Enable automatic workflow approval for Liatrio Labs organization members #22
Conversation
This commit updates the Claude Code and OpenCode GPT-5 Codex workflows to automatically allow workflow execution for members of the liatrio-labs GitHub organization without requiring manual approval. Changes: - Added check-org-membership job to both workflows - Checks author_association first (OWNER, MEMBER, COLLABORATOR) - Falls back to checking liatrio-labs organization membership via GitHub API - Main workflow jobs now depend on authorization check passing This ensures that: 1. Existing collaborators continue to work without changes 2. Any member of liatrio-labs organization can trigger workflows 3. Non-members and non-collaborators are still blocked 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
WalkthroughExtracted inline authorization checks into a reusable Changes
Sequence Diagram(s)sequenceDiagram
participant Event as GitHub Event
participant Action as check-org-membership (composite)
participant Job as claude / opencode
Event->>Action: workflow triggered (event payload + inputs)
rect rgb(230,245,255)
Action->>Action: derive AUTHOR_ASSOC from EVENT_NAME
Action->>Action: if AUTHOR_ASSOC in (OWNER,MEMBER,COLLABORATOR) -> set is-authorized=true
end
alt AUTHOR_ASSOC not sufficient
rect rgb(255,245,230)
Action->>Action: call gh api orgs/$ORGANIZATION/members/$ACTOR
Action->>Action: set is-authorized based on API result
end
end
Action-->>Job: outputs.is-authorized
alt is-authorized == 'true'
Job->>Job: run job steps (checkout, run action)
else
Job--x Job: job skipped (gated)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.github/workflows/claude.yml (1)
14-69: Duplicated authorization logic across workflows.The
check-org-membershipjob in this file is identical to the one in.github/workflows/opencode-gpt-5-codex.yml, differing only in the trigger command (@claudevs/oc-codex). This duplication should be consolidated into a reusable action per the refactor suggestion in the opencode workflow review.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude.yml(1 hunks).github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/claude.yml (1)
71-73: Job dependency and authorization gating are correctly implemented.The claude job properly depends on
check-org-membershipand gates execution with theis-authorizedoutput. The conditional at line 73 will correctly skip the job if authorization fails.
This addresses the CodeRabbit review feedback regarding GITHUB_TOKEN permissions. The default GITHUB_TOKEN does not have org-level "Members" read permission required to query organization membership. Changes: - Updated both workflows to use ORG_MEMBER_CHECK_TOKEN secret - This token must be a PAT or GitHub App token with read:org scope Setup Required: A repository administrator must create and add the ORG_MEMBER_CHECK_TOKEN secret with appropriate permissions. See PR description for instructions. Fixes: Critical permission issue identified in CodeRabbit review 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.github/workflows/opencode-gpt-5-codex.yml (1)
14-69: Add explicit permissions block tocheck-org-membershipjob.Same as
claude.yml: the job lacks an explicit permissions block. Add minimal permissions for consistency and auditability.check-org-membership: runs-on: ubuntu-latest + permissions: + contents: read if: |
🧹 Nitpick comments (1)
.github/workflows/claude.yml (1)
14-70: Add explicit permissions block tocheck-org-membershipjob.The
check-org-membershipjob lacks an explicit permissions block. While the job relies onsecrets.ORG_MEMBER_CHECK_TOKENfor the API call, it's a security best practice to declare minimal permissions explicitly, even if they're not used by the job itself.check-org-membership: runs-on: ubuntu-latest + permissions: + contents: read if: |This ensures the job's token scope is clearly auditable and adheres to the principle of least privilege.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/claude.yml(1 hunks).github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🔇 Additional comments (1)
.github/workflows/claude.yml (1)
38-69: I need to verify the technical claims in the review comment about GitHub Actions tokens and organization membership checks.Now let me search for more details on the specific GitHub API endpoint for organization membership to understand the exact requirements:
Critical: Verify
ORG_MEMBER_CHECK_TOKENis properly scoped and the authorization check is functioning correctly.GITHUB_TOKEN cannot be given organization-scoped permissions, and the code correctly uses a custom secret
ORG_MEMBER_CHECK_TOKENinstead. However, the API endpoint requires a fine-grained token with "Members" organization permissions (read) to verify both public and private organization membership.The security concern is valid: GH_TOKEN and GITHUB_TOKEN (in order of precedence) are authentication tokens, so the token's permissions determine success or failure. If
ORG_MEMBER_CHECK_TOKENis misconfigured or missing, the silent error suppression (--silent 2>/dev/null) will mask the failure, causing the job to setauthorized=falsefor all non-author-association-privileged users.To verify and fix:
- Confirm that
secrets.ORG_MEMBER_CHECK_TOKENexists in repository/organization settings with a PAT or GitHub App token granting "Members" read access to liatrio-labs.- Test with an organization member to ensure they can trigger the workflow; check Actions logs for the authorization step.
- Consider removing
2>/dev/nulltemporarily to surface any permission errors during testing.- Add explicit logging when the API call fails to help debug authorization issues.
