diff options
| author | hathach <[email protected]> | 2026-06-30 16:45:34 +0700 |
|---|---|---|
| committer | hathach <[email protected]> | 2026-06-30 16:45:34 +0700 |
| commit | c52a4a37f0505bb020dd4f121dfe3908b8b30783 (patch) | |
| tree | 9375afc002b7432028fc58b3ab885606668fd90f | |
| parent | da41189467c00e339b89f722b6c6e24e4481b288 (diff) | |
ci(claude-review): allowlist the tools /code-review needs
The auto-review job runs /code-review headless, which uses Bash (git diff, gh),
file search, and Task (it fans out sub-agent reviewers). None were allowlisted,
so every such call stalled on a per-tool approval prompt and the review couldn't
gather the diff or spawn reviewers. Add --allowedTools.
Safe here (unlike claude.yml): this job is gated to same-repo PRs and its token
is contents:read, so it cannot push. Bash is broad — scope to git/gh/grep if
preferred.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
| -rw-r--r-- | .github/workflows/claude-code-review.yml | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 59019616f..88d435c00 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -53,8 +53,15 @@ jobs: # TEMPORARY: expose the full Claude transcript in the Actions log for # debugging. Revert to remove once done. show_full_output: true + # /code-review needs git/gh (Bash), file search, and the sub-agents it + # fans out (Task). This job runs ONLY on same-repo PRs (the `if` above) + # with a contents:read token that cannot push — so, unlike claude.yml's + # fork-exposed @claude job, allowlisting these is safe. Without it the + # headless run stalls on per-tool approval and can't read the diff or + # spawn reviewers. (Bash is broad; scope it to git/gh/grep if preferred.) claude_args: | --max-turns 50 --model claude-opus-4-8 --effort max + --allowedTools Bash,Read,Grep,Glob,Task,WebFetch,WebSearch,TodoWrite # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md |