ci: let the claude bot trigger the PR audit workflows

[matt-aitken]

Summary

PRs opened by the claude GitHub app fail both the agent instructions audit and the REVIEW.md drift audit before Claude gets a chance to run. claude-code-action refuses any actor whose account type is not User unless the actor is listed in allowed_bots:

Workflow initiated by non-human actor: claude (type: Bot).
Add bot to allowed_bots list or use '*' to allow all bots.

So those PRs land with two permanently red checks and no audit coverage at all. Both workflows already allowlist Devin; this adds the claude app alongside it.

Why this does not open the workflows up to outside contributors

allowed_bots is only consulted for non-User actors. Humans, contributor or maintainer, take the separate write-permission path and are unaffected by what is in the list.

Beyond that, both jobs are guarded by github.event.pull_request.head.repo.full_name == github.repository, so a fork PR skips the job entirely, and they trigger on pull_request rather than pull_request_target, so a fork-triggered run would get no API key and a read-only token anyway.

The bot is named explicitly instead of using "*", which would let every bot trigger these audits, dependabot's PR stream included.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4f343a3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[devin-ai-integration]

Devin Review found 1 potential issue.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fcf41bf8-9f59-4173-9aa2-31bc06b18464

📥 Commits

Reviewing files that changed from the base of the PR and between d91818f and 4f343a3.

📒 Files selected for processing (2)

• .github/workflows/check-review-md.yml
• .github/workflows/claude-md-audit.yml

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: code-quality / code-quality

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-05-12T14:34:38.795Z

Learnt from: ericallam
Repo: triggerdotdev/trigger.dev PR: 3561
File: .github/workflows/check-review-md.yml:3-10
Timestamp: 2026-05-12T14:34:38.795Z
Learning: In this repo’s `.github/workflows/check-review-md.yml`, the workflow is intentionally configured to run on *all* `pull_request` events (e.g., `opened`, `ready_for_review`, `synchronize`) and not only when `.claude/REVIEW.md` changes. The Claude Code audit compares each PR’s diff against `REVIEW.md` to detect contradictions and new undocumented patterns, so restricting the trigger to paths limited to `.claude/REVIEW.md` would undermine that coverage. Do not suggest narrowing the `pull_request` trigger to only REVIEW.md-related path changes.

Applied to files:

• .github/workflows/check-review-md.yml

🔇 Additional comments (2)

.github/workflows/check-review-md.yml (1)

41-41: LGTM!

.github/workflows/claude-md-audit.yml (1)

43-43: LGTM!

---

Walkthrough

Updated the Claude Code action configuration in two GitHub Actions workflows to include claude[bot] in the allowed_bots settings. No other workflow logic or job behavior changed.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description explains the change and rationale, but it misses the required template sections and issue reference.	Add the issue reference, checklist items, Testing, Changelog, and Screenshots sections from the template, plus a brief note on how you tested it.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: allowing the Claude bot to trigger PR audit workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/allow-claude-bot-audits

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}