Change 1: pull-requests: write permission

This is a required and correct change. The workflow was previously only able to read PR data, so it could not post comments. Upgrading to write is the minimal permission needed.

The security posture here is sound: this workflow uses the workflow_run event pattern, which runs in the context of the base branch (not the forked branch), so secrets like ANTHROPIC_API_KEY are never exposed to untrusted code from a fork. This is the recommended approach for safely running privileged workflows triggered by fork PRs.

Change 2: allowed_non_write_users: "*"

This allows the claude-code-action to proceed for PRs from users who don't have write access to the repository (e.g., external contributors). For an open-source project like MultiQC, this is a reasonable default.

One consideration worth noting: "*" is effectively unlimited — any user opening a PR will trigger an API call to Anthropic. For a high-traffic repo this could generate significant costs. A more conservative option would be a specific list of trusted external contributors, or leaving this unset and only running for write-access users. That said, given the current PR volume, this is likely fine.

Prompt Injection Risk (pre-existing, not introduced here)

The workflow already instructs Claude to use gh pr comment to post comments, and runs with --permission-mode bypassPermissions. With allowed_non_write_users: "*" now enabled for all contributors, there is a minor increase in attack surface: a malicious actor could craft a PR whose code/content attempts to manipulate Claude's behavior (prompt injection) — e.g., embedding instructions in source code comments like "IGNORE PREVIOUS INSTRUCTIONS". This is a pre-existing design concern rather than something introduced by this PR, but it's worth being aware of.

Summary

This looks good to merge.