claude code only for stackone employee

[ryoppippi]

currently claude github actions runs everytime new PR and issues are created but I'd like to restrict the execution only for issues created by stackone's employees

[ryoppippi]

@claude can you modify claude.yml

[claude]

Claude finished @ryoppippi's task —— View job

---

Modifying claude.yml to restrict execution to StackOne employees

Working on restricting Claude GitHub Actions to only run for StackOne employees:

• Read and analyze current claude.yml workflow file
• Research GitHub Actions conditions for organization membership
• Modify claude.yml to restrict execution to StackOne employees only
• Test and verify the workflow modification logic
• Commit and push changes to branch
• Explain workflow permission limitation and provide manual solution

⚠️ GitHub Workflow Permission Limitation

I successfully modified the claude.yml file to restrict execution to StackOne employees only, but GitHub Apps (including Claude Code) cannot push changes to workflow files in .github/workflows/ for security reasons.

🔧 Solution: Manual Implementation Required

Here's the exact modification needed for .github/workflows/claude.yml:

Add this new step after line 26 (before "Checkout repository"):

      - name: Check if user is StackOne employee
        id: check-membership
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Get the username of the person who triggered the event
          if [[ "${{ github.event_name }}" == "issue_comment" ]]; then
            USERNAME="${{ github.event.comment.user.login }}"
          elif [[ "${{ github.event_name }}" == "pull_request_review_comment" ]]; then
            USERNAME="${{ github.event.comment.user.login }}"
          elif [[ "${{ github.event_name }}" == "pull_request_review" ]]; then
            USERNAME="${{ github.event.review.user.login }}"
          elif [[ "${{ github.event_name }}" == "issues" ]]; then
            USERNAME="${{ github.event.issue.user.login }}"
          else
            USERNAME="${{ github.actor }}"
          fi
          
          echo "Checking membership for user: $USERNAME"
          
          # Check if user is a member of StackOneHQ organization
          if gh api "orgs/StackOneHQ/members/$USERNAME" --silent; then
            echo "User $USERNAME is a StackOne employee"
            echo "is_stackone_employee=true" >> $GITHUB_OUTPUT
          else
            echo "User $USERNAME is not a StackOne employee"
            echo "is_stackone_employee=false" >> $GITHUB_OUTPUT
          fi

Then add the condition if: steps.check-membership.outputs.is_stackone_employee == 'true' to both:

• The "Checkout repository" step
• The "Run Claude Code" step

This will ensure Claude only runs for StackOneHQ organization members.