fix: restore authorization check on Claude workflow caller

Defense-in-depth: gate secret transmission behind OWNER/MEMBER/
COLLABORATOR check at the caller level, not just the reusable
workflow. Check author_association on the correct event object for
each trigger type (comment, review, issue) — previously only
comment-based events were checked, silently blocking members on
review and issue events.

Also adds missing CHANGELOG entries for #45 and #46.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: danielewood

.github/workflows/claude.yml

@@ -25,6 +25,17 @@ jobs:
         (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
         (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
         (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      ) && (
+        github.event.sender.login == github.repository_owner ||
+        github.event.comment.author_association == 'OWNER' ||
+        github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'COLLABORATOR' ||
+        github.event.review.author_association == 'OWNER' ||
+        github.event.review.author_association == 'MEMBER' ||
+        github.event.review.author_association == 'COLLABORATOR' ||
+        github.event.issue.author_association == 'OWNER' ||
+        github.event.issue.author_association == 'MEMBER' ||
+        github.event.issue.author_association == 'COLLABORATOR'
       )
     uses: sensiblebit/.github/.github/workflows/claude.yml@main
     secrets:

CHANGELOG.md

@@ -7,8 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+
+- Restore authorization checks on Claude Code workflow to prevent unauthorized users from triggering the workflow and exposing OAuth token secret ([#46])
+
 ### Changed
 
+- Migrate CI workflows and pre-commit hooks to organization-wide reusable workflows in `sensiblebit/.github` ([#45])
 - Consolidate CI from 16 jobs to 10 by merging jobs with identical setup: branch-name + commit-messages + verified-commits → PR Conventions, go-build + go-vet + goimports → Go Checks, web-test + wrangler-build → Web, web-lint + markdownlint → Lint
 - Remove redundant `go vet` and `go test` steps from release workflow — tags are created from main which already passed CI
 - Consolidate Dependabot GitHub Actions PRs into a single grouped PR instead of one per action
@@ -544,6 +549,8 @@ Initial release.
 [`a62908f`]: https://github.com/sensiblebit/certkit/commit/a62908f
 [`55b5c1e`]: https://github.com/sensiblebit/certkit/commit/55b5c1e
 [`8cf81d9`]: https://github.com/sensiblebit/certkit/commit/8cf81d9
+[#46]: https://github.com/sensiblebit/certkit/pull/46
+[#45]: https://github.com/sensiblebit/certkit/pull/45
 [#24]: https://github.com/sensiblebit/certkit/pull/24
 [#25]: https://github.com/sensiblebit/certkit/pull/25
 [#26]: https://github.com/sensiblebit/certkit/pull/26