fix: improve shell safety and variable handling in claude-reviews gating

Author: AshishKumar4

.github/workflows/claude-reviews.yml

@@ -41,21 +41,24 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           EVENT_NAME: ${{ github.event_name }}
           ACTOR: ${{ github.actor }}
+          REPO: ${{ github.repository }}
           PR_NUMBER: ${{ env.PR_NUMBER }}
           COMMENT_BODY: ${{ github.event.comment.body }}
           PR_TITLE: ${{ github.event.pull_request && github.event.pull_request.title || '' }}
           PR_AUTHOR: ${{ github.event.pull_request && github.event.pull_request.user && github.event.pull_request.user.login || '' }}
           PR_HEAD_REPO: ${{ github.event.pull_request && github.event.pull_request.head && github.event.pull_request.head.repo && github.event.pull_request.head.repo.full_name || '' }}
+          PR_HEAD_REF: ${{ github.event.pull_request && github.event.pull_request.head && github.event.pull_request.head.ref || '' }}
+          PR_BASE_REF: ${{ github.event.pull_request && github.event.pull_request.base && github.event.pull_request.base.ref || '' }}
         run: |
-          set -e
+          set -euo pipefail
 
           # Default: proceed for pull_request events; gate comment-driven runs.
           PROCEED="true"
 
           if [ "$EVENT_NAME" = "issue_comment" ] || [ "$EVENT_NAME" = "pull_request_review_comment" ]; then
-            PERM=$(gh api "repos/${{ github.repository }}/collaborators/$ACTOR/permission" --jq .permission 2>/dev/null || echo "none")
+            PERM=$(gh api "repos/$REPO/collaborators/$ACTOR/permission" --jq .permission 2>/dev/null || echo "none")
             case "$PERM" in
-              admin|maintain|write) ;; 
+              admin|maintain|write) ;;
               *)
                 echo "Non-collaborator trigger ($PERM); skipping."
                 PROCEED="false"
@@ -64,22 +67,21 @@ jobs:
           fi
 
           # Fetch PR metadata for fork/release/dependabot gating.
-         
+          TITLE=""
           AUTHOR=""
           HEAD_REPO=""
           HEAD_REF=""
           BASE_REF=""
 
-
           if [ "$EVENT_NAME" = "pull_request" ]; then
-           
+            TITLE="$PR_TITLE"
             AUTHOR="$PR_AUTHOR"
             HEAD_REPO="$PR_HEAD_REPO"
-            HEAD_REF="${{ github.event.pull_request.head.ref }}"
-            BASE_REF="${{ github.event.pull_request.base.ref }}"
+            HEAD_REF="$PR_HEAD_REF"
+            BASE_REF="$PR_BASE_REF"
           else
-            PR_JSON=$(gh pr view "$PR_NUMBER" --repo "${{ github.repository }}" --json title,author,headRepository,headRepositoryOwner,headRefName,baseRefName)
-            '%s' "$PR_JSON" | jq -r '.title // ""')
+            PR_JSON=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json title,author,headRepository,headRepositoryOwner,headRefName,baseRefName)
+            TITLE=$(printf '%s' "$PR_JSON" | jq -r '.title // ""')
             AUTHOR=$(printf '%s' "$PR_JSON" | jq -r '.author.login // ""')
             HEAD_REF=$(printf '%s' "$PR_JSON" | jq -r '.headRefName // ""')
             BASE_REF=$(printf '%s' "$PR_JSON" | jq -r '.baseRefName // ""')
@@ -88,7 +90,6 @@ jobs:
             HEAD_REPO=$(printf '%s' "$PR_JSON" | jq -r 'if .headRepository and .headRepository.full_name then .headRepository.full_name elif .headRepositoryOwner and .headRepository and .headRepository.name then (.headRepositoryOwner.login + "/" + .headRepository.name) else "" end')
           fi
 
-
           if [ -z "$HEAD_REPO" ]; then
             echo "Could not determine head repo; skipping to protect secrets."
             PROCEED="false"
@@ -104,18 +105,16 @@ jobs:
           fi
 
           # Heuristic: release-please branches commonly include "release-please".
-          if [ -n "$HEAD_REF" ] && echo "$HEAD_REF" | grep -qi "release-please"; then
+          if [ -n "$HEAD_REF" ] && printf '%s' "$HEAD_REF" | grep -qi "release-please"; then
             PROCEED="false"
           fi
 
-          if [ "$HEAD_REPO" != "${{ github.repository }}" ]; then
+          if [ "$HEAD_REPO" != "$REPO" ]; then
             echo "Fork PR detected ($HEAD_REPO); skipping to protect secrets."
             PROCEED="false"
           fi
 
-          # Debug: print gating context
           echo "Gate context: author=$AUTHOR head_ref=$HEAD_REF base_ref=$BASE_REF head_repo=$HEAD_REPO"
-
           echo "proceed=$PROCEED" >> "$GITHUB_OUTPUT"
 
       - name: Cleanup previous Claude workflow comments