[pull] main from anthropics:main

.claude/commands/link-review.md

@@ -3,7 +3,9 @@ allowed-tools: Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)
 description: Review links in changed files for quality and security issues
 ---
 
-Review the links in the changed files and check for potential issues:
+**IMPORTANT**: Only review the files explicitly listed in the prompt above. Do not search for or review additional files.
+
+Review the links in the specified changed files and check for potential issues:
 
 ## Link Quality Checks
 1. **Broken Links**: Identify any links that might be broken or malformed

.claude/commands/model-check.md

@@ -3,7 +3,9 @@ allowed-tools: Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)
 description: Validate Claude model usage against current public models
 ---
 
-Review the changed files for Claude model usage.
+**IMPORTANT**: Only review the files explicitly listed in the prompt above. Do not search for or review additional files.
+
+Review the specified changed files for Claude model usage.
 
 First, fetch the current list of allowed models from:
 https://docs.claude.com/en/docs/about-claude/models/overview.md

.claude/commands/notebook-review.md

@@ -3,7 +3,9 @@ allowed-tools: Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(
 description: Comprehensive review of Jupyter notebooks and Python scripts
 ---
 
-Review the changes to Jupyter notebooks and Python scripts in this PR using the Notebook review skill.
+**IMPORTANT**: Only review the files explicitly listed in the prompt above. Do not search for or review additional files.
+
+Review the specified Jupyter notebooks and Python scripts using the Notebook review skill.
 
 Provide a clear summary with:
 - ✅ What looks good

.github/workflows/claude-link-review.yml

@@ -8,26 +8,74 @@ on:
       - '**.mdx'
       - '**.ipynb'
       - 'README.md'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: number
 
 jobs:
   link-review:
+    # Only run for internal contributors (not forks) unless manually triggered
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
     steps:
-      - name: Checkout repository
+      - name: Set PR number
+        id: pr-number
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "number=${{ inputs.pr_number }}" >> $GITHUB_OUTPUT
+          else
+            echo "number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Checkout PR
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/pull/{0}/head', inputs.pr_number) || '' }}
+
+      - name: Get changed files
+        id: changed-files
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            # For manual dispatch, get base ref from PR
+            BASE_REF=$(gh pr view ${{ steps.pr-number.outputs.number }} --json baseRefName -q .baseRefName)
+            git fetch origin $BASE_REF
+            CHANGED_FILES=$(git diff --name-only origin/$BASE_REF...HEAD | grep -E '\.(md|mdx|ipynb)$' || echo "")
+          else
+            git fetch origin ${{ github.base_ref }}
+            CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.(md|mdx|ipynb)$' || echo "")
+          fi
+
+          if [ -z "$CHANGED_FILES" ]; then
+            echo "No relevant files changed"
+            echo "has_files=false" >> $GITHUB_OUTPUT
+          else
+            echo "Changed files:"
+            echo "$CHANGED_FILES"
+            echo "$CHANGED_FILES" > changed_files.txt
+            echo "has_files=true" >> $GITHUB_OUTPUT
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Claude Link Review
+        if: steps.changed-files.outputs.has_files == 'true'
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          prompt: "/link-review"
+          prompt: |
+            /link-review
+
+            Changed files to review:
+            $(cat changed_files.txt)
           claude_args: |
             --allowedTools "Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(echo:*),Read,Glob,Grep,WebFetch"
         env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_NUMBER: ${{ steps.pr-number.outputs.number }}

.github/workflows/claude-model-check.yml

@@ -7,27 +7,76 @@ on:
       - '**/*.ipynb'
       - '**.py'
       - '**.md'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: number
 
 permissions:
   contents: read
   pull-requests: write
 
 jobs:
   model-check:
+    # Only run for internal contributors (not forks) unless manually triggered
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
-    
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Set PR number
+        id: pr-number
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "number=${{ inputs.pr_number }}" >> $GITHUB_OUTPUT
+          else
+            echo "number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Checkout PR
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
-
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/pull/{0}/head', inputs.pr_number) || '' }}
+
+      - name: Get changed files
+        id: changed-files
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            # For manual dispatch, get base ref from PR
+            BASE_REF=$(gh pr view ${{ steps.pr-number.outputs.number }} --json baseRefName -q .baseRefName)
+            git fetch origin $BASE_REF
+            CHANGED_FILES=$(git diff --name-only origin/$BASE_REF...HEAD | grep -E '\.(ipynb|py|md)$' || echo "")
+          else
+            git fetch origin ${{ github.base_ref }}
+            CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.(ipynb|py|md)$' || echo "")
+          fi
+
+          if [ -z "$CHANGED_FILES" ]; then
+            echo "No relevant files changed"
+            echo "has_files=false" >> $GITHUB_OUTPUT
+          else
+            echo "Changed files:"
+            echo "$CHANGED_FILES"
+            echo "$CHANGED_FILES" > changed_files.txt
+            echo "has_files=true" >> $GITHUB_OUTPUT
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Claude Model Validation
+        if: steps.changed-files.outputs.has_files == 'true'
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          prompt: "/model-check"
+          prompt: |
+            /model-check
+
+            Changed files to review:
+            $(cat changed_files.txt)
           claude_args: |
             --allowedTools "Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(echo:*),Read,Glob,Grep,WebFetch"
         env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_NUMBER: ${{ steps.pr-number.outputs.number }}

.github/workflows/claude-notebook-review.yml

@@ -8,26 +8,74 @@ on:
       - 'pyproject.toml'
       - 'uv.lock'
       - 'scripts/**/*.py'
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        description: 'PR number to review'
+        required: true
+        type: number
 
 jobs:
   notebook-review:
+    # Only run for internal contributors (not forks) unless manually triggered
+    if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: write
     steps:
-      - name: Checkout repository
+      - name: Set PR number
+        id: pr-number
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "number=${{ inputs.pr_number }}" >> $GITHUB_OUTPUT
+          else
+            echo "number=${{ github.event.pull_request.number }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Checkout PR
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('refs/pull/{0}/head', inputs.pr_number) || '' }}
+
+      - name: Get changed files
+        id: changed-files
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            # For manual dispatch, get base ref from PR
+            BASE_REF=$(gh pr view ${{ steps.pr-number.outputs.number }} --json baseRefName -q .baseRefName)
+            git fetch origin $BASE_REF
+            CHANGED_FILES=$(git diff --name-only origin/$BASE_REF...HEAD | grep -E '\.(ipynb|py)$' || echo "")
+          else
+            git fetch origin ${{ github.base_ref }}
+            CHANGED_FILES=$(git diff --name-only origin/${{ github.base_ref }}...HEAD | grep -E '\.(ipynb|py)$' || echo "")
+          fi
+
+          if [ -z "$CHANGED_FILES" ]; then
+            echo "No relevant files changed"
+            echo "has_files=false" >> $GITHUB_OUTPUT
+          else
+            echo "Changed files:"
+            echo "$CHANGED_FILES"
+            echo "$CHANGED_FILES" > changed_files.txt
+            echo "has_files=true" >> $GITHUB_OUTPUT
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run Claude Notebook Review
+        if: steps.changed-files.outputs.has_files == 'true'
         uses: anthropics/claude-code-action@v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
-          prompt: "/notebook-review"
+          prompt: |
+            /notebook-review
+
+            Changed files to review:
+            $(cat changed_files.txt)
           claude_args: |
             --allowedTools "Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(echo:*),Read,Glob,Grep,WebFetch"
         env:
-          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_NUMBER: ${{ steps.pr-number.outputs.number }}