mirror of
https://github.com/l0ng-ai/tty7.git
synced 2026-09-22 00:02:23 +00:00
l0ng-ai
c6055c44d1
Three changes, one shape. The run was failing at the app-token exchange because the action checks the triggering actor's repository access and a fork PR's author has none; `github_token` plus `allowed_non_write_users` is the documented pair for pull_request_target, and the label gate is what makes trusting that actor a decision somebody made. Findings now go on the pull request instead of the run log, which needs `pull-requests: write`. That is affordable only because the tool allowlist stays read-only: with no Bash there is no curl, so the worst a successful injection buys is a silly comment. The fork's tree comes back, one directory down. #392 removed it entirely because a checkout at the workspace root is what Claude Code reads as the project -- but the action's own security guide gives the middle path, a subdirectory, which keeps the project files ours while letting the review see whole files instead of hunks. `.claude/` and friends are dropped from that tree and a top-level CLAUDE.md is renamed rather than deleted, since a PR that edits it still deserves review.