fix(ci): secure personal claude requests on github

[alexsoyes]

🎯 What & why

Reserve @claude on GitHub issues and PRs for Alex’s personal use, with live identity checks and safeguards against fork-controlled code.

🛠️ How it works

Only GitHub account ID 8973343 (currently alexsoyes) can invoke, manually dispatch or rerun this workflow. A separate read-only job verifies that identity and current repository write access; another maintainer’s write access is insufficient. Numeric identity prevents a reused login from impersonating the owner. It explicitly checks out the default branch, validates mentions, and rejects fork PRs, closed/deleted PR sources and source branches main/next before the Claude secret is available. The official action repeats its own actor checks.

The sponsor’s existing personal subscription remains the funding source. Approved jobs run one at a time, queued with GitHub’s queue: max, with 20-turn and 30-minute limits. The effective App grant is explicit, repository-scoped and short-lived; manual smoke runs request only read permissions. Repo-defined automatic Claude hooks are disabled, comment context is restricted to the invoking actor, shell approvals are narrowed, commits are API-signed, and no ruleset bypass is granted. Direct actions and the action’s internal CLI are pinned; existing Dependabot updates remain in place.

Operations, limits, token rotation and residual prompt-injection/code-execution risks are documented in Maintainers. The normal maintainer review and CI rules remain the merge gate; auto-merge is disabled on this setup PR.

🧪 How to verify

• Pre-commit: 561 repository tests and 140 architecture tests passed, plus documentation/link checks. Twelve security tests cover live permission decisions, rerunners, bots, forks, protected sources, API failure and secret isolation.
• Live read-only GitHub authorization using the request on feat(aidd-dev): rename todo to batch and report each agent's outcome #984: allowed: true.
• Existing subscription-token inference test: CLAUDE_AUTH_OK.
• YAML validation passed. Actionlint v1.7.12 passed with only its unsupported queue schema key excluded; that property is documented by GitHub.
• Independent source/security review: no remaining concrete findings.
• GitHub CI is running on the owner-only update; local hooks and the live GitHub authorization check passed.
• After maintainer approval and merge on main, dispatch Claude Code, verify CLAUDE_GITHUB_OK, then test a disposable feature-branch change and its verified commit/CI. The full GitHub/App execution remains untested until that integration.

The challenge report distinguishes exclusive workflow invocation from secret custody and records the remaining activation gate.

⚠️ Heads-up

The default branch must contain the workflow for comment events and the official App’s workflow validation. This activation fix therefore targets main.

Only Alex can spend personal quota through this workflow. This is not exclusive custody of a repository secret: repository writers can use secrets through other workflows, and administrators can change the setup. A protected environment requiring Alex’s approval would strengthen secret-access control but add an approval for every run; it has not been imposed. Limits are per run and concurrency, not a daily quota guarantee. Fork PRs require prior human review and import to an internal feature branch. Approved pnpm checks still execute repository code; no prompt/tool policy is an absolute injection boundary.

The OAuth token created on 2026-10-13 is valid for one year and backed up outside this repository. The official action refuses force pushes and cannot amend #984’s published commit.

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.