Skip to content

Commit dd0cec3

Browse files
dsp-antclaude
andcommitted
Simplify @claude access control to check repository permissions
Check if user has at least triage rights on the repository instead of checking team membership. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
1 parent feaf370 commit dd0cec3

File tree

1 file changed

+16
-20
lines changed

1 file changed

+16
-20
lines changed

.github/workflows/claude.yml

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -25,29 +25,25 @@ jobs:
2525
id-token: write
2626
actions: read # Required for Claude to read CI results on PRs
2727
steps:
28-
- name: Check team membership
28+
- name: Check repository permissions
2929
run: |
30-
# Check if user is member of steering-committee team or any of its subteams
31-
TEAM_SLUG="steering-committee"
32-
ACTOR="${{ github.actor }}"
30+
# Check if user has at least triage rights on the repository
31+
PERMISSION=$(gh api "repos/${{ github.repository }}/collaborators/${{ github.actor }}/permission" -q '.permission' 2>/dev/null)
3332
34-
# Check direct membership in steering-committee
35-
if gh api "orgs/modelcontextprotocol/teams/${TEAM_SLUG}/memberships/${ACTOR}" 2>/dev/null | grep -q '"state": "active"'; then
36-
echo "✓ User is a direct member of $TEAM_SLUG team"
37-
exit 0
38-
fi
39-
40-
# Check membership in subteams
41-
SUBTEAMS=$(gh api "orgs/modelcontextprotocol/teams/${TEAM_SLUG}/teams" --paginate -q '.[].slug' 2>/dev/null)
42-
for subteam in $SUBTEAMS; do
43-
if gh api "orgs/modelcontextprotocol/teams/${subteam}/memberships/${ACTOR}" 2>/dev/null | grep -q '"state": "active"'; then
44-
echo "✓ User is a member of $subteam subteam"
33+
case "$PERMISSION" in
34+
admin|maintain|push|triage)
35+
echo "✓ User has $PERMISSION rights on the repository"
4536
exit 0
46-
fi
47-
done
48-
49-
echo "✗ User is not a member of $TEAM_SLUG team or any of its subteams"
50-
exit 1
37+
;;
38+
pull)
39+
echo "✗ User only has pull (read-only) rights"
40+
exit 1
41+
;;
42+
*)
43+
echo "✗ User does not have sufficient permissions"
44+
exit 1
45+
;;
46+
esac
5147
env:
5248
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5349

0 commit comments

Comments
 (0)