ci: allow model dispatch bot in Claude action - #1300
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 86fa50b154
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "Codex (@codex) review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "Codex (@codex) address that feedback".
| with: | ||
| anthropic_api_key: ${{ secrets.BRAINTRUST_AGENT_SPEND_API_KEY }} | ||
| github_token: ${{ github.token }} | ||
| allowed_bots: braintrust-bot |
There was a problem hiding this comment.
When the repository dispatch is created by the Braintrust GitHub App, github.actor is braintrust-bot[bot], while the pinned Claude action compares allowed_bots against the actor's full login. Consequently, braintrust-bot does not match and the Claude step remains rejected for every dispatch that reaches this fallback; use braintrust-bot[bot] instead.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
i think claude handles this parsing for us https://github.com/anthropics/claude-code-action/blob/fbda2eb1bdc90d319b8d853f5deb53bca199a7c1/src/github/validation/actor.ts so its fine
This branch was successfully deployed
2 participants
Summary
braintrust-botto invoke the Claude Code step in the add-model workflowWhy
Repository-dispatch runs are initiated by the Braintrust GitHub App, so Claude Code correctly identifies the actor as a bot and rejects it unless that specific bot is allowlisted.
Security
This names only
braintrust-bot; it does not use the action's*wildcard. The workflow still accepts only theadd-modelrepository-dispatch event and validates the provider and model slug before this step.Verification
allowed_botsagainst the pinned Claude Code action'saction.yml