diff options
| author | Ha Thach <[email protected]> | 2026-06-30 17:26:02 +0700 |
|---|---|---|
| committer | GitHub <[email protected]> | 2026-06-30 17:26:02 +0700 |
| commit | 188b99892972aafa75495ccd4be61e6c97f47a69 (patch) | |
| tree | f78f796218e692926f7ec53e2692e2fcafcf0f9e | |
| parent | da41189467c00e339b89f722b6c6e24e4481b288 (diff) | |
| parent | 37e247176cb37e15f25622bdbdc6b03931ff3d9b (diff) | |
Merge pull request #3747 from hathach/claude/claude-review-allowtools
ci(claude-review): allowlist the tools /code-review needs
| -rw-r--r-- | .github/workflows/claude-code-review.yml | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 59019616f..a9b026bfd 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -53,8 +53,15 @@ jobs: # TEMPORARY: expose the full Claude transcript in the Actions log for # debugging. Revert to remove once done. show_full_output: true + # The headless review was blocked on two tools: compound Bash pipelines + # (sed/python/grep) and Write (it dropped a check_headings.py helper to + # inspect the diff). Default permission mode gates both; Read/Grep/Glob/ + # Task already run un-prompted. Allowlist them. Safe here (unlike + # claude.yml's fork-exposed @claude job): same-repo-only + contents:read + # token, so any write is ephemeral and nothing can be pushed. claude_args: | --max-turns 50 --model claude-opus-4-8 --effort max + --allowedTools Bash,Write # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md |