diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 61ba3f5..a50af5f 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -1,3 +1,6 @@ +# Claude Code — lightweight caller. The heavy logic lives in getnodus/workflow. +# Write @claude in an issue/PR/review comment (OWNER / MEMBER / COLLABORATOR only). + name: Claude Code on: @@ -12,35 +15,12 @@ on: jobs: claude: - # The @claude mention is invoked by issue/PR/review comments. On a public - # repo anyone can comment, so we gate on author_association as - # defense-in-depth on top of the action's own internal check. Only - # already-trusted accounts (OWNER / MEMBER / COLLABORATOR) can spin - # Claude using our org OAuth token. - if: | - ( - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.review.author_association)) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.issue.author_association)) - ) - runs-on: ubuntu-latest + uses: getnodus/workflow/.github/workflows/claude.yml@main permissions: contents: read pull-requests: read issues: read id-token: write actions: read - steps: - - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - with: - fetch-depth: 1 - - - name: Run Claude Code - id: claude - uses: anthropics/claude-code-action@v1 - with: - claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - additional_permissions: | - actions: read + secrets: + CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}