[Tooling] Secure Claude workflows

[iangmaia]

Summary

• Allow @claude review comments only from trusted commenters and skip Claude workflows on fork/external PRs before checkout or Claude execution.
• Pin mutable action references and preserve the Claude action's required OIDC permission for GitHub App token exchange.
• Keep review feedback inline-only where the workflow does not grant issue-comment permissions.

[dangermattic]

	1 Warning
⚠️	PR is not assigned to a milestone.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress Android by scanning the QR code below to install the corresponding build.

	App Name	WordPress Android
	Build Type	Debug
	Version	pr23056-7bd88fa
	Build Number	1498
	Application ID	org.wordpress.android.prealpha
	Commit	7bd88fa
	Installation URL	4vq3cfqloqkh0

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack Android by scanning the QR code below to install the corresponding build.

	App Name	Jetpack Android
	Build Type	Debug
	Version	pr23056-7bd88fa
	Build Number	1498
	Application ID	com.jetpack.android.prealpha
	Commit	7bd88fa
	Installation URL	1kg1dkvd03k00

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[Copilot]

Pull request overview

Hardens the claude-review GitHub Actions workflow to reduce exposure when triggered via issue_comment by ensuring Claude and checkout do not run for external/fork PRs, while also pinning action references and constraining review output to inline-only.

Changes:

• Adds an early PR-origin check (via gh api) and gates both checkout and Claude execution to internal PRs only.
• Pins actions/checkout and anthropics/claude-code-action to immutable SHAs and disables credential persistence on checkout.
• Updates the Claude prompt/tooling to use the issue_comment PR number and removes top-level PR commenting capability.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.