Add non-write users check workflow

[OctavianGuzu]

Adds a workflow that detects when a PR adds or modifies allowed_non_write_users in workflow files and leaves a comment prompting security review.

[github-actions]

allowed_non_write_users detected

This PR adds or modifies allowed_non_write_users, which allows users without write access to trigger Claude Code Action workflows. This can introduce security risks.

If this is a new flow, please make sure you actually need allowed_non_write_users. If you are editing an existing workflow, double check that you are not adding new Claude permissions which might lead to a vulnerability.

See existing workflows in this repo for safe usage examples, or contact the AppSec team.

[claude]

Code Review Summary

Nice idea — having an automated check for allowed_non_write_users changes is a good security guardrail. The workflow is well-structured from a security perspective (no checkout, minimal permissions, env vars instead of inline ${{ }} interpolation).

A few things worth addressing:

1. Diff grep scope is too broad — The allowed_non_write_users search runs across the entire PR diff, not just workflow files. Changes to docs, tests, or source code mentioning this string will trigger false positives. The filename filter also matches all YAML files, not just .github/workflows/. See inline comment with a suggested fix.

2. Duplicate comment detection is fragile — Searching all comments for the substring allowed_non_write_users can collide with organic reviewer discussion. A unique HTML comment marker would be more robust.

3. Missing paths filter on the trigger — The workflow runs on every PR, relying on the in-script check to exit early. A paths filter on .github/workflows/** would avoid spinning up a runner at all for unrelated PRs.

[github-actions]

allowed_non_write_users detected

This PR adds or modifies allowed_non_write_users, which allows users without write access to trigger Claude Code Action workflows. This can introduce security risks.

If this is a new flow, please make sure you actually need allowed_non_write_users. If you are editing an existing workflow, double check that you are not adding new Claude permissions which might lead to a vulnerability.

See existing workflows in this repo for safe usage examples, or contact the AppSec team.