tinyusb.git/.github/workflows/claude.yml, branch master

ci(claude): drop Bash allowlist entirely (Codex P1, round 2)

2026-06-02T04:18:14Z

Codex correctly noted that allowing python3/python (and really cmake/make too) is arbitrary code + network execution: a command allowlist cannot contain a prompt-injected or malicious fork PR when this job holds the OAuth secret + write token, and the review workflow directs fork PRs to @claude. The Bash allowlist was beyond the original scope (auto-commit/PR) anyway. Remove it: Claude edits files and the action commits/opens the PR, and the resulting commit is verified by the existing CircleCI matrix. Keep use_commit_signing and --max-turns 30. Co-Authored-By: Claude Opus 4.8 (1M context)

ci(claude): scope Bash allowlist instead of wide-open (Codex P1)

2026-06-02T03:42:39Z

Codex flagged that @claude can be summoned on a fork PR (the review workflow even directs fork PRs here), so the checked-out PR content is potentially attacker-controlled. Unrestricted Bash in this write-token + OAuth-secret job let prompt injection steer Claude into arbitrary shell/network commands. Scope Bash to the repo's actual verification commands (cmake, ninja, make, ctest, python/python3, pre-commit, clang-format, codespell, git). This blocks the injection-to-arbitrary-command path while still letting Claude build/test before committing. Building fork code itself is already done by the existing CircleCI, so that surface is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context)

ci(claude): enable @claude to fix bugs and commit from comments

2026-06-02T03:38:09Z

Configure the @claude summon workflow so it can actually produce a verified fix when asked in an issue/PR comment: - use_commit_signing: bot commits show as Verified - --allowedTools Bash: lets Claude build/test to verify the fix before committing (default allowlist blocks Bash). Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR. - --max-turns 30: enough turns to investigate -> fix -> verify Auto-commit/PR is already built into claude-code-action and the required write permissions were already present, so no permission changes are needed. Co-Authored-By: Claude Opus 4.8 (1M context)

ci: address second codex/copilot review round

2026-06-01T17:24:05Z

- claude.yml: drop the issues "assigned" trigger; its author_association gate keys on the issue author, not the assigner, so a maintainer assigning an outside contributor's issue would be wrongly skipped. - claude-code-review.yml: issues: read -> write so use_sticky_comment can create/update its PR comment via the issues API. - hil SKILL.md: make local/remote command blocks copy-pasteable (drop [-b BOARD_NAME] notation for concrete examples) and fix timeout (600000 ms is 10 min; use 1200000 ms for the stated 20 min). Co-Authored-By: Claude Opus 4.8 (1M context)

ci: address codex/copilot review on claude workflows

2026-06-01T17:16:54Z

- claude.yml: gate @claude on author_association (OWNER/MEMBER/COLLABORATOR) so the write-scoped token and OAuth secret are never issued for an untrusted commenter on this public repo (defense-in-depth). - claude-code-review.yml: skip fork PRs in the job condition (head.repo.full_name == github.repository) since forks get no secrets and would only fail noisily; fix the misleading token comment; pass additional_permissions: actions: read so actions: read is effective. - hil SKILL.md: reword hostname guidance, use full test/hil/* paths, and show an explicit CONFIG= assignment so the local command is runnable. Co-Authored-By: Claude Opus 4.8 (1M context)

ci: re-enable Claude PR review and harden auth/permissions

2026-06-01T16:51:41Z

- claude-code-review.yml: re-enable (drop `if: false`); switch from pull_request_target to pull_request so fork PRs never receive the OAuth token (avoids prompt-injection token leak). Auto-review on open/synchronize/reopen/ready_for_review, skip drafts, sticky comment. - claude.yml: grant contents/pull-requests/issues write so @claude can reply and push fixes; @claude is the on-demand path for fork PRs.

chore(workflows): update GitHub Actions dependencies and improve membrowse error handling

2026-03-12T08:48:49Z

update AGENTS.md with metrics compare

fix trailing newline in workflow files to pass pre-commit

2026-03-04T11:13:51Z

Co-Authored-By: Claude Sonnet 4.6

"Claude PR Assistant workflow"

2026-03-04T11:08:07Z

remove claude code workflow

2025-10-03T04:05:39Z