fixup claude permissions (#2652)

Author: nedtwigg

.github/workflows/claude.yml

@@ -5,74 +5,62 @@ on:
     types: [created]
   pull_request_review_comment:
     types: [created]
-  issues:
-    types: [opened, assigned]
   pull_request_review:
     types: [submitted]
+  issues:
+    types: [opened, assigned]
 
 jobs:
-  check-team-membership:
+  claude:
+    # Only run if @claude is mentioned in the triggering content
+    # For issues (opened/assigned), checks the issue body or title
+    # For comments/reviews, checks the comment/review body
+    if: contains(github.event.comment.body || github.event.review.body || github.event.issue.body || github.event.issue.title || '', '@claude')
     runs-on: ubuntu-latest
-    outputs:
-      is-team-member: ${{ steps.check-membership.outputs.is-member }}
+    permissions:
+      contents: read
+      pull-requests: read
+      issues: read
+      id-token: write
     steps:
       - name: Check team membership
         id: check-membership
         uses: actions/github-script@v8
         with:
           script: |
             try {
-              // Get username - prioritize sender (the person who triggered the event)
-              const username = github.event?.sender?.login ||
-                              github.event?.comment?.user?.login;
-
+              // Get the user who triggered the event
+              const username = context.payload.sender?.login;
+              
               if (!username) {
-                console.log('Could not determine username from event payload');
-                console.log(`Event type: ${github.event_name}`);
-                console.log(`Event payload keys: ${Object.keys(github.event).join(', ')}`);
-                return false;
+                core.setFailed('Could not determine username from event');
+                return;
               }
-
-              console.log(`Checking team membership for user: ${username} (triggered by ${github.event_name} event)`);
-
+              
+              console.log(`Checking if ${username} is a member of diffplug/spotless`);
+              
               const { data } = await github.rest.teams.getMembershipForUserInOrg({
                 org: 'diffplug',
                 team_slug: 'spotless',
                 username: username
               });
-              console.log(`User ${username} membership status: ${data.state}`);
-              return data.state === 'active';
+              
+              if (data.state !== 'active') {
+                core.setFailed(`User ${username} is not an active team member`);
+              } else {
+                console.log(`✓ ${username} is an active team member`);
+              }
             } catch (error) {
-              const username = github.event.sender?.login || github.event.comment?.user?.login || 'unknown user';
-              console.log(`User ${username} is not a member of the Spotless team or error occurred: ${error.message}`);
-              return false;
+              // User is not a team member or API error
+              core.setFailed(`Access denied: ${error.message}`);
             }
 
-  claude:
-    needs: check-team-membership
-    if: |
-      needs.check-team-membership.outputs.is-team-member == 'true' &&
-      (
-        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-        (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-        (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
-      )
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: read
-      issues: read
-      id-token: write
-    steps:
       - name: Checkout repository
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
 
       - name: Run Claude Code
-        id: claude
         uses: anthropics/claude-code-action@beta
         with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}