CI: harden claude-code-review.yml and claude.yml security/reliability

[jnasbyupgrade]

Summary

Split out from the advanced-testing/ci stack (PR #35) at the user's request -- this is standalone CI hardening, unrelated to that stack's actual content, and needs to land independently/faster.

claude-code-review.yml

• Trust gate now checks PR author (user.login), not head repo owner -- head.repo.owner.login is always this repo's own org for upstream-branch-headed PRs (e.g. gh stack), so it silently skipped review regardless of who opened the PR. Confirmed via the check-runs API: claude-review showed conclusion: "skipped" on a whole PR stack that was legitimately the trusted account's own work.
• Checkout step no longer overrides repository:/ref: to point at the PR's fork -- claude-code-action fetches and reviews the PR's content itself; the override was also breaking that internal fetch (couldn't find remote ref pull/<n>/head). Restored persist-credentials: false on that step (was silently dropped when the override was removed -- same permissions block grants pull-requests: write, a real write-capable credential, with nothing here that legitimately needs it in .git/config).
• --allowedTools mcp__github_inline_comment__create_inline_comment so the code-review plugin's agent-mode run actually starts the inline-comment MCP server (was silently falling back to one consolidated comment instead of real per-line inline comments).
• actions: write permission -- no narrower scope exists for cache-write alone; without it, the action's internal cache save silently fails every run (a warning, not a hard failure, so it looks fine while just being slower/uncached).

claude.yml

• actions: write (was read) for the same cache-write reason.
• actions/checkout@v4 -> @v7.

Test plan

• YAML parses cleanly for both files.
• This change only affects GitHub Actions workflow files.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1c8df9cf-11d8-4c10-819b-9a743bb46ed3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}