From 52b89ed7fdc18e0a0fdad6153a595a1cc79266f9 Mon Sep 17 00:00:00 2001 From: Jamie Nelson Date: Sun, 11 Oct 2026 11:48:26 +1100 Subject: [PATCH 1/2] fix(ci): allow Dependabot to receive automated code review --- .github/workflows/claude-code-review.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index b5e8cfd..ff33b8c 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -35,6 +35,7 @@ jobs: id: claude-review uses: anthropics/claude-code-action@v1 with: + allowed_bots: 'dependabot[bot]' claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' From d48dfbd70643a2ce0894eb579f730cc334be3673 Mon Sep 17 00:00:00 2001 From: Jamie Nelson Date: Sun, 11 Oct 2026 12:07:49 +1100 Subject: [PATCH 2/2] docs(ci): document the verified Dependabot review secret prerequisite --- .github/workflows/README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/README.md b/.github/workflows/README.md index ddef541..18438e9 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -128,3 +128,7 @@ When adding new workflows: - `action.yml` - Action definition file - `package.json` - Contains version and scripts - `.eslintrc.cjs` - ESLint configuration + +### claude-code-review.yml + +Automated review accepts human contributors and the `dependabot[bot]` actor. Dependabot-triggered runs read Dependabot secrets, so configure `CLAUDE_CODE_OAUTH_TOKEN` under repository Settings → Secrets and variables → Dependabot as well as the Actions secret used by human-triggered runs. Keep the token in GitHub's secret stores. Verify a real Dependabot-triggered review after configuration; a successful human-triggered review does not establish that the bot received credentials.