Repository navigation
ci: delete claude.yml (third-party action fork holding our OAuth token) - #267
Conversation
The workflow ran keithah/claude-code-action@fork-pr-support, a third-party fork pinned to a mutable branch (last commit 2025-10-10), and passed it CLAUDE_CODE_OAUTH_TOKEN with id-token: write. allowed_non_write_users: "*" let anyone trigger it with an @claude comment. The upstream fix it waited for (anthropics/claude-code-action#614) is still unmerged. It is unused: all 17 runs in the last two weeks were skipped. Closes V2-1810 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MaidSafe-Hermes
left a comment
MaidSafe-Hermes
left a comment
There was a problem hiding this comment.
APPROVE — 2/2 seats reviewed (sol-1 gpt-6.1-sol xhigh; glm-1 z-ai/glm-5.3); both seats agree (two model families).
The frozen diff deletes only .github/workflows/claude.yml; it removes the third-party fork action, OAuth token use, id-token: write, and unrestricted non-writer invocation. No concrete regression or required code follow-up is shown. Branch rules require linear-link and pr-template; both pass. The listed build, test, lint, format, docs, storage, and devnet checks pass.
Security Audit is failing and is separate from this code-review verdict; resolve it as a security/merge gate. Deleting the workflow does not delete or revoke the repository secret/token; complete the stated post-merge credential cleanup separately. Review covers head d61c5eb.
Brings in the browser listener's UPnP port mapping (WithAutonomi#264, ADR-0027), the CI concurrency and job timeouts (WithAutonomi#268) and the removal of claude.yml (WithAutonomi#267). Conflicts: the endpoint publication, where main's Publication replaces the single endpoint and the swarm's STUN server is still set beside it, and the ADR index, which lists both ADR-0026 and ADR-0027. A mapped endpoint withdrawn when its mapping ends now also clears the swarm's STUN server, so the node hosts no rooms while browsers cannot reach it, as before any endpoint is published. ADR-0026 says so, and main's two withdrawal tests check the STUN server is set on publication and gone after withdrawal.
Linear issue
Closes V2-1810
Summary
Deletes
.github/workflows/claude.yml.keithah/claude-code-action@fork-pr-support. That's a third-party fork, pinned to a mutable branch (last commit 2025-10-10). It receivedCLAUDE_CODE_OAUTH_TOKEN, and the job hadid-token: write. Whoever controls that branch can change the code that runs with our secret.allowed_non_write_users: "*"meant anyone could trigger it with an@claudecomment on an issue or PR, including fork PRs.skipped.From the ant-node CI audit (V2-1799). If we want the Claude action back later, use upstream
anthropics/claude-code-actionpinned by SHA, with write-access-only triggers.After merge (repo admin): delete the now-unused
CLAUDE_CODE_OAUTH_TOKENrepo secret, and consider revoking the token.Risk tier
Compatibility
Semver impact
Test evidence
Workflow file deletion only; no crate code changes.
git grepfinds no other reference toclaude.yml,claude-code-actionorCLAUDE_CODE_OAUTH_TOKENin the repo.New dependency
none
ADR
n/a
Mitigation / rollback
Revert this commit to restore the workflow.
🤖 Generated with Claude Code