From c6839dcac08f9741ca5afe45f2f171e1a7fe7391 Mon Sep 17 00:00:00 2001
From: Samuel Newman <mozzius@protonmail.com>
Date: Fri, 9 Jan 2026 19:57:52 +0200
Subject: [PATCH] Require admin/write access to use Claude

---
 .github/workflows/claude.yml | 39 +++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 247217fe2d..3f2270057c 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -11,13 +11,50 @@ on:
     types: [submitted]
 
 jobs:
-  claude:
+  check-permissions:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
+    outputs:
+      has-permission: ${{ steps.check-org.outputs.result }}
+    steps:
+      - name: Check organization membership
+        id: check-org
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let username;
+            if (context.eventName === 'issue_comment' || context.eventName === 'pull_request_review_comment') {
+              username = context.payload.comment.user.login;
+            } else if (context.eventName === 'pull_request_review') {
+              username = context.payload.review.user.login;
+            } else if (context.eventName === 'issues') {
+              username = context.payload.issue.user.login;
+            }
+
+            try {
+              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: username
+              });
+
+              const hasAccess = ['admin', 'write'].includes(perm.permission);
+              console.log(`User ${username} has ${perm.permission} access`);
+
+              return hasAccess;
+            } catch(error) {
+              console.log(`User ${username} has no repository access`);
+              return false;
+            }
+
+  claude:
+    needs: [check-permissions]
+    if: needs.check-permissions.outputs.has-permission == 'true'
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: read