ci: workflows: claude-pr-review: Ignore outside collaborators for now

[patrickelectric]

In the next PR I should add the ability of maintainers to trigger the review manually via slash commands.

Summary by Sourcery

CI:

• Tighten the Claude PR review GitHub Actions workflow condition to exclude PRs from outside collaborators without write access.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[github-actions]

Automated PR Review

0. Summary

• Verdict: MINOR SUGGESTIONS ✏️

Tightens the if: condition on the Claude PR review workflow so the job only runs for PR authors with author_association of OWNER, MEMBER, or COLLABORATOR. This cleanly skips (neutral) the review for outside contributors instead of letting claude-code-action's actor-permission check hard-fail the run.

1. Correctness & Implementation Bugs

• 1.1 [minor] .github/workflows/claude-pr-review.yml:18-25 — the gate is correct for the stated intent, but worth being aware of two edge cases:
  • CONTRIBUTOR (past contributors without write access) and MANNEQUIN will also be silently skipped. If the repo ever wants to re-include those, this list will need revisiting.
  • This filter does not depend on pull_request_target-specific behavior; author_association is computed by GitHub from the trusted side, so the gate cannot be spoofed from the fork. Good.

8. Documentation

• 8.1 [nit] PR title and body both contain colaborators — should be collaborators (two ls). Worth fixing before merge so the squashed commit subject doesn't carry the typo into git log.
• 8.2 [nit] .github/workflows/claude-pr-review.yml:16-19 — the inline comment is good (explains the why: hard-fail vs. neutral skip). Consider a brief follow-up note pointing at the planned slash-command override mentioned in the PR body, so the next maintainer knows the current gate is the interim policy and not the end state.

Generated by PR Review Bot. This is advisory, a human reviewer must still approve.