Enable @claude workflow to open PRs

[d-morrison]

Summary

• Bumps claude.yml permissions to write for contents, pull-requests, and issues so an @claude invocation can push a branch and open a PR.
• Restricts claude.yml to trusted authors (OWNER / MEMBER / COLLABORATOR) via the job-level if: guard — a write-scoped token shouldn't be reachable by anyone who can comment on a public issue.
• Adds an --allowedTools list to claude_args covering the git + gh commands needed for branch push and PR creation, plus a narrowed set of Rscript -e patterns (lintr::lint*, devtools::check*, devtools::document*, pkgdown::build*) — a bare Rscript -e * would let Claude shell out via system() and bypass the git-push deny list.
• Extends --disallowedTools to cover the +ref force-push refspec form (Bash(git push origin +*), Bash(git push -u origin +*)) in addition to the --force / -f / --delete / --mirror / --tags / --all flag forms. The :ref delete-refspec can't be expressed in Claude Code's pattern syntax (a trailing :* is the trailing-wildcard alias, not a literal : + wildcard); defense-in-depth comes from GitHub branch protection on main.
• quarto render / quarto check are intentionally not in the allowed list — rendering this site evaluates R code chunks which can call system() and re-open the bypass. Builds belong in a separate non-write job if @claude ever needs one.
• Adds CLAUDE.md (Quarto/R conventions, things not to edit, PR expectations) so the workflow's Claude has the same project context the existing Copilot instructions provide.
• Adds .claude/settings.json with sensible default allow/deny rules for local Claude Code use; .claude/.gitignore keeps settings.local.json out of git.
• Adds an if: guard to claude-code-review.yml to skip draft PRs and Dependabot bumps — neither benefits from an LLM review and Dependabot bumps would otherwise burn API quota on every patch release. Also switches the checkout to submodules: recursive so reviews can see the macros/ submodule content.

Without the claude.yml changes, the canonical workflow on main has all-read permissions and an empty allowed-tools list, so it can comment but can't push branches or call gh pr create.

Test plan

• Open an issue and mention @claude asking for a small fix; verify the workflow pushes a branch and opens a PR rather than only commenting.
• Confirm the workflow run logs show the expected --allowedTools list and no permission errors.
• Verify the actor gate refuses an @claude mention from a non-collaborator account (e.g. via a draft PR from a fork).
• Confirm the review workflow still runs and now skips drafts / Dependabot.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR configures Claude Code for this Quarto/R template repository so @claude invocations can create branches and PRs, while adding repo-specific Claude guidance and local permission defaults.

Changes:

• Expands .github/workflows/claude.yml permissions and Claude allowed tools.
• Adds CLAUDE.md with project conventions and PR expectations.
• Adds .claude/ defaults for Claude Code settings and local settings ignores.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
CLAUDE.md	Adds Claude Code repository guidance and workflow expectations.
.github/workflows/claude.yml	Grants write permissions and configures Claude allowed tools for branch/PR creation.
.claude/settings.json	Adds default local Claude Code allow/deny permissions.
.claude/.gitignore	Keeps local Claude settings out of version control.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

.github/workflows/claude.yml:68

• Allowing unrestricted Rscript -e * lets Claude run arbitrary shell commands from R (for example via system()), which bypasses the --disallowedTools protections for destructive git push variants. If the workflow needs write-scoped tokens, restrict this helper to specific safe commands or run validation helpers in a separate non-writing context.

          claude_args: |
            --allowedTools "Bash(quarto render),Bash(quarto check),Bash(Rscript -e *),Bash(git diff:*),Bash(git log:*),Bash(git status:*),Bash(git checkout:*),Bash(git switch:*),Bash(git branch:*),Bash(git add:*),Bash(git commit:*),Bash(git push origin:*),Bash(git push -u origin:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr create:*),Bash(gh pr edit:*),Bash(gh issue view:*)" --disallowedTools "Bash(git push --force:*),Bash(git push -f:*),Bash(git push --delete:*),Bash(git push -d:*),Bash(git push --mirror:*),Bash(git push --tags:*),Bash(git push --all:*)"

