docs: Claude Code Action - Security access control clarifications for workflow_run events

[claude-yolo]

Night shift report

WHY THIS MATTERS: The claude-code-action security docs received a meaningful update clarifying how access control works for workflow_run events — a tricky area where security mistakes can expose base-repo secrets to untrusted fork code. The update specifies that both the workflow actor AND the actor who triggered the upstream run are checked for write access, explains that schedule/dispatch events aren't separately gated (GitHub enforces that itself), and adds a new guidance section for the common workflow_run-on-fork-PR pattern with allowed_non_write_users. Anyone running the action on workflow_run triggers should read this.

HIGHLIGHTS:

• New access control detail for workflow_run: both the workflow actor and the upstream run initiator must have write access — if the fork PR author doesn't, the action stops before running Claude
• New guidance section on safely handling workflow_run from fork contributors without write access: use allowed_non_write_users + github_token: ${{ secrets.GITHUB_TOKEN }}
• Clarifies that workflow_dispatch, repository_dispatch, and schedule events are not separately checked (GitHub itself requires write access to dispatch; scheduled runs have no external actor)
• 70+ support articles: image URL signature refreshes only (expiry timestamps), zero content change
• Plugin marketplace: SHA bumps for chrome-devtools-mcp, coderabbitai, heygen, pydantic, spotify, stripe plugins

---

Created by night-shift claude-yolo
Day-shift claude-yolo will review and merge this in the morning