MHSanaei de5b130095 ci(claude-bot): gate write capability to trusted actors ...

Make every automatic, untrusted trigger read-only and require an explicit trusted actor for any code change.

- handle-issue (issue opened): read-only triage; confirm bugs and tag the maintainer, never edit code or open a PR. Authenticates as GITHUB_TOKEN so replies post as github-actions[bot], not a personal account.

- handle-pr-fix (PR opened): applies fixes only for owner/member/collaborator authors; dropped allowed_non_write_users so the default write gate also applies.

- handle-pr-review (PR opened, external authors): read-only review comment only.

- mention (@claude comment): runs only for the repository owner; may open a PR from an issue or commit to a PR on explicit request.

No job authenticates as the static PAT anymore; the PAT is used only to route git pushes for the trusted PR-fix and owner-mention paths.

2026-07-09 02:18:43 +02:00

..

ISSUE_TEMPLATE

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

workflows

ci(claude-bot): gate write capability to trusted actors

2026-07-09 02:18:43 +02:00

dependabot.yml

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

FUNDING.yml

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

pull_request_template.md

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00