[d-morrison]

@claude apply changes based on the comments in this thread

[claude]

Claude finished @d-morrison's task in 4m 25s —— View job

---

Applying Copilot review changes

• Read current state of changed files
• Fix CLAUDE.md: split _extensions/ and macros/ onto separate lines so it's unambiguous only macros/ is a git submodule; add explicit (see .gitmodules) reference; strengthen the "Submodules" note to say macros/ is the only submodule
• CLAUDE.md parenthetical CI list: already resolved in the previous commit (bb30796) — the list was replaced with the concise "CI workflow definitions" label
• .claude/settings.json Rscript -e * restriction: blocked — Claude Code treats its own settings files as sensitive and won't let an agent running in CI rewrite them (this is intentional security behaviour). See manual fix below.
• .github/workflows/ security changes (actor gate, destructive-refspec deny list): blocked — GitHub App permissions do not allow workflow file modifications. See manual fix below.

---

What was committed

3305641 — CLAUDE.md:

• _extensions/ and macros/ are now on separate lines in the layout table, removing any ambiguity that both are submodules
• The macros/ entry now reads "git submodule for shortcode/macro definitions (see .gitmodules)" with an explicit pointer to .gitmodules
• The "Working in this repo" submodule note now says macros/ is the only git submodule

---

Manual changes still needed

.claude/settings.json — restrict Rscript

Replace the broad "Bash(Rscript -e *)" entry with specific safe patterns to prevent bypassing the deny list via system():

"Bash(Rscript -e 'lintr::*')",
"Bash(Rscript -e 'devtools::check*')",
"Bash(Rscript -e 'devtools::document*')",
"Bash(Rscript -e 'pkgdown::*')",

.github/workflows/claude.yml — actor gate + destructive-refspec deny list

The workflow file needs:

1. A collaborator/trusted-user check before granting write access (e.g. check github.event.comment.author_association is OWNER, MEMBER, or COLLABORATOR)
2. The git push deny-list entries should also cover :branch (delete-ref) and +ref (force-update) refspec forms — not just the --force / -f flags

These require a human with workflow-write permissions to apply.

---

· Branch

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (3)

.github/workflows/claude.yml:78

• The allowed git push origin:* / git push -u origin:* patterns still permit delete refspecs such as git push origin :some-branch, while the deny list only blocks the --delete/-d forms. With the write-scoped token this can delete any unprotected branch, so the workflow should narrow the allowed push form (for example to a dedicated branch prefix/refspec) or otherwise block colon delete refspecs before granting push access.

          claude_args: |
            --allowedTools "Bash(quarto render),Bash(quarto check),Bash(Rscript -e 'lintr::lint*'),Bash(Rscript -e 'devtools::check*'),Bash(Rscript -e 'devtools::document*'),Bash(Rscript -e 'pkgdown::build*'),Bash(git diff:*),Bash(git log:*),Bash(git status:*),Bash(git checkout:*),Bash(git switch:*),Bash(git branch:*),Bash(git add:*),Bash(git commit:*),Bash(git push origin:*),Bash(git push -u origin:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr create:*),Bash(gh pr edit:*),Bash(gh issue view:*)" --disallowedTools "Bash(git push --force:*),Bash(git push -f:*),Bash(git push --delete:*),Bash(git push -d:*),Bash(git push --mirror:*),Bash(git push --tags:*),Bash(git push --all:*),Bash(git push origin +*),Bash(git push -u origin +*)"

.github/workflows/claude.yml:78

• The workflow permits git commit but never configures a Git committer identity, and the allowed tool list does not permit git config for Claude to set one. GitHub-hosted runners are not guaranteed to have user.name/user.email, so the branch/PR flow can fail at git commit with “Author identity unknown”; add an explicit setup step or narrowly allow the needed git config user.* commands.

