basic-memory/.github/workflows/claude.yml at 01ece8e5cfcf5d821348d61edc2eb82639d0db57 · basicmachines-co/basic-memory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
name: Claude Code

on:
  issue_comment:
    types: [created]
  pull_request_review_comment:
    types: [created]
  issues:
    types: [opened, assigned]
  pull_request_review:
    types: [submitted]

jobs:
  claude:
    if: |
      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write
    steps:
      - name: Check user permissions
        id: check_membership
        uses: actions/github-script@v7
        with:
          script: |
            let actor;
            if (context.eventName === 'issue_comment') {
              actor = context.payload.comment.user.login;
            } else if (context.eventName === 'pull_request_review_comment') {
              actor = context.payload.comment.user.login;
            } else if (context.eventName === 'pull_request_review') {
              actor = context.payload.review.user.login;
            } else if (context.eventName === 'issues') {
              actor = context.payload.issue.user.login;
            }

            console.log(`Checking permissions for user: ${actor}`);

            // List of explicitly allowed users (organization members)
            const allowedUsers = [
              'phernandez',
              'groksrc',
              'nellins',
              'bm-claudeai'
            ];

            if (allowedUsers.includes(actor)) {
              console.log(`User ${actor} is in the allowed list`);
              core.setOutput('is_member', true);
              return;
            }

            // Fallback: Check if user has repository permissions
            try {
              const collaboration = await github.rest.repos.getCollaboratorPermissionLevel({
                owner: context.repo.owner,
                repo: context.repo.repo,
                username: actor
              });

              const permission = collaboration.data.permission;
              console.log(`User ${actor} has permission level: ${permission}`);

              // Allow if user has push access or higher (write, maintain, admin)
              const allowed = ['write', 'maintain', 'admin'].includes(permission);

              core.setOutput('is_member', allowed);

              if (!allowed) {
                core.notice(`User ${actor} does not have sufficient repository permissions (has: ${permission})`);
              }
            } catch (error) {
              console.log(`Error checking permissions: ${error.message}`);

              // Final fallback: Check if user is a public member of the organization
              try {
                const membership = await github.rest.orgs.getMembershipForUser({
                  org: 'basicmachines-co',
                  username: actor
                });

                const allowed = membership.data.state === 'active';
                core.setOutput('is_member', allowed);

                if (!allowed) {
                  core.notice(`User ${actor} is not a public member of basicmachines-co organization`);
                }
              } catch (membershipError) {
                console.log(`Error checking organization membership: ${membershipError.message}`);
                core.setOutput('is_member', false);
                core.notice(`User ${actor} does not have access to this repository`);
              }
            }

      - name: Checkout repository
        if: steps.check_membership.outputs.is_member == 'true'
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Claude Code
        if: steps.check_membership.outputs.is_member == 'true'
        id: claude
        uses: anthropics/claude-code-action@beta
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          allowed_tools: Bash(uv run pytest),Bash(uv run ruff check . --fix),Bash(uv run ruff format .),Bash(uv run pyright),Bash(just test),Bash(just lint),Bash(just format),Bash(just type-check),Bash(just check),Read,Write,Edit,MultiEdit,Glob,Grep,LS, mcp__web_search