[Antawari]

Why

.github/workflows/claude.yml ran an AI agent whose instructions were the body of an issue or comment. Its if: let only OWNER/MEMBER/COLLABORATOR accounts trigger it. But once a trusted account wrote @claude on someone else's issue or pull request, the agent read that outsider's text while holding id-token: write, which is exchanged for an app token that can write to the repository. A crafted issue body could therefore steer a write-capable agent. The workflow has not run in months (its recent runs were all skipped), so it is removed rather than narrowed. A narrowed bot would still hold write tools. Git history keeps the file.

What changed

• Deleted .github/workflows/claude.yml.
• tests/integration/test_claude_workflow_author_guard.py now pins the new state instead of the old per-trigger guard:
  • It scans every file in .github/workflows/ (count reported in the failure message).
  • No workflow with an anthropics/claude-code-action step may declare issue_comment, issues, pull_request_review, pull_request_review_comment, discussion or discussion_comment.
  • claude.yml must stay absent.
  • Two in-test controls prove the checker can fail: a comment-triggered sample is flagged, and a pull-request-only sample passes.
  • claude-code-review.yml (pull_request only) is detected as an agent workflow and passes.

Evidence

• Red first. The rewritten test ran against the tree with claude.yml still present: 2 driving tests failed ("checked 6 workflow file(s); 1 run the Claude agent on triggers whose body an outsider writes: claude.yml: issue_comment, issues, pull_request_review, pull_request_review_comment"), and the 4 control/pin tests passed. Then the file was deleted.
• After the deletion: that test file 6/6; full suite pytest tests/ -x: 5862 passed, 4 skipped, 37 xfailed, 20 xpassed. ruff check and ruff format --check are clean on the changed file.

Not in this PR

• claude-code-review.yml (pull-request review bot) is unchanged; reviewing its scope is separate follow-up work.
• Repository settings, such as protection rules on the pypi environment and tag protection for v* (which release.yml publishes on), are owner decisions and are not changed here.

🤖 Generated with Claude Code