          claude_args: |
            --allowedTools "Bash(quarto render),Bash(quarto check),Bash(Rscript -e 'lintr::lint*'),Bash(Rscript -e 'devtools::check*'),Bash(Rscript -e 'devtools::document*'),Bash(Rscript -e 'pkgdown::build*'),Bash(git diff:*),Bash(git log:*),Bash(git status:*),Bash(git checkout:*),Bash(git switch:*),Bash(git branch:*),Bash(git add:*),Bash(git commit:*),Bash(git push origin:*),Bash(git push -u origin:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr create:*),Bash(gh pr edit:*),Bash(gh issue view:*)" --disallowedTools "Bash(git push --force:*),Bash(git push -f:*),Bash(git push --delete:*),Bash(git push -d:*),Bash(git push --mirror:*),Bash(git push --tags:*),Bash(git push --all:*),Bash(git push origin +*),Bash(git push -u origin +*)"

.github/workflows/claude.yml:78

• The allowed gh pr create path still lacks authentication for the GitHub CLI: gh expects a token in GH_TOKEN/GITHUB_TOKEN, but this workflow does not export ${{ github.token }} (the Claude OAuth token is unrelated). Without that env, PR creation can fail with gh authentication errors even though the job permissions are write-scoped.

          claude_args: |
            --allowedTools "Bash(quarto render),Bash(quarto check),Bash(Rscript -e 'lintr::lint*'),Bash(Rscript -e 'devtools::check*'),Bash(Rscript -e 'devtools::document*'),Bash(Rscript -e 'pkgdown::build*'),Bash(git diff:*),Bash(git log:*),Bash(git status:*),Bash(git checkout:*),Bash(git switch:*),Bash(git branch:*),Bash(git add:*),Bash(git commit:*),Bash(git push origin:*),Bash(git push -u origin:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh pr create:*),Bash(gh pr edit:*),Bash(gh issue view:*)" --disallowedTools "Bash(git push --force:*),Bash(git push -f:*),Bash(git push --delete:*),Bash(git push -d:*),Bash(git push --mirror:*),Bash(git push --tags:*),Bash(git push --all:*),Bash(git push origin +*),Bash(git push -u origin +*)"

[d-morrison]

@claude apply changes based on the comments in this thread

[claude]

Claude finished @d-morrison's task in 7m 5s —— View job

---

Review of Copilot comment thread #4315522929

• Read current state of changed files
• Assessed which review comments are actionable

---

What's already addressed (prior commits)

The branch (b961e69, 07299ef) already resolved the key items from earlier Copilot reviews:

• ✅ Actor gate — claude.yml if: condition requires author_association in ["OWNER","MEMBER","COLLABORATOR"] before any write-scoped run
• ✅ Rscript restriction — Rscript -e * replaced with four specific safe namespaces (lintr::lint*, devtools::check*, devtools::document*, pkgdown::build*)
• ✅ Force-push / +ref refspec deny list — Bash(git push origin +*) and Bash(git push -u origin +*) added to disallowed tools
• ✅ macros/ submodule clarity in CLAUDE.md

---

Items from review #4315522929 — assessment

Non-suppressed (high confidence):

1. claude-code-review.yml description mismatch — The PR body says the file is "intentionally untouched" but it was changed to skip drafts and Dependabot PRs. The PR body should be updated to reflect this.

   Blocked: gh pr edit and gh api both require approval in this CI environment. Manual fix: Update the PR description to replace the line claude-code-review.yml is intentionally untouched. with a bullet like: Adds an if: guard to claude-code-review.yml to skip draft PRs and Dependabot bumps — neither benefits from an LLM review, and Dependabot bumps would otherwise consume API quota on every patch release.

2. quarto render / quarto check in write-scoped context — Quarto executes R code chunks during render; chunks in this repo can call system(), which bypasses the git push deny list. The fix is to remove Bash(quarto render) and Bash(quarto check) from the --allowedTools line in claude.yml (or move render/check to a separate job without write credentials).

   Blocked: Modifying .github/workflows/ files is not permitted via the GitHub App token. Manual fix needed in claude.yml line 78:

   - --allowedTools "Bash(quarto render),Bash(quarto check),Bash(Rscript -e 'lintr::lint*'),...
   + --allowedTools "Bash(Rscript -e 'lintr::lint*'),...

