[Tooling] Secure Claude workflows

[iangmaia]

Summary

• Allow @claude review comments only from trusted commenters and skip Claude workflows on fork/external PRs before checkout or Claude execution.
• Pin mutable action references and preserve the Claude action's required OIDC permission for GitHub App token exchange.
• Keep review feedback inline-only where the workflow does not grant issue-comment permissions.

[wpmobilebot]

XCFramework Build

This PR's XCFramework is available for testing. Add the following to your Package.swift:

.package(url: "https://github.com/wordpress-mobile/GutenbergKit", branch: "pr-build/533")

_{Built from 2bdb8d2}

[Copilot]

Pull request overview

This PR hardens the claude-review GitHub Actions workflow by preventing Claude from running (and preventing checkout) on fork/external PRs, while also pinning action references and limiting review output to inline comments only.

Changes:

• Added a “PR origin” check via gh api and gated both checkout and Claude execution to internal PRs only.
• Pinned actions/checkout and anthropics/claude-code-action to immutable commit SHAs and disabled credential persistence on checkout.
• Removed top-level PR comment tooling/instructions so the workflow stays inline-only when issue-comment permissions aren’t granted.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[mokagio]

The E2E tests are failing consistently (retried 3 times). I tasked an agent to investigate, see #540

[iangmaia]

@claude review this PR.

[claude]

Claude finished @iangmaia's task in 0s —— View job

---

I'll analyze this and get back to you.

[iangmaia]

Claude finished @iangmaia's task in 0s —— View job

I'll analyze this and get back to you.

Ah ofc, this PR isn't merged so this won't trigger the Claude workflow.

[mokagio]

We established that the E2E won't go to green until #540 lands. Given the Claude review would be useful in #540, I'm going to merge this without the E2E green (which anyway are tests that don't matter for the context of this change) and move on.