diff options
| author | hathach <[email protected]> | 2026-06-02 11:18:14 +0700 |
|---|---|---|
| committer | hathach <[email protected]> | 2026-06-02 11:18:14 +0700 |
| commit | 2fc46b690996f776e3b36bcaa9865e7d2a8f8c89 (patch) | |
| tree | 024f74a625ad2e0fb21a0dcb6b60c5cb6213e1fb /.github/workflows | |
| parent | 6936cc630dfc0d125337e3f4f6e9322b503df3b2 (diff) | |
ci(claude): drop Bash allowlist entirely (Codex P1, round 2)
Codex correctly noted that allowing python3/python (and really cmake/make
too) is arbitrary code + network execution: a command allowlist cannot
contain a prompt-injected or malicious fork PR when this job holds the
OAuth secret + write token, and the review workflow directs fork PRs to
@claude.
The Bash allowlist was beyond the original scope (auto-commit/PR) anyway.
Remove it: Claude edits files and the action commits/opens the PR, and the
resulting commit is verified by the existing CircleCI matrix. Keep
use_commit_signing and --max-turns 30.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/claude.yml | 24 |
1 files changed, 9 insertions, 15 deletions
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 66a1098ab..66e36897c 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -57,18 +57,12 @@ jobs: # No custom prompt: Claude performs the instructions in the @claude comment. - # Let summoned runs actually fix bugs: allow the repo's build/test/lint - # commands so Claude can verify the change before it commits, plus enough - # turns to investigate. File edits (Edit/Write) and git push are handled - # by the action itself. - # - # Bash is scoped to a curated allowlist rather than wide-open: the job `if` - # gate trusts the *commenter*, but @claude can be summoned on a fork PR - # (claude-code-review.yml even directs fork PRs here), so the checked-out - # PR content is potentially attacker-controlled. Scoping blocks prompt - # injection from steering Claude into arbitrary shell/network commands - # while this job holds the OAuth secret + write token. Keep `bash`/`sh`/ - # `curl`/`wget`/`eval` OUT of this list. - claude_args: >- - --allowedTools "Bash(git:*),Bash(cmake:*),Bash(ninja:*),Bash(make:*),Bash(ctest:*),Bash(python3:*),Bash(python:*),Bash(pre-commit:*),Bash(clang-format:*),Bash(codespell:*)" - --max-turns 30 + # Deliberately NO Bash in the tool allowlist. @claude can be summoned on a + # fork PR (claude-code-review.yml even directs fork PRs here), and this job + # holds the OAuth secret + a write token. Any build/interpreter command + # (python -c, cmake/make custom targets, etc.) run against attacker- + # controlled PR content is arbitrary code + network execution, so no + # command allowlist can safely contain it. Claude still edits files and + # the action commits/opens the PR; the resulting commit is verified by the + # repo's CircleCI matrix. --max-turns gives room to investigate + fix. + claude_args: '--max-turns 30' |