Suppressed (low confidence):

3. :branch delete-refspec not blocked — Already acknowledged in the workflow comments: "the :ref delete-refspec form can't be expressed in Claude Code's pattern syntax…so destructive deletes are caught instead by GitHub branch protection on the default branch." No action needed if branch protection is in place.

4. Git committer identity — The claude-code-action configures git identity automatically in its setup step; this is not a concern in practice.

5. GH_TOKEN for gh pr create — The claude-code-action exposes GITHUB_TOKEN to Claude automatically when the job has pull-requests: write; this is not a concern in practice.

---

Summary

Both actionable items from this review require human intervention (workflow-write permissions for the quarto render change, and a direct PR description edit). No code commits were made — the branch is clean. The two manual fixes are described above.
· Branch

[d-morrison]

@claude please review the new commit 130efcb (drops quarto render / quarto check from @claude --allowedTools to prevent R-chunk system() bypass; PR body also updated to accurately describe the claude-code-review.yml changes). Report any remaining actionable issues. The auto-review claude-review check failure is expected — the action validates the workflow file against main so it can't pass on a PR that modifies the workflow itself.

[claude]

Claude finished @d-morrison's task in 2m 25s —— View job

---

Review of commit 130efcb

• Read current state of all changed files
• Verified commit 130efcb changes
• Assessed all remaining review thread items
• Report findings

---

130efcb — Assessment: ✅ Clean and correct

The commit does exactly what the message says:

• Both Bash(quarto render) and Bash(quarto check) are removed from the --allowedTools string in .github/workflows/claude.yml line 83.
• The added inline comment clearly explains the rationale (R code chunks → system() → bypasses deny list) and the recommended workaround (separate non-write job).
• The PR body already accurately describes both the claude-code-review.yml changes and the quarto exclusion rationale.

---

Remaining actionable issues

1. Redundant actions: read (minor cleanup)

In claude.yml, actions: read appears in two places:

# Line 39 — job-level permissions block
actions: read

# Lines 54–55 — additional_permissions input to the action
additional_permissions: |
  actions: read

The job-level permissions: block already grants actions: read to the runner. The additional_permissions input is passed to the claude-code-action's own invocation and is redundant when the job already holds the permission. Harmless, but one of the two can be removed to avoid confusion about which one is doing the work.

2. Known, documented limitation: :branch delete-refspec (no action needed)

The deny list blocks --delete, -d, +ref force-update, but git push origin :branch (colon-delete refspec) can't be expressed in Claude Code's pattern syntax. This is correctly documented in the inline comment at lines 65–69 and mitigated by branch protection on main. No further action is needed here unless branch protection is not currently enabled on this repo.

3. .claude/settings.json still allows quarto render locally (intentional)

The local settings file retains Bash(quarto render) and Bash(quarto check). This is correct and intentional — local Claude Code sessions don't run with a write-scoped GITHUB_TOKEN, so the system() bypass concern doesn't apply. The security boundary is the CI workflow only.

---

All prior review items — status

Issue	Status
Actor gate (OWNER/MEMBER/COLLABORATOR only)	✅ Fixed (07299ef)
Rscript -e * → specific safe namespaces	✅ Fixed (b961e69)
+ref force-update refspec deny list	✅ Fixed (b961e69)
quarto render/quarto check bypass	✅ Fixed (130efcb)
macros/ as the only submodule	✅ Fixed (3305641)
CLAUDE.md parenthetical CI list	✅ Fixed (bb30796)
PR body describing claude-code-review.yml changes	✅ Fixed (PR body updated)
:branch delete-refspec	Documented limitation; mitigated by branch protection
git commit committer identity	Handled by claude-code-action setup step — not a concern
GH_TOKEN for gh CLI	Exposed by action automatically when pull-requests: write — not a concern

The PR is in good shape. The only thing I'd call out to address before merge is the redundant actions: read (item 1 above), if you want a clean config — but it has no functional impact.
· Branch

[d-morrison]

@claude please review the new commit 91b2bb2 (drops the redundant additional_permissions: actions: read input from the action; the job-level permissions: block already grants the scope). Anything still actionable?

