From b54d61e00b4493606c3c2d9ec5cdbb15f07018be Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan@amutable.com>
Date: Tue, 17 Mar 2026 19:46:31 +0100
Subject: [PATCH 1/2] ci: Fix allowed tools in claude-review

Bash(gh:api *) wasn't actually working. Turns out the colon syntax
is deprecated and unnecessary. Let's stop using it which also fixes
the bug so that gh api calls are allowed now.
---
 .github/workflows/claude-review.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 05c1e3eb5f..6860380fd8 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -195,10 +195,10 @@ jobs:
             --max-turns 100
             --allowedTools "
                 Read,LS,Grep,Glob,Task,TaskStop,
-                Bash(cat:*),Bash(test:*),Bash(printf:*),Bash(jq:*),Bash(head:*),Bash(tail:*),
-                Bash(git:*),Bash(grep:*),Bash(find:*),Bash(ls:*),Bash(wc:*),
-                Bash(gh:api *),
-                Bash(diff:*),Bash(sed:*),Bash(awk:*),Bash(sort:*),Bash(uniq:*),
+                Bash(cat *),Bash(test *),Bash(printf *),Bash(jq *),Bash(head *),Bash(tail *),
+                Bash(git *),Bash(grep *),Bash(find *),Bash(ls *),Bash(wc *),
+                Bash(gh api *),
+                Bash(diff *),Bash(sed *),Bash(awk *),Bash(sort *),Bash(uniq *),
                 "
             --json-schema '${{ env.REVIEW_SCHEMA }}'
           prompt: |

From 6089075265765b43e6666e4d5978292a32501496 Mon Sep 17 00:00:00 2001
From: Daan De Meyer <daan@amutable.com>
Date: Tue, 17 Mar 2026 19:47:35 +0100
Subject: [PATCH 2/2] ci: Allow attaching claude-review label to PRs for
 automatic review

- If a pr is labeled with claude-review, review it immediately
- If a pr labeled with claude-review is updated, review it regardless
of the author
- If a pr is opened by a maintainer, review it and add the claude-review
label. If the claude-review label is later removed, the pr won't be
auto-reviewed anymore.
---
 .github/workflows/claude-review.yml | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 6860380fd8..736b459b07 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -11,7 +11,7 @@ name: Claude Review
 
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened]
+    types: [opened, synchronize, reopened, labeled]
   # Strangely enough you have to use issue_comment to react to regular comments on PRs.
   # See https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_comment-use-issue_comment.
   issue_comment:
@@ -33,8 +33,11 @@ jobs:
     if: |
       github.repository_owner == 'systemd' &&
       ((github.event_name == 'pull_request_target' &&
-        contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.pull_request.author_association) &&
-        github.event.pull_request.user.login != 'YHNdnzj') ||
+        (github.event.action == 'labeled' && github.event.label.name == 'claude-review' && github.event.sender.login != 'github-actions[bot]' ||
+         github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'claude-review') ||
+         github.event.action == 'opened' &&
+         contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.pull_request.author_association) &&
+         github.event.pull_request.user.login != 'YHNdnzj')) ||
        (github.event_name == 'issue_comment' &&
         github.event.issue.pull_request &&
         contains(github.event.comment.body, '@claude review') &&
@@ -56,6 +59,12 @@ jobs:
       comment_id: ${{ steps.tracking.outputs.comment_id }}
 
     steps:
+      - name: Auto-add claude-review label for trusted contributors
+        if: github.event_name == 'pull_request_target' && github.event.action == 'opened'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr edit --repo "${{ github.repository }}" "$PR_NUMBER" --add-label claude-review
+
       - name: Resolve PR metadata
         id: pr
         env: