Require admin/write access to use Claude

.github/workflows/claude.yml

@@ -11,13 +11,50 @@ on:
     types: [submitted]
 
 jobs:
-  claude:
+  check-permissions:
     if: |
       (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
       (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
+    outputs:
+      has-permission: ${{ steps.check-org.outputs.result }}
+    steps:
+      - name: Check organization membership
+        id: check-org
+        uses: actions/github-script@v7
+        with:
+          script: |
+            let username;
+            if (context.eventName === 'issue_comment' || context.eventName === 'pull_request_review_comment') {
+              username = context.payload.comment.user.login;
+            } else if (context.eventName === 'pull_request_review') {
+              username = context.payload.review.user.login;
+            } else if (context.eventName === 'issues') {
+              username = context.payload.issue.user.login;
+            }
+
+            try {
+              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: username
+              });
+
+              const hasAccess = ['admin', 'write'].includes(perm.permission);
+              console.log(`User ${username} has ${perm.permission} access`);
+
+              return hasAccess;
+            } catch(error) {
+              console.log(`User ${username} has no repository access`);
+              return false;
+            }
+
+  claude:
+    needs: [check-permissions]
+    if: needs.check-permissions.outputs.has-permission == 'true'
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       pull-requests: read