[claude]

Claude finished @d-morrison's task in 45s —— View job

---

Review of commit 91b2bb2

• Read current state of changed files
• Verified 91b2bb2 correctly removes the redundant additional_permissions: actions: read
• Checked for remaining actionable issues
• Report findings

---

91b2bb2 — Assessment: ✅ Clean and correct

The commit does exactly what the message says. The additional_permissions: | actions: read block is removed and replaced with a comment explaining why it is not needed — the job-level permissions: block at lines 34–39 is the canonical place to grant GITHUB_TOKEN scopes, and the action input was a no-op duplicate. The wording of the replacement comment is accurate and useful for future editors.

---

All issues — final status

Issue	Status
Actor gate (OWNER/MEMBER/COLLABORATOR only)	✅ Fixed (07299ef)
Rscript -e * → specific safe namespaces	✅ Fixed (b961e69)
+ref force-update refspec deny list	✅ Fixed (b961e69)
quarto render/quarto check bypass	✅ Fixed (130efcb)
macros/ as the only submodule in CLAUDE.md	✅ Fixed (3305641)
CLAUDE.md parenthetical CI list	✅ Fixed (bb30796)
PR body describing claude-code-review.yml changes	✅ Fixed (PR body updated)
Redundant actions: read in additional_permissions	✅ Fixed (91b2bb2)
:branch delete-refspec not blockable	Documented limitation (lines 65–69); mitigated by branch protection on main
Git committer identity	Handled by claude-code-action setup step — not a concern
GH_TOKEN for gh CLI	Exposed automatically by the action when pull-requests: write — not a concern

No remaining actionable items. The PR is ready to merge.
· Branch

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

[d-morrison]

@claude apply changes based on the comments in this thread and other unaddressed comments

[claude]

Claude finished @d-morrison's task in 1m 51s —— View job

---

Review of thread #4316868793 — assessment complete

• Read current state of changed files
• Assessed actionable items from review #4316868793
• Assessed all previously-open items
• Report findings

---

Both actionable items from review #4316868793 are in .github/workflows/ files. GitHub App permissions do not allow workflow file modifications, so these require human intervention. There are no non-workflow changes outstanding.

---

Item 1 — claude.yml:32: issues.assigned actor gate is wrong

What's broken: Line 32 checks github.event.issue.author_association (the issue author's association) for all issues events, including assigned. For assigned, the triggering actor is github.actor (the person who did the assigning), not the issue author — so a collaborator assigning themselves to an issue filed by an outsider would fail the write-scoped gate.

Fix: Remove assigned from the issues trigger types. The @claude text lives in the issue body (written by the original author), so assigned events don't add new @claude mentions; they just change who's assigned. Collaborators can add a comment instead.

-  issues:
-    types: [opened, assigned]
+  issues:
+    types: [opened]

Or, if you want to keep assigned, change the if: for that branch to check github.actor's association — but that requires an API call since github.actor is a username, not an association. Removing assigned is simpler and loses nothing useful.

---

Item 2 — claude-code-review.yml:24: runs on fork PRs where CLAUDE_CODE_OAUTH_TOKEN is unavailable

What's broken: On pull_request events from forks, GitHub doesn't expose repository secrets, so secrets.CLAUDE_CODE_OAUTH_TOKEN is empty and the job fails with a noisy red check for every external contributor PR.

Fix: Add a same-repo guard to the if: condition:

-    if: github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]'
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.login != 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository

---

All items — final status

Issue	Status
Actor gate (OWNER/MEMBER/COLLABORATOR only)	✅ Fixed (07299ef)
Rscript -e * → specific safe namespaces	✅ Fixed (b961e69)
+ref force-update refspec deny list	✅ Fixed (b961e69)
quarto render/quarto check bypass	✅ Fixed (130efcb)
macros/ as the only submodule in CLAUDE.md	✅ Fixed (3305641)
CLAUDE.md parenthetical CI list	✅ Fixed (bb30796)
PR body describing claude-code-review.yml changes	✅ Fixed (PR body updated)
Redundant actions: read in additional_permissions	✅ Fixed (91b2bb2)
issues.assigned checks issue author, not actor	Manual fix needed — remove assigned from issues.types in claude.yml
Review workflow runs on fork PRs (secret unavailable)	Manual fix needed — add head.repo.full_name == github.repository guard to claude-code-review.yml
:branch delete-refspec not blockable	Documented limitation; mitigated by branch protection on main
· Branch

