docs: update actor validation docs to reflect event-based guard

Self-trigger guard now only blocks comment/review events, not all
events. Updated CLAUDE.md, docs/forgejo.md API table, and known
limitations section.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -57,7 +57,7 @@ All other `src/github/` modules work on Forgejo via Octokit REST as-is (permissi
 - `src/github/operations/comments/create-initial.ts` — Platform-aware spinner/URL format
 - `src/github/operations/comments/update-with-branch.ts` — Forgejo branch link in tracking comment
 - `src/github/operations/branch.ts` — Uses `repos.getBranch()` on Forgejo (Forgejo has `/git/refs` not `/git/ref`)
-- `src/github/validation/actor.ts` — Bot-type check skipped on Forgejo; self-trigger guard active
+- `src/github/validation/actor.ts` — Bot-type check skipped on Forgejo; self-trigger guard only blocks comment/review events (`issue_comment`, `issues`, `pull_request_review`, `pull_request_review_comment`). PR, workflow_dispatch, and schedule events pass through even when actor matches bot_name.
 - `src/entrypoints/update-comment-link.ts` — Forgejo PR compare URL (`expand=1` instead of `quick_pull=1`)
 - `src/mcp/install-mcp-server.ts` — Skips GitHub public MCP server on Forgejo
 

docs/forgejo.md

@@ -107,15 +107,15 @@ On Forgejo, there is no OIDC token exchange with Anthropic. The action uses the
 
 ### API Differences
 
-| Feature               | GitHub                                      | Forgejo                                                               |
+| Feature               | GitHub                                      | Forgejo                                                                  |
-| --------------------- | ------------------------------------------- | --------------------------------------------------------------------- |
+| --------------------- | ------------------------------------------- | ------------------------------------------------------------------------ |
-| **GraphQL API**       | Used for PR/issue data fetching             | Not available — REST API only                                         |
+| **GraphQL API**       | Used for PR/issue data fetching             | Not available — REST API only                                            |
-| **Data fetching**     | Single GraphQL query per entity             | 5-8 parallel REST API calls                                           |
+| **Data fetching**     | Single GraphQL query per entity             | 5-8 parallel REST API calls                                              |
-| **Actor validation**  | Checks for bot/app accounts                 | Bot-type check skipped; self-trigger guard active                     |
+| **Actor validation**  | Checks for bot/app accounts                 | Bot-type check skipped; self-trigger guard on comment/review events only |
-| **GitHub MCP server** | `ghcr.io/github/github-mcp-server` included | Skipped — GitHub-specific                                             |
+| **GitHub MCP server** | `ghcr.io/github/github-mcp-server` included | Skipped — GitHub-specific                                                |
-| **CI/Actions MCP**    | Full GitHub Actions API                     | Works via Octokit REST + `GITHUB_API_URL`                             |
+| **CI/Actions MCP**    | Full GitHub Actions API                     | Works via Octokit REST + `GITHUB_API_URL`                                |
-| **Permission check**  | `getCollaboratorPermissionLevel()`          | `getCollaboratorPermissionLevel()` with `repos.get()` fallback on 403 |
+| **Permission check**  | `getCollaboratorPermissionLevel()`          | `getCollaboratorPermissionLevel()` with `repos.get()` fallback on 403    |
-| **Git ref lookup**    | `git.getRef()` (`/git/ref/heads/...`)       | `repos.getBranch()` (`/git/refs` is plural on Forgejo)                |
+| **Git ref lookup**    | `git.getRef()` (`/git/ref/heads/...`)       | `repos.getBranch()` (`/git/refs` is plural on Forgejo)                   |
 
 ### Webhook & Event Differences
 
@@ -391,7 +391,7 @@ All execution modes and trigger types have been validated end-to-end on a Forgej
 - **GitHub MCP server**: The `ghcr.io/github/github-mcp-server` Docker image is GitHub-specific and is skipped on Forgejo.
 - **Commit signing**: SSH signing has not been tested on Forgejo. The `use_commit_signing` option (GitHub API signing) won't work since it uses GitHub's commit API.
 - **`downloadJobLogForWorkflowRun`**: Forgejo's Actions API may lack this endpoint. The CI MCP server attempts it via Octokit REST but may return limited data.
-- **Bot filtering**: `allowed_bots` checks won't match `claude[bot]` since Forgejo has no bot accounts. Bot-type actor validation is skipped on Forgejo, but self-trigger prevention is active — the action blocks events where the actor matches the configured `bot_name` to prevent infinite loops.
+- **Bot filtering**: `allowed_bots` checks won't match `claude[bot]` since Forgejo has no bot accounts. Bot-type actor validation is skipped on Forgejo. Self-trigger prevention only blocks comment/review events (`issue_comment`, `issues`, `pull_request_review`, `pull_request_review_comment`) where the actor matches `bot_name` — these are the events that can cause infinite loops. PR events, workflow_dispatch, and schedule events are allowed through, enabling CI workflows (like upstream-sync) that are triggered by the bot user.
 - **`pull_request_review` trigger is dead code**: Forgejo sends `pull_request_comment` for both review comments and review submissions. The `pull_request_review` trigger in the workflow never fires — all review-related events are handled through the `pull_request_comment` codepath.
 - **Review comment tracking comments are always issue comments**: On Forgejo, review comment events lack the top-level `comment` object needed to create PR review comment replies. The tracking comment is always created as a regular issue comment instead.
 - **Workflow `if:` conditions are unreliable for Forgejo events**: Forgejo does not populate `github.event.comment.body`, `github.event.review.body`, or `github.event.action` in the workflow expression context for several event types. All trigger validation happens in application code (`trigger.ts`), not in workflow conditions.