Restrict Claude workflow to trusted actors via author_association checks

[Copilot]

Any external GitHub user could trigger the Claude Code workflow by mentioning @claude in a comment or issue, causing it to run with contents/pull-requests/issues: write — a clear privilege-escalation path.

Changes

• author_association allowlist: The workflow if condition now gates execution on the triggering user having an association of OWNER, MEMBER, COLLABORATOR, or CONTRIBUTOR. NONE, FIRST_TIMER, and FIRST_TIME_CONTRIBUTOR are blocked.
• Bot exclusion: Added github.event.sender.type != 'Bot' guard.
• fromJSON + contains pattern: Used for clean, maintainable allowlist checks across all four event types.

if: |
  (github.event.sender.type != 'Bot') &&
  (
    (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR","CONTRIBUTOR"]'), github.event.comment.author_association)) ||
    ...
  )

The write permissions (pull-requests, issues, contents) are retained — they're required for Claude to post comments and push code changes.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.