From b009ddb01232192538762f21371d65a4e6d04f14 Mon Sep 17 00:00:00 2001 From: hathach Date: Tue, 2 Jun 2026 10:38:09 +0700 Subject: ci(claude): enable @claude to fix bugs and commit from comments Configure the @claude summon workflow so it can actually produce a verified fix when asked in an issue/PR comment: - use_commit_signing: bot commits show as Verified - --allowedTools Bash: lets Claude build/test to verify the fix before committing (default allowlist blocks Bash). Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR. - --max-turns 30: enough turns to investigate -> fix -> verify Auto-commit/PR is already built into claude-code-action and the required write permissions were already present, so no permission changes are needed. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/claude.yml | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index bf7a401e4..9e7c8335f 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -50,10 +50,15 @@ jobs: additional_permissions: | actions: read - # Optional: Give a custom prompt to Claude. If this is not specified, Claude will perform the instructions specified in the comment that tagged it. - # prompt: 'Update the pull request description to include a summary of changes.' + # Sign the bot's commits so they show as "Verified". The action commits + # automatically — on a PR comment it pushes to that PR's branch; on an + # issue comment it opens a new claude/* branch + PR with the fix. + use_commit_signing: true - # Optional: Add claude_args to customize behavior and configuration - # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md - # or https://code.claude.com/docs/en/cli-reference for available options - # claude_args: '--allowed-tools Bash(gh pr:*)' + # No custom prompt: Claude performs the instructions in the @claude comment. + + # Let summoned runs actually fix bugs: allow Bash so Claude can build/test + # and verify the change before it commits, plus enough turns to investigate. + # File edits (Edit/Write) and git push are handled by the action itself. + # Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR. + claude_args: '--allowedTools Bash --max-turns 30' -- cgit v1.3.1 From 6936cc630dfc0d125337e3f4f6e9322b503df3b2 Mon Sep 17 00:00:00 2001 From: hathach Date: Tue, 2 Jun 2026 10:42:39 +0700 Subject: ci(claude): scope Bash allowlist instead of wide-open (Codex P1) Codex flagged that @claude can be summoned on a fork PR (the review workflow even directs fork PRs here), so the checked-out PR content is potentially attacker-controlled. Unrestricted Bash in this write-token + OAuth-secret job let prompt injection steer Claude into arbitrary shell/network commands. Scope Bash to the repo's actual verification commands (cmake, ninja, make, ctest, python/python3, pre-commit, clang-format, codespell, git). This blocks the injection-to-arbitrary-command path while still letting Claude build/test before committing. Building fork code itself is already done by the existing CircleCI, so that surface is unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/claude.yml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 9e7c8335f..66a1098ab 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -57,8 +57,18 @@ jobs: # No custom prompt: Claude performs the instructions in the @claude comment. - # Let summoned runs actually fix bugs: allow Bash so Claude can build/test - # and verify the change before it commits, plus enough turns to investigate. - # File edits (Edit/Write) and git push are handled by the action itself. - # Safe because the job `if` gate restricts this to OWNER/MEMBER/COLLABORATOR. - claude_args: '--allowedTools Bash --max-turns 30' + # Let summoned runs actually fix bugs: allow the repo's build/test/lint + # commands so Claude can verify the change before it commits, plus enough + # turns to investigate. File edits (Edit/Write) and git push are handled + # by the action itself. + # + # Bash