This addresses the CodeRabbit refactoring suggestion to eliminate duplicated authorization logic across workflows. Changes: - Created .github/actions/check-org-membership composite action - Extracted 45+ lines of duplicated bash logic into single reusable action - Action accepts trigger-command as input parameter - Both workflows now use the same authorization logic - Reduced maintenance burden and ensured consistency Benefits: - Single source of truth for authorization logic - DRY principle compliance - Future updates apply consistently across all workflows - Easier to test and maintain The composite action: - Checks author_association first (OWNER, MEMBER, COLLABORATOR) - Falls back to organization membership verification - Returns is-authorized boolean output - Supports all event types (issue_comment, pull_request_review, etc.) Addresses: CodeRabbit refactoring suggestion 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (1)
.github/workflows/opencode-gpt-5-codex.yml (1)
14-57: Add explicit permissions block to check-org-membership job.The job lacks an explicit permissions block, which defaults to broad GITHUB_TOKEN permissions. Since this job only checks out the repository to access the composite action, it needs minimal permissions.
check-org-membership: runs-on: ubuntu-latest + permissions: + contents: read if: |
🧹 Nitpick comments (1)
.github/actions/check-org-membership/action.yml (1)
1-98: Document required token scope in action description and repository setup instructions.The action requires
secrets.ORG_MEMBER_CHECK_TOKENto have organization membership read permissions, but this requirement is not clearly communicated. If the token lacks the "Members" read permission, all org member checks silently fail.Add an input description clarification or include setup documentation linking to the secret configuration requirements. For example:
github-token: description: 'GitHub token with org membership read permissions' + description: | + GitHub token with organization membership read permissions. + Required scopes: read:org_members or admin:org. + See: https://docs.github.com/en/rest/orgs/members required: trueAdditionally, would you like me to generate a documented setup guide (e.g.,
.github/WORKFLOWS_SETUP.md) that explains how to configureORG_MEMBER_CHECK_TOKENwith the correct permissions?
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/actions/check-org-membership/action.yml(1 hunks).github/workflows/claude.yml(1 hunks).github/workflows/opencode-gpt-5-codex.yml(1 hunks)
🧰 Additional context used
🪛 GitHub Check: CodeQL
.github/workflows/claude.yml
[warning] 16-58: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
.github/workflows/opencode-gpt-5-codex.yml
[warning] 16-58: Workflow does not contain permissions
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {{contents: read}}
🔇 Additional comments (3)
.github/workflows/opencode-gpt-5-codex.yml (1)
58-79: Authorization gating and permissions look good.The
opencodejob properly depends oncheck-org-membershipand executes only when authorized. The permissions block correctly includescontents: readandid-token: writefor the workflow's functionality..github/workflows/claude.yml (1)
58-94: Authorization gating and permissions look good.The
claudejob properly depends oncheck-org-membershipand executes only when authorized. The permissions block is comprehensive and appropriate for the Claude Code action's requirements..github/actions/check-org-membership/action.yml (1)
75-89: Event type dispatch and early authorization checks look sound.The logic correctly maps each event type to its corresponding author association field (comment, review, or issue) and efficiently authorizes known-good users (OWNER, MEMBER, COLLABORATOR) without unnecessary API calls.
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Added minimal 'contents: read' permission to check-org-membership jobs in both claude.yml and opencode-gpt-5-codex.yml workflows. This follows security best practices by explicitly limiting GITHUB_TOKEN permissions instead of relying on broad defaults, adhering to the principle of least privilege. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
|
@ryderstorm here is another one to review please - I noticed that the workflows on Grants contribution needed to be manually approved and its because the previous workflow was only working automatically if a person was added individually to the repo with specific permissions. This PR is an attempt to make these permissions broader so that any member of the Liatrio Labs organization will be able to use the |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/actions/check-org-membership/action.yml (2)
5-7: Remove unusedtrigger-commandinput.The input is defined and set as an environment variable but never used in the authorization script. This was likely carried over from earlier design but should be removed to avoid confusion.
Apply this diff:
inputs: trigger-command: - description: 'The trigger command to check for (e.g., @claude or /oc-codex)' - required: true github-token: description: 'GitHub token with org membership read permissions' required: trueAnd remove the unused environment variable:
env: GH_TOKEN: ${{ inputs.github-token }} - TRIGGER_COMMAND: ${{ inputs.trigger-command }} EVENT_NAME: ${{ inputs.event-name }}Also applies to: 63-63
91-97: Add error logging for organization membership API failures.When the
gh apicall fails at line 92, the error output flows to the workflow logs (good—this addresses the prior error suppression issue). However, for better debugging when the token lacks proper permissions or the API endpoint is inaccessible, consider capturing and logging the error message.Apply this diff to capture and log the error:
# Check if user is a member of the organization - if gh api "orgs/$ORGANIZATION/members/$ACTOR"; then + if gh api "orgs/$ORGANIZATION/members/$ACTOR" >/dev/null 2>&1; then echo "User is authorized as $ORGANIZATION organization member" echo "authorized=true" >> "$GITHUB_OUTPUT" else + echo "Organization membership check failed for user $ACTOR in $ORGANIZATION" >&2 echo "User is not authorized" echo "authorized=false" >> "$GITHUB_OUTPUT" fiThis preserves the existing behavior (denying on API failure) while making it clear why authorization was denied when troubleshooting token or permission issues.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/actions/check-org-membership/action.yml(1 hunks).github/workflows/claude.yml(1 hunks).github/workflows/opencode-gpt-5-codex.yml(1 hunks)
Summary
This PR updates the Claude Code and OpenCode GPT-5 Codex workflows to automatically allow workflow execution for members of the liatrio-labs GitHub organization without requiring manual approval.
Changes
check-org-membershipjob to both workflowsauthor_associationfirst (OWNER, MEMBER, COLLABORATOR)Benefits
✅ Existing collaborators continue to work without changes
✅ Any member of liatrio-labs organization can trigger workflows automatically
✅ Non-members and non-collaborators are still blocked
✅ No manual approval required for organization members
Implementation Details
The new
check-org-membershipjob:@claudeor/oc-codex)author_associationfrom the eventliatrio-labsorg usinggh api "orgs/liatrio-labs/members/$ACTOR"is-authorizedthat the main job depends onTesting
To test this PR:
@claudeor/oc-codexon an issue or PRFiles Changed
.github/workflows/claude.yml.github/workflows/opencode-gpt-5-codex.yml🤖 Generated with Claude Code
Summary by CodeRabbit