fix(ci): grant Claude Code workflow write access to open PRs#1087
Conversation
Signed-off-by: phernandez <paul@basicmachines.co>
Signed-off-by: phernandez <paul@basicmachines.co>
The Claude Code workflow (claude.yml) triggers implementation runs when a maintainer mentions the bot on an issue, but its job permissions were contents: read / pull-requests: read. That let a run edit files and commit locally, then fail at the push step with: remote: Permission to basicmachines-co/basic-memory.git denied to github-actions[bot] (403) so every run dead-ended without ever opening a PR (see #1084, which got stuck there twice). - contents/pull-requests/issues -> write so the bot can push its working branch, open the PR, and comment the link back on the issue. - Add a scoped claude_args --allowed-tools list (just/uv/uvx/pytest/ruff/ python) so a run can execute the project quality gates before opening the PR. The default Bash allowlist already covered git/gh and file edits (that part worked in #1084); only the test runners were blocked, so this is additive. The existing job gate still restricts triggering to OWNER/MEMBER/ COLLABORATOR, so fork PRs cannot exploit the added write scope. Signed-off-by: phernandez <paul@basicmachines.co>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 038130bff7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # write access lets @claude push its working branch and open the PR; | ||
| # with contents:read the push failed as github-actions[bot] (403) and the | ||
| # run dead-ended after committing locally (see #1084). | ||
| contents: write |
There was a problem hiding this comment.
When this job runs for pull_request_target, it still checks out github.event.pull_request.head.sha into the workspace before starting Claude, so raising the job token to contents: write gives a PR-head checkout the base-repo write context and OAuth-backed Claude session. Anthropic's action security docs warn not to check out an untrusted ref into the workspace root for pull_request_target (https://raw.githubusercontent.com/anthropics/claude-code-action/main/docs/security.md); this is reachable for any collaborator PR whose body contains @claude or a compromised collaborator branch. Keep the root checkout on the base ref, or put the PR head in a subdirectory via --add-dir, before enabling write permissions.
Useful? React with 👍 / 👎.
1 participant
Problem
The Claude Code workflow (`.github/workflows/claude.yml`) runs an implementation pass when a maintainer mentions the bot on an issue, but the job only had `contents: read` / `pull-requests: read`. A run could edit files and commit locally, then failed at push with:
```
remote: Permission to basicmachines-co/basic-memory.git denied to github-actions[bot] (403)
```
So every run dead-ended after committing, without ever opening a PR. #1084 hit this exact wall twice today.
Fix
Safety
The job's existing `if:` gate still restricts triggering to `OWNER`/`MEMBER`/`COLLABORATOR` association, so fork PRs from outside contributors cannot run the job and cannot exploit the added write scope.
Follow-up
Once merged, the bot-mention → PR flow works again. #1084 already has a fix committed on a stuck branch; re-mentioning the bot there should push it. Additional well-scoped issues (#1011, #991, #238/#684) are queued for the same treatment.
🤖 Generated with Claude Code