fix(ci): gate claude-auto-fix-ci.yml to same-repo runs and exclude bots

[Dhravya]

Our automated "fix CI failures" helper was only staying out of pull requests opened from forks by accident, not by design. Because this repository is public and anyone can open a fork pull request, that accident was the only thing keeping outside contributors' code from being run inside a trusted, privileged automation that holds our write credentials — and this repository is the build source for the production MCP service that our AI agents and user memories sit behind. If that incidental behavior ever changed, someone else's untrusted code could execute with our secrets and push changes to the source that ships to production. Merging this makes the boundary explicit and permanent: the helper will only ever act on pull requests that originate inside this repository, and it also steps aside for routine bot-triggered runs.

Before / After

Before: When any pull request failed the type-check/format/lint checks, the auto-fix helper would consider stepping in and running with elevated, write-capable credentials. For fork pull requests it happened to stay out only because of an implicit quirk of how the platform reports those runs — nothing in the automation itself drew a line between "code from our team" and "code from an outside fork." That left a silent, fragile edge: if the platform's behavior ever shifted, or a fork run slipped through, untrusted code from an outside contributor could be pulled into the privileged automation, expose the automation's secret, and push commits onto the branch that feeds the production MCP build.

After: The auto-fix helper now checks, in plain terms, that the failing run came from a pull request inside this same repository before it does anything. A failing fork pull request still triggers the surrounding event, but the helper cleanly skips — no privileged run, no secret handed out, no code checkout, no push — and it keeps skipping even if the platform's incidental fork behavior changes later. Runs kicked off by the graphite and dependabot bots are skipped too, matching our existing review automation. Trusted same-repo pull requests are unaffected: the helper still runs and pushes fixes exactly as before.

What changed

Single file: .github/workflows/claude-auto-fix-ci.yml, job auto-fix, the if: gate.

• Added an explanatory comment above the if: documenting the security boundary — workflow_run runs in the base-repo context with repository secrets, so checking out untrusted head-branch code there is the canonical "pwn request" pattern (linked to the GitHub Security Lab writeup).
• Extended the if: with github.event.workflow_run.head_repository.full_name == github.event.workflow_run.repository.full_name so a run whose head is a fork can never execute the job, independent of the platform's implicit empty-pull_requests behavior.
• Added bot exclusions matching the sibling gated workflow claude-code-review.yml: github.event.workflow_run.actor.login != 'graphite-app[bot]' and != 'dependabot[bot]'. The workflow_run actor field is used because this is a workflow_run-triggered job.

The permissions, checkout, claude-code-action step, and --allowedTools list are untouched, so the auto-fix capability is preserved for trusted same-repo pull requests (71 successful runs since March).

Checks run

• actionlint .github/workflows/claude-auto-fix-ci.yml (v1.7.12) — passed, no findings. Confirms the extended if: expression and its workflow_run payload references (head_repository.full_name, repository.full_name, actor.login) are valid.
• YAML parse via python3 -c "yaml.safe_load(...)" — passed.
• Repo-wide search (rg) for any test, doc, or config that references this workflow or asserts its gate value — none found, so no assertion was loosened or changed.
• bun run check-types / bun run format-lint (Biome) — not run against this change: the change is YAML-only, and the repo's Biome config lints code (TS/JS), not GitHub Actions workflow YAML, so these suites are unaffected. actionlint is the appropriate linter and was run instead.

Assumptions

• The pull_requests[0] clause is retained (not replaced) so the gate is strictly additive; the new same-repo clause is the authoritative fork boundary while the original clause is preserved to avoid changing behavior for the trusted path.
• Bot exclusions mirror claude-code-review.yml; the workflow_run.actor.login field is used rather than github.actor because for a workflow_run trigger github.actor is not the reliable source of the triggering user.

  

---

Fixes: Public repo auto-fix workflow with repo write + Bash(*) is a supply-chain path into the prod MCP build

What caused this

Affected: int_ecd270c87001rlz8v4a308n0 · severity medium

A check caught it, an investigation traced it, an autofix wrote the change. Each step links to its record.

Step	Where to look
1. An issue from an exploration was opened	Open the investigation
2. A fix run traced the cause	Fix run thread
3. An autofix wrote the change, and it succeeded	Autofix fix_0960c6…
4. This pull request opened it for review	this PR

This pull request originated from a Polylane autofix. Polylane investigated the issue and delegated the fix to Cursor, which authored this pull request.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	supermemory-mcp	18015f4	Sep 12 2026, 02:39 PM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	supermemory-app	18015f4	Commit Preview URL Branch Preview URL	Sep 12 2026, 02:40 PM