ci: update Claude review workflows to Opus 4.6

[ian-flores]

Summary

• Update model ID in claude-auto-review.yml from us.anthropic.claude-opus-4-5-20251101-v1:0 to us.anthropic.claude-opus-4-6-v1
• Add claude.yml PR assistant workflow (responds to @claude mentions in PRs/issues)

Test plan

• Verify auto-review triggers on next PR opened
• Verify @claude mentions work in PR comments

[statik]

looks good! requesting some additional security

[statik]

could you extend the guards on this to only allow being invoked by maintainers or org members? this is a copy paste answer from google when I searched how to limit this

jobs:
  comment-job:
    if: github.actor == 'repo-maintainer' || contains(github.event.issue.author_association, 'COLLABORATOR')
    runs-on: ubuntu-latest
    steps:
      - run: echo "Only maintained by authorized users"

[ian-flores]

Added author_association checks to each event path in the if condition. Only OWNER, MEMBER, and COLLABORATOR can now trigger the workflow — external contributors and first-time commenters are silently ignored. Used the fromJSON + contains pattern to check against the allowed list.

[statik]

@ian-flores I love the author_association approach. I noticed https://github.blog/changelog/2025-08-08-upcoming-changes-to-github-events-api-payloads/ says the author association was being removed from issue comment and pr comment payloads last year. I wonder if there is another way to get this info?

[statik]

lets test it out!

[ian-flores]

Replaced author_association with a repo permission API check. The workflow now calls GET /repos/{owner}/{repo}/collaborators/{actor}/permission as the first step and fails if the actor doesn't have write or admin access. This avoids relying on author_association in the event payload entirely — good catch on the deprecation risk.

[ian-flores]

It worked @statik! Thanks for the reviews 🤝

https://github.com/posit-dev/team-operator/actions/runs/21873081709