CI: Claude review, trigger logic [skip ci] (#8923)

Author: danmar

.github/workflows/claude-review.yml

@@ -1,13 +1,29 @@
 # Automated code review of pull requests using Claude
+#
+# - PRs opened by members/owners/collaborators are reviewed automatically.
+# - For other PRs a member/owner/collaborator can request a review by writing
+#   a PR comment containing "@claude review".
+#
+# pull_request_target and issue_comment run the workflow file from the base
+# branch with access to secrets. The PR code is never checked out or executed.
 name: claude-review
 
 on:
-  pull_request:
+  pull_request_target:
     types: [opened, synchronize, ready_for_review, reopened]
+  issue_comment:
+    types: [created]
 
 jobs:
   review:
-    if: github.event.pull_request.draft == false && github.event.pull_request.head.repo.full_name == github.repository
+    if: |
+      (github.event_name == 'pull_request_target' &&
+       github.event.pull_request.draft == false &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.pull_request.author_association)) ||
+      (github.event_name == 'issue_comment' &&
+       github.event.issue.pull_request &&
+       contains(github.event.comment.body, '@claude review') &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
 
     runs-on: ubuntu-24.04
 
@@ -17,6 +33,7 @@ jobs:
       id-token: write
 
     steps:
+    # checks out the base branch, not the PR head
     - uses: actions/checkout@v7
       with:
         fetch-depth: 1
@@ -27,7 +44,7 @@ jobs:
         anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
         prompt: |
           REPO: ${{ github.repository }}
-          PR NUMBER: ${{ github.event.pull_request.number }}
+          PR NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
 
           Review this pull request. Focus on correctness bugs, potential
           false positives/false negatives in checkers, performance problems