2525 issues : read
2626 id-token : write
2727 steps :
28- - name : Check organization membership
28+ - name : Check user permissions
2929 id : check_membership
3030 uses : actions/github-script@v7
3131 with :
@@ -41,29 +41,62 @@ jobs:
4141 actor = context.payload.issue.user.login;
4242 }
4343
44- console.log(`Checking membership for user: ${actor}`);
44+ console.log(`Checking permissions for user: ${actor}`);
4545
46+ // List of explicitly allowed users (organization members)
47+ const allowedUsers = [
48+ 'phernandez',
49+ 'groksrc',
50+ 'nellins',
51+ 'bm-claudeai'
52+ ];
53+
54+ if (allowedUsers.includes(actor)) {
55+ console.log(`User ${actor} is in the allowed list`);
56+ core.setOutput('is_member', true);
57+ return;
58+ }
59+
60+ // Fallback: Check if user has repository permissions
4661 try {
47- const membership = await github.rest.orgs.getMembershipForUser({
48- org: 'basicmachines-co',
62+ const collaboration = await github.rest.repos.getCollaboratorPermissionLevel({
63+ owner: context.repo.owner,
64+ repo: context.repo.repo,
4965 username: actor
5066 });
5167
52- console.log(`Membership status: ${membership.data.state}`);
68+ const permission = collaboration.data.permission;
69+ console.log(`User ${actor} has permission level: ${permission}`);
5370
54- // Allow if user is a member (public or private) or admin
55- const allowed = membership.data.state === 'active' &&
56- (membership.data.role === 'member' || membership.data.role === 'admin');
71+ // Allow if user has push access or higher (write, maintain, admin)
72+ const allowed = ['write', 'maintain', 'admin'].includes(permission);
5773
5874 core.setOutput('is_member', allowed);
5975
6076 if (!allowed) {
61- core.notice(`User ${actor} is not a member of basicmachines-co organization `);
77+ core.notice(`User ${actor} does not have sufficient repository permissions (has: ${permission}) `);
6278 }
6379 } catch (error) {
64- console.log(`Error checking membership: ${error.message}`);
65- core.setOutput('is_member', false);
66- core.notice(`User ${actor} is not a member of basicmachines-co organization`);
80+ console.log(`Error checking permissions: ${error.message}`);
81+
82+ // Final fallback: Check if user is a public member of the organization
83+ try {
84+ const membership = await github.rest.orgs.getMembershipForUser({
85+ org: 'basicmachines-co',
86+ username: actor
87+ });
88+
89+ const allowed = membership.data.state === 'active';
90+ core.setOutput('is_member', allowed);
91+
92+ if (!allowed) {
93+ core.notice(`User ${actor} is not a public member of basicmachines-co organization`);
94+ }
95+ } catch (membershipError) {
96+ console.log(`Error checking organization membership: ${membershipError.message}`);
97+ core.setOutput('is_member', false);
98+ core.notice(`User ${actor} does not have access to this repository`);
99+ }
67100 }
68101
69102name : Checkout repository
78111 uses : anthropics/claude-code-action@beta
79112 with :
80113 anthropic_api_key : ${{ secrets.ANTHROPIC_API_KEY }}
81- allowed_tools : Bash(uv run pytest),Bash(uv run ruff check . --fix),Bash(uv run ruff format .),Bash(uv run pyright),Bash(make test),Bash(make lint),Bash(make format),Bash(make type-check),Bash(make check),Read,Write,Edit,MultiEdit,Glob,Grep,LS
114+ allowed_tools : Bash(uv run pytest),Bash(uv run ruff check . --fix),Bash(uv run ruff format .),Bash(uv run pyright),Bash(just test),Bash(just lint),Bash(just format),Bash(just type-check),Bash(just check),Read,Write,Edit,MultiEdit,Glob,Grep,LS
0 commit comments