Stop checking out the fork PR head in claude-code-review.yml

[jnasbyupgrade]

actions/checkout refuses to check out a fork PR's head under pull_request_target by default (a hard-coded safety refusal added in a patch-level actions/checkout@v4 release), so review never actually ran against a genuine fork-originated PR — only against same-repo/upstream-branch PRs, which don't hit this check. The fix is not to opt back in via allow-unsafe-pr-checkout: true: claude-code-action already fetches and reads the PR's real content itself, internally, via the base repo's own refs/pull//head, so there's no reason for this job to put the fork's files in the workspace at all. The checkout step now fetches the base ref only, matching claude-code-action's own documented recommended pattern.

Note: pull_request_target always runs the workflow file from the base branch, so this PR's own claude-review check will still run the OLD broken workflow and fail the same way — that's expected, not a sign the fix doesn't work. Verification happens on a subsequent PR, after this merges to master.

[coderabbitai]

📝 Walkthrough

Walkthrough

The workflow documentation now states that pull_request_target checks out only the base branch. Claude reads pull request contents independently. The checkout step no longer overrides the repository and commit with PR head values. It checks out the base ref.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks the base branch bright,
While Claude reads the diff in flight.
No head code hops into the burrow,
The workflow stays clear and thorough.
“Safe reviews!” the rabbit sings.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main workflow change: stopping checkout of fork pull request heads.
Description check	✅ Passed	The description accurately explains the checkout failure, the safety rationale, the workflow change, and the expected verification process.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jnasbyupgrade]

@claude pls review

[claude]

Claude finished @jnasbyupgrade's task in 2m 7s —— View job

---

Review of PR #53

• Read the diff and full workflow file
• Verify the checkout/permissions mechanics (no network access available to fetch claude-code-action's docs, so this is based on GitHub Actions' documented pull_request_target semantics)
• Check gating logic, permissions, and security comment consistency
• Post review feedback

Verdict: looks correct, sound security improvement, no blocking issues.

What changed: .github/workflows/claude-code-review.yml drops the repository:/ref: override on the actions/checkout step, so it now checks out whatever actions/checkout@v4 defaults to under pull_request_target — which is the base branch tip, not the PR head. That's the correct default: for pull_request_target, GITHUB_REF/github.sha refer to the base branch, since the workflow runs in the base repo's context. So "Check out base ref" (the new step name) accurately describes the new behavior, and this isn't a functional regression for anything currently in the job — nothing else in claude-review (the CI-wait gate, the review action itself) reads local PR-head files; the gate step only calls gh api.

Security reasoning holds up:

• refs/pull/<n>/head is auto-created by GitHub in the base repo for every PR (fork or not) and is fetchable with plain contents: read — which this job already has (line 44). So claude-code-action fetching the PR's real content internally via that ref, as the PR description claims, is plausible and doesn't require any permission this workflow doesn't already grant.
• Not checking out the fork's arbitrary head content into a pull_request_target workspace (which carries write-capable secrets) is the standard "don't pwn-request yourself" mitigation — removing that checkout is strictly safer than before, even setting aside the actions/checkout refusal claim.
• persist-credentials: false and fetch-depth: 1 are correctly retained on the now-simplified step.

One thing I couldn't independently verify: the specific claim that actions/checkout@v4 hard-refuses cross-repo fork checkouts under pull_request_target as of some patch release. I don't have web access in this session to check the changelog/issue for it. It doesn't matter for correctness of this fix either way — removing the unnecessary fork checkout is the right move regardless of whether the old step was erroring or silently succeeding — but if you have the specific actions/checkout release/issue link handy, it'd be worth a one-line citation in the comment for future readers.

Expected self-failure note: the PR body's explanation that this PR's own claude-review check will still run the old broken workflow (since pull_request_target always loads the workflow from master) and that real verification happens on a follow-up PR is correct and exactly the right way to reason about testing a pull_request_target workflow change.

No changes requested.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/claude-code-review.yml:
- Around line 91-94: Update the actions/checkout reference in the
pull_request_target workflow to a verified full-length commit SHA instead of the
mutable v4 tag, and retain the existing security comment while documenting the
pinned version if appropriate. Ensure future SHA updates can be managed by
Dependabot or Renovate.
- Around line 89-97: Update the workflow’s Claude action reference from the
mutable anthropics/claude-code-action@v1 tag to a known-good immutable commit
SHA, while preserving the existing action configuration and checkout behavior.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c0047cf0-53ce-4f0b-9026-66c661e2a480

📥 Commits

Reviewing files that changed from the base of the PR and between a33f653 and 9df5b8d.

📒 Files selected for processing (1)

• .github/workflows/claude-code-review.yml