[Tooling] Secure Claude workflows

[iangmaia]

Summary

• Allow @claude review comments only from trusted commenters and skip Claude workflows on fork/external PRs before checkout or Claude execution.
• Pin mutable action references and preserve the Claude action's required OIDC permission for GitHub App token exchange.
• Keep review feedback inline-only where the workflow does not grant issue-comment permissions.

[dangermattic]

	1 Message
📖	This PR is still a Draft: some checks will be skipped.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress by scanning the QR code below to install the corresponding build.

	App Name	WordPress
	Configuration	Release-Alpha
	Build Number	32987
	Version	PR #25724
	Bundle ID	org.wordpress.alpha
	Commit	e9bbc4e
	Installation URL	48khpfb2nqu7o

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack by scanning the QR code below to install the corresponding build.

	App Name	Jetpack
	Configuration	Release-Alpha
	Build Number	32987
	Version	PR #25724
	Bundle ID	com.jetpack.alpha
	Commit	e9bbc4e
	Installation URL	3up2eividgr9g

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[Copilot]

Pull request overview

Hardens the claude-review GitHub Actions workflow by preventing Claude execution (and repository checkout) on external/fork PRs, and by pinning action references to immutable SHAs. This keeps the automated review surface area smaller for untrusted issue_comment events while maintaining inline-only review behavior.

Changes:

• Add a pre-check step that queries the PR’s head repository and skips the workflow for external/fork PRs before checkout/Claude execution.
• Pin actions/checkout and anthropics/claude-code-action to specific commit SHAs, and disable credential persistence on checkout.
• Update the prompt/input wiring for issue_comment events and restrict Claude’s allowed tools to inline-only feedback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.