ci: address codex/copilot review on claude workflows

- claude.yml: gate @claude on author_association (OWNER/MEMBER/COLLABORATOR)
  so the write-scoped token and OAuth secret are never issued for an
  untrusted commenter on this public repo (defense-in-depth).
- claude-code-review.yml: skip fork PRs in the job condition
  (head.repo.full_name == github.repository) since forks get no secrets
  and would only fail noisily; fix the misleading token comment; pass
  additional_permissions: actions: read so actions: read is effective.
- hil SKILL.md: reword hostname guidance, use full test/hil/* paths, and
  show an explicit CONFIG= assignment so the local command is runnable.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

3 files changed, 30 insertions, 16 deletions

diff --git a/.claude/skills/hil/SKILL.md b/.claude/skills/hil/SKILL.md
index c705c149c..22588eba3 100644
--- a/.claude/skills/hil/SKILL.md
+++ b/.claude/skills/hil/SKILL.md
@@ -5,12 +5,12 @@ description: Use when running TinyUSB Hardware-in-the-Loop (HIL) tests on physic
 
 # Hardware-in-the-Loop (HIL) Testing
 
-Run TinyUSB HIL tests on real boards. **Run `hostname` first** — it sets the default config and whether remote mode is possible.
+Run TinyUSB HIL tests on real boards. **Run `hostname` first** — it tells you which host you are on, which determines the default config and whether remote mode is possible.
 
-| Host | Local boards | Remote (SSH → ci.lan)? |
+| Host | Local config | Remote (SSH → ci.lan)? |
 |------|--------------|------------------------|
-| `htpc` (dev PC) | `local.json` | yes (large pool, `tinyusb.json`) |
-| `ci` (the rig) | `tinyusb.json` (large pool) | no — can't SSH to htpc, and boards are already local |
+| `htpc` (dev PC) | `test/hil/local.json` | yes (large pool, `test/hil/tinyusb.json`) |
+| `ci` (the rig) | `test/hil/tinyusb.json` (large pool) | no — can't SSH to htpc, and boards are already local |
 
 Default to **local**. Use **remote** only when on `htpc` and the user says `remote`/`ci.lan`. Never attempt remote on `ci`.
 
@@ -27,10 +27,12 @@ If `local.json` is missing on `htpc`, ask the user to supply one (only fall back
 
 ## Local execution
 
-Pick `$CONFIG` from `hostname`: `local.json` on `htpc`, `tinyusb.json` on `ci`.
+Set `CONFIG` from `hostname` first, then run:
 
 ```bash
-python3 test/hil/hil_test.py [-b BOARD_NAME] -B examples $CONFIG $EXTRA_ARGS
+CONFIG=test/hil/local.json      # on htpc
+# CONFIG=test/hil/tinyusb.json  # on ci
+python3 test/hil/hil_test.py [-b BOARD_NAME] -B examples "$CONFIG" $EXTRA_ARGS
 ```
 
 ## Remote execution (htpc → ci.lan only)
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index 2f055287c..6c8bbb03d 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -5,16 +5,18 @@ on:
     # opened/reopened/ready_for_review -> first auto review
     # synchronize                      -> auto re-review on new pushes
     #
-    # NOTE: pull_request (not _target) means fork PRs from non-write-access
-    # contributors get NO token, so they are not auto-reviewed -> use @claude
-    # on those. Same-repo branches (yours or write-access contributors) get
-    # full auto-review safely.
+    # NOTE: pull_request (not _target) means fork PRs get a read-only GITHUB_TOKEN
+    # and NO repository secrets (CLAUDE_CODE_OAUTH_TOKEN), so they cannot be
+    # auto-reviewed. The job condition below skips them cleanly -> use @claude on
+    # those. Same-repo branches (yours or write-access contributors) auto-review.
     types: [opened, synchronize, reopened, ready_for_review]
 
 jobs:
   claude-review:
-    # Skip drafts; review real PRs only
-    if: github.event.pull_request.draft == false
+    # Skip drafts, and skip fork PRs (no secrets -> would only fail noisily)
+    if: >
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.head.repo.full_name == github.repository
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -34,6 +36,9 @@ jobs:
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # Pairs with the actions: read permission so Claude can read CI results
+          additional_permissions: |
+            actions: read
           plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
           plugins: 'code-review@claude-code-plugins'
           prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 660edfb7b..dedecd349 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -12,11 +12,18 @@ on:
 
 jobs:
   claude:
+    # Only trusted actors (repo owner/member/collaborator) may summon @claude, so the
+    # write-scoped token and OAuth secret are never issued for an outside contributor's
+    # comment on this public repo. Defense-in-depth on top of the action's own check.
     if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude') &&
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
+      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude') &&
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.comment.author_association)) ||
+      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude') &&
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.review.author_association)) ||
+      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')) &&
+        contains(fromJSON('["OWNER", "MEMBER", "COLLABORATOR"]'), github.event.issue.author_association))
     runs-on: ubuntu-latest
     permissions:
       contents: write       # allow Claude to push commits/branches when asked