ci(claude-review): skip automatic review on fork PRs

[ajitpratap0]

Summary

The Claude Code Review check fails on every PR opened from a fork (#525, #527, #529, #532–#535). Fork PRs get a read-only GITHUB_TOKEN and no repository secrets (the logs show claude_code_oauth_token is empty), so the action fails with 403 Resource not accessible by integration when it posts its first comment.

This adds a job-level if so the review runs only for same-repo PRs and workflow_dispatch. Fork PRs now show the check as skipped rather than failed. Maintainers can still ask for a review on a fork PR by commenting @claude (handled by claude.yml, which runs on the base repo).

I didn't use pull_request_target, because it would expose secrets and a write token to untrusted fork code and prompts.

The other failure, same-repo PRs getting 404 from the retired claude-sonnet-4-20250514, was already fixed by #536.

Test Plan

• Workflow YAML parses; the if expression is a valid job condition
• This PR (same-repo) still runs the review
• The next fork PR shows Claude Code Review as skipped

Breaking Changes

None. Fork PRs no longer get an automatic Claude review comment, but they weren't getting one before either.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VCRwrpJY25CRtyTcu6aD8V

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gosqlx-website	Ready	Preview	Oct 10, 2026 5:38pm UTC

[github-actions]

Claude finished @ajitpratap0's task —— View job

---

PR Review: skip automatic Claude review on fork PRs

• Read workflow file and diff
• Check related workflow (claude.yml)
• Post review

Verdict: LGTM. The fix is small, correct, and safe. I have one suggestion (Dependabot) and a few nits, none of which block the merge.

---

What it does

.github/workflows/claude-code-review.yml:13 adds a job-level condition:

if: github.event_name == 'workflow_dispatch' || github.event.pull_request.head.repo.full_name == github.repository

Fork PRs now show the check as skipped instead of failed.

Correctness

• Fork detection is sound. If the fork was deleted, head.repo is null. The comparison then evaluates to false and the job is skipped, which is the safe outcome. GitHub's == on strings is case-insensitive, so repo-name casing isn't a problem.
• Skipped counts as passing. A skipped job satisfies a required status check, so fork PRs won't be blocked from merging. If Claude Code Review is a required check, it's worth confirming this once on the next fork PR (your second unchecked test-plan item).
• workflow_dispatch is kept. It has no pull_request context, so the second clause is never evaluated for it.

Security

• Not using pull_request_target is the right call. It would hand secrets and a write token to untrusted fork code and prompt content.
• The @claude fallback in claude.yml runs from the base repo context. The action checks that the commenter has write access, so maintainers can still request a review on a fork PR.

Suggestions

1. Dependabot PRs will probably still fail. They come from branches in this repo, so the new condition passes, but Dependabot-triggered runs get a read-only token and can't read normal Actions secrets (CLAUDE_CODE_OAUTH_TOKEN is empty). That's the same failure mode this PR fixes. .github/dependabot.yml exists, so this is likely to hit. A possible tweak:

   if: |
     github.event_name == 'workflow_dispatch' ||
     (github.event.pull_request.head.repo.full_name == github.repository &&
      github.actor != 'dependabot[bot]')

   You could also add the secret under Dependabot secrets. I haven't confirmed that Dependabot PRs fail today, so check a recent one first.

Nits (non-blocking)

• Stale commented-out example (lines 68–71). The "Optional: Skip review for certain conditions" block still shows an if: as a step-level input. It's now a bit redundant next to the real job-level if, so consider deleting it.
• anthropics/claude-code-action@beta is unpinned (here and in claude.yml). The repo already runs OpenSSF Scorecard, which flags this. Pinning to a commit SHA is a worthwhile follow-up, and the fix doesn't depend on it.
• Trailing whitespace on line 21. It was already there; ignore it unless you're touching the file anyway.
• workflow_dispatch may not work with the direct_prompt review flow. The beta action expects a PR or issue context, so a manual run may not do anything useful. That was true before this PR.

Test coverage

It's a CI-only change, so there are no Go tests to add. The first unchecked item (same-repo PR still runs the review) is demonstrated by this PR's own review run. The second needs the next fork PR.

--- | Branch: ci/claude-review-skip-forks