workflows/claude: fix PR checkout for fork PRs
What the developer wrote
Authored by Olaoluwa Osuntokun
workflows/claude: fix PR checkout for fork PRs
When a PR originates from a fork, the PR branch doesn't exist in the
origin remote. This adds a step that uses `gh pr checkout` before
running the Claude action, which properly handles fork PRs by adding
the fork as a remote and fetching the branch from there.
What changed, and why it matters
This is a small GitHub Actions workflow fix that changes how pull-request branches are checked out before running an automated 'Claude Code' review step. Previously, branches from forked repositories could not be found; the fix uses GitHub's 'gh pr checkout' command, which automatically adds the fork as a remote and fetches the correct branch. It is a CI/CD plumbing change, not a patch for a product vulnerability.
No security action required. Review as a normal CI workflow improvement. Ensure the workflow's permissions block remains minimal (e.g., contents: read, pull-requests: read) and that the Claude Code action is pinned to a trusted version.
Security signals we found
Uses ${{ github.token }} with the gh CLI, which is the standard, least-privilege default token in GitHub Actions
No new secrets, credentials, or elevated permissions are requested
No changes to application code, RPC handlers, or consensus-critical logic
Workflow already had access to PR contents; this change only makes that access work for fork PRs
Evidence from the diff
The commit modifies .github/workflows/claude.yml. It inserts a new step that runs ‘gh pr checkout
Changed components
.github/workflows/claude.ymlInspect captured patch +12 / −0
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index d300267..d211eb0 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -30,6 +30,18 @@ jobs:
with:
fetch-depth: 1
+ - name: Checkout PR branch (handles fork PRs)
+ if: github.event.issue.pull_request || github.event_name == 'pull_request_review_comment' || github.event_name == 'pull_request_review'
+ env:
+ GH_TOKEN: ${{ github.token }}
+ run: |
+ if [ "${{ github.event_name }}" = "issue_comment" ]; then
+ PR_NUMBER=${{ github.event.issue.number }}
+ else
+ PR_NUMBER=${{ github.event.pull_request.number }}
+ fi
+ gh pr checkout "$PR_NUMBER"
+
- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@v1
Why this scored 21/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.