From 3f2220bc4ae71c27333d5e5735f7b2286d2bfee8 Mon Sep 17 00:00:00 2001
From: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
Date: Wed, 14 Oct 2026 14:56:01 -0700
Subject: [PATCH] fix(claude-review): opt in to fork PR-head checkout for
 actions/checkout v7

actions/checkout v7 (bumped in #116) refuses to check out fork pull request code from a workflow_run job unless the step opts in, so every fork PR review fails at the PR-head checkout. The step only reads the code, never runs it, persists no credentials, and strips symlinks afterwards.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
---
 .github/workflows/reusable_claude_pr_review.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/reusable_claude_pr_review.yml b/.github/workflows/reusable_claude_pr_review.yml
index b2935b7..daf027e 100644
--- a/.github/workflows/reusable_claude_pr_review.yml
+++ b/.github/workflows/reusable_claude_pr_review.yml
@@ -242,6 +242,9 @@ jobs:
           persist-credentials: false
           submodules: false
           fetch-depth: 0
+          # checkout v7 refuses fork code under workflow_run without this opt-in.
+          # Safe here: the code is only read, never run, and no token persists.
+          allow-unsafe-pr-checkout: true
 
       # Remove any symlinks from the checkout so the agent's read tools can only
       # see files inside pr-head/.