diff options
| author | hathach <[email protected]> | 2026-06-02 10:42:39 +0700 |
|---|---|---|
| committer | hathach <[email protected]> | 2026-06-02 10:42:39 +0700 |
| commit | 6936cc630dfc0d125337e3f4f6e9322b503df3b2 (patch) | |
| tree | d3ef4b1a1c4e71b00fca9a4a011807db48686a33 /.github/workflows | |
| parent | b009ddb01232192538762f21371d65a4e6d04f14 (diff) | |
ci(claude): scope Bash allowlist instead of wide-open (Codex P1)
Codex flagged that @claude can be summoned on a fork PR (the review
workflow even directs fork PRs here), so the checked-out PR content is
potentially attacker-controlled. Unrestricted Bash in this write-token +
OAuth-secret job let prompt injection steer Claude into arbitrary
shell/network commands.
Scope Bash to the repo's actual verification commands (cmake, ninja,
make, ctest, python/python3, pre-commit, clang-format, codespell, git).
This blocks the injection-to-arbitrary-command path while still letting
Claude build/test before committing. Building fork code itself is already
done by the existing CircleCI, so that surface is unchanged.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/claude.yml | 20 |
1 files changed, 15 insertions, 5 deletions
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 9e7c8335f..66a1098ab 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -57,8 +57,18 @@ jobs: # No custom prompt: Claude performs the instructions in the @claude comment. - # Let summoned runs actually fix bugs: allow Bash so Claude can build/test - # and verify the change before it commits, plus enough turns to investigate. - # File edits (Edit/Write) and git push are handled by the action itself. - # Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR. - claude_args: '--allowedTools Bash --max-turns 30' + # Let summoned runs actually fix bugs: allow the repo's build/test/lint + # commands so Claude can verify the change before it commits, plus enough + # turns to investigate. File edits (Edit/Write) and git push are handled + # by the action itself. + # + # Bash is scoped to a curated allowlist rather than wide-open: the job `if` + # gate trusts the *commenter*, but @claude can be summoned on a fork PR + # (claude-code-review.yml even directs fork PRs here), so the checked-out + # PR content is potentially attacker-controlled. Scoping blocks prompt + # injection from steering Claude into arbitrary shell/network commands + # while this job holds the OAuth secret + write token. Keep `bash`/`sh`/ + # `curl`/`wget`/`eval` OUT of this list. + claude_args: >- + --allowedTools "Bash(git:*),Bash(cmake:*),Bash(ninja:*),Bash(make:*),Bash(ctest:*),Bash(python3:*),Bash(python:*),Bash(pre-commit:*),Bash(clang-format:*),Bash(codespell:*)" + --max-turns 30 |