[d-morrison]

@claude implement recommended fixes, then review again

[claude]

Claude finished @d-morrison's task in 2m 9s —— View job

---

Implementation attempt + final review

• Read current state of workflow files
• Applied fixes locally (committed as a4cf48d)
• Attempted push — blocked: GitHub App token lacks workflows scope; cannot push .github/workflows/ changes
• Final review of remote branch state

---

What was attempted (local commit a4cf48d, not pushable)

Both remaining items were edited and committed locally but rejected at push time with:

refusing to allow a GitHub App to create or update workflow without workflows permission

This is the same limitation noted in prior runs. Both fixes require a human with workflows write permission.

---

Manual fixes still needed

Fix 1 — claude.yml line 19: remove assigned from issues trigger

The if: guard on line 32 checks github.event.issue.author_association (the issue author's association). For assigned events the triggering actor is github.actor, not the issue author — a collaborator assigning themselves to an outsider's issue fails the gate. Removing assigned avoids the mismatch; collaborators can add a comment instead.

-  issues:
-    types: [opened, assigned]
+  issues:
+    types: [opened]

Fix 2 — claude-code-review.yml line 24: add same-repo guard

On fork pull_request events GitHub doesn't expose repository secrets, so CLAUDE_CODE_OAUTH_TOKEN is empty and the job fails with a noisy red check for external contributors.

-    if: github.event.pull_request.draft == false && github.event.pull_request.user.login != 'dependabot[bot]'
+    if: |
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.login != 'dependabot[bot]' &&
+      github.event.pull_request.head.repo.full_name == github.repository

---

Final review — all items

Issue	Status
Actor gate (OWNER/MEMBER/COLLABORATOR only)	✅ Fixed (07299ef)
Rscript -e * → specific safe namespaces (CI)	✅ Fixed (b961e69)
Rscript -e * in .claude/settings.json (local)	✅ Fixed (b961e69) — local sessions don't carry write-scoped token, intentionally broader
+ref force-update refspec deny list	✅ Fixed (b961e69)
quarto render/quarto check bypass in CI	✅ Fixed (130efcb)
macros/ as the only submodule in CLAUDE.md	✅ Fixed (3305641)
CLAUDE.md parenthetical CI list	✅ Fixed (bb30796)
PR body describing claude-code-review.yml changes	✅ Fixed (PR body updated)
Redundant actions: read in additional_permissions	✅ Fixed (91b2bb2)
issues.assigned checks issue author, not actor	⚠️ Manual fix needed — diff above
Review workflow runs on fork PRs (secret unavailable)	⚠️ Manual fix needed — diff above
:branch delete-refspec not blockable	Documented limitation (lines 65–69 of claude.yml); mitigated by branch protection on main

The two remaining items are purely defensive — neither is a regression introduced by this PR (the original workflow had no issues.assigned trigger and no review workflow if: at all). The PR is safe to merge as-is and the two fixes can be applied as a follow-up commit.

---

· Branch

[d-morrison]

@claude please review the new commit 7fabe9c (applies both manual fixes from your previous review: drops assigned from claude.yml issues trigger types, and adds the same-repo guard to claude-code-review.yml). Anything still actionable?

[claude]

Claude finished @d-morrison's task in 44s —— View job

---

Review of commit 7fabe9c

• Read current state of workflow files
• Verify fix 1: assigned removed from claude.yml issues trigger
• Verify fix 2: same-repo guard added to claude-code-review.yml
• Check for any remaining actionable issues
• Report findings

---

7fabe9c — Assessment: ✅ Clean and correct

Both manual fixes are correctly applied.

Fix 1 — claude.yml issues trigger (claude.yml:18–24)

assigned is gone; types: [opened] is the only remaining issues trigger. The commit also adds an explanatory inline comment (lines 19–23) so future editors know why assigned is absent — prevents it being added back by mistake.

Fix 2 — claude-code-review.yml same-repo guard (claude-code-review.yml:25–28)

The if: now has all three guards on separate lines:

if: |
  github.event.pull_request.draft == false &&
  github.event.pull_request.user.login != 'dependabot[bot]' &&
  github.event.pull_request.head.repo.full_name == github.repository

The comment at line 22 accurately describes all three conditions. Formatting and logic are correct.

---

All items — final status

Issue	Status
Actor gate (OWNER/MEMBER/COLLABORATOR only)	✅ Fixed (07299ef)
Rscript -e * → specific safe namespaces (CI)	✅ Fixed (b961e69)
+ref force-update refspec deny list	✅ Fixed (b961e69)
quarto render/quarto check bypass in CI	✅ Fixed (130efcb)
macros/ as the only submodule in CLAUDE.md	✅ Fixed (3305641)
CLAUDE.md parenthetical CI list	✅ Fixed (bb30796)
PR body describing claude-code-review.yml changes	✅ Fixed (PR body updated)
Redundant actions: read in additional_permissions	✅ Fixed (91b2bb2)
issues.assigned checks issue author, not actor	✅ Fixed (7fabe9c)
Review workflow runs on fork PRs (secret unavailable)	✅ Fixed (7fabe9c)
:branch delete-refspec not blockable	Documented limitation (claude.yml lines 70–74); mitigated by branch protection on main

No remaining actionable items. The PR is ready to merge.

[d-morrison]

@claude please review the new commit 80f43f9 (updates the file-level header comment in claude-code-review.yml to mention the fork-PR skip — keeps the top-of-file summary aligned with the if-guard you reviewed last round). Anything still actionable?

[claude]

Claude finished @d-morrison's task in 39s —— View job

---

Review of commit 80f43f9

• Read current state of claude-code-review.yml
• Verified commit 80f43f9 changes
• Checked for any remaining actionable issues
• Report findings

---

80f43f9 — Assessment: ✅ Clean and correct

The commit does exactly what the message says. The file-level header comment at lines 6–7 now reads:

# Skips drafts, Dependabot bumps, and fork PRs (fork PRs can't read repo
# secrets). Project guidance is in CLAUDE.md.

This accurately describes all three conditions in the if: guard (lines 26–29). The brief parenthetical (fork PRs can't read repo secrets) explains why fork PRs are skipped, which is exactly what a future editor needs to know. The comment is concise and well-placed.

---

All items — final status

Issue	Status
Actor gate (OWNER/MEMBER/COLLABORATOR only)	✅ Fixed (07299ef)
Rscript -e * → specific safe namespaces (CI)	✅ Fixed (b961e69)
+ref force-update refspec deny list	✅ Fixed (b961e69)
quarto render/quarto check bypass in CI	✅ Fixed (130efcb)
macros/ as the only submodule in CLAUDE.md	✅ Fixed (3305641)
CLAUDE.md parenthetical CI list	✅ Fixed (bb30796)
PR body describing claude-code-review.yml changes	✅ Fixed (PR body updated)
Redundant actions: read in additional_permissions	✅ Fixed (91b2bb2)
issues.assigned checks issue author, not actor	✅ Fixed (7fabe9c)
Review workflow runs on fork PRs (secret unavailable)	✅ Fixed (7fabe9c)
Header comment out of sync with if: guard	✅ Fixed (80f43f9)
:branch delete-refspec not blockable	Documented limitation (claude.yml lines 70–74); mitigated by branch protection on main

No remaining actionable items. The PR is ready to merge.
· Branch

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://d-morrison.github.io/qwt/pr-preview/pr-70/
Built to branch gh-pages at 2026-05-19 10:59 PDT. Preview will be ready when the GitHub Pages deployment is complete.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.