From 67120cd93c5621e69657f8d88a2602f1df7e7c68 Mon Sep 17 00:00:00 2001 From: frankbria Date: Mon, 6 Jul 2026 21:46:41 -0700 Subject: [PATCH] fix(ci): gate comment-triggered AI workflows on author association (#748) Comment-triggered AI workflows spent paid credits (ZHIPU_API_KEY, CLAUDE_CODE_OAUTH_TOKEN) for any commenter, since neither job gated on author_association. External users could drain credits at will. - opencode.yml + claude.yml: gate on author_association in {OWNER, MEMBER, COLLABORATOR}, read from the correct event object per trigger (comment/review/issue). - opencode.yml: drop the loose ' /oc'/' /opencode' substring matches; keep only startsWith prefix matches so the command must begin the comment. Closes #748 --- .github/workflows/claude.yml | 8 ++++---- .github/workflows/opencode.yml | 7 +++---- 2 files changed, 7 insertions(+), 8 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 4ffcea0f..9f0c2af0 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -13,10 +13,10 @@ on: jobs: claude: if: | - (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) || - (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) || - (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude'))) + (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) || + (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) || + (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) || + (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) && contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association)) runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/opencode.yml b/.github/workflows/opencode.yml index 59098551..3597482b 100644 --- a/.github/workflows/opencode.yml +++ b/.github/workflows/opencode.yml @@ -9,10 +9,9 @@ on: jobs: opencode: if: | - contains(github.event.comment.body, ' /oc') || - startsWith(github.event.comment.body, '/oc') || - contains(github.event.comment.body, ' /opencode') || - startsWith(github.event.comment.body, '/opencode') + contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association) && + (startsWith(github.event.comment.body, '/oc') || + startsWith(github.event.comment.body, '/opencode')) runs-on: ubuntu-latest permissions: id-token: write