/.github/workflows/claude.yml.disabled b/.github/workflows/claude.yml.disabled deleted file mode 100644 index 28a9bedc..00000000 --- a/.github/workflows/claude.yml.disabled +++ /dev/null @@ -1,78 +0,0 @@ -name: Claude Code - -on: - issue_comment: - types: [created] - pull_request_review_comment: - types: [created] - issues: - types: [opened, assigned] - pull_request_review: - types: [submitted] - -jobs: - authorize: - if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) - runs-on: ubuntu-latest - permissions: - contents: read - outputs: - trusted: ${{ steps.permission.outputs.trusted }} - steps: - - name: Check actor repository permission - id: permission - env: - GH_TOKEN: ${{ github.token }} - REPOSITORY: ${{ github.repository }} - ACTOR: ${{ github.actor }} - run: | - set -euo pipefail - - permission=$(gh api "repos/${REPOSITORY}/collaborators/${ACTOR}/permission" --jq '.permission' 2>/dev/null || echo none) - - case "$permission" in - admin|maintain|write) - echo "trusted=true" >> "$GITHUB_OUTPUT" - ;; - *) - echo "trusted=false" >> "$GITHUB_OUTPUT" - ;; - esac - - claude: - needs: authorize - if: needs.authorize.outputs.trusted == 'true' - runs-on: ubuntu-latest - permissions: - contents: read - pull-requests: read - issues: read - actions: read # Required for Claude to read CI results on PRs - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - fetch-depth: 1 - - - name: Run Claude Code - id: claude - uses: anthropics/claude-code-action@v1 - with: - claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - - # This is an optional setting that allows Claude to read CI results on PRs - additional_permissions: | - actions: read - - # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it. - # prompt: 'Update the pull request description to include a summary of changes.' - - # Optional: Add claude_args to customize behavior and configuration - # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md - # or https://code.claude.com/docs/en/cli-reference for available options - # claude_args: '--allowed-tools Bash(gh pr:*)' -