fix: allow bot-triggered license audits

[brendan-kellam]

Summary

• allow the github-actions actor to invoke the Claude license audit
• keep the action allowlist scoped to the repository automation bot

Testing

• parsed .github/workflows/license-audit.yml with Ruby Psych
• ran git diff --check

Failure: https://github.com/sourcebot-dev/sourcebot/actions/runs/31248976662/job/93524070990?pr=1557

---

Note

Low Risk
Single workflow input change scoped to repository automation; no application or security logic changes.

Overview
The License Audit workflow’s Audit licenses with Claude step now passes allowed_bots: "github-actions" to anthropics/claude-code-action@v1, so runs triggered by the GitHub Actions bot are accepted instead of being blocked by the action’s bot allowlist.

^{Reviewed by Cursor Bugbot for commit 6615fb9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Summary by CodeRabbit

• Bug Fixes

  • License audits can now run successfully when triggered by GitHub Actions.

• Documentation

  • Added an Unreleased changelog entry documenting the license audit improvement.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 52b90889-a6d8-4c2f-b818-ab5967da057e

📥 Commits

Reviewing files that changed from the base of the PR and between 66ff430 and 777dd0f.

📒 Files selected for processing (2)

• .github/workflows/license-audit.yml
• CHANGELOG.md

---

Walkthrough

The license-audit workflow now permits the Claude audit step to interact only with the github-actions bot. The unreleased changelog documents that GitHub Actions can run license audits.

Changes

License audit workflow

Layer / File(s)	Summary
Configure Claude bot access .github/workflows/license-audit.yml, CHANGELOG.md	The Claude audit action restricts permitted bot actors to github-actions. The Unreleased changelog records the trigger behavior.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• sourcebot-dev/sourcebot#1003: Introduced the license-audit workflow that this change updates.
• sourcebot-dev/sourcebot#1021: Modified the license-audit workflow and documented its trigger behavior.

Suggested reviewers: msukkari

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the workflow change that enables bot-triggered license audits.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch brendan/fix-license-audit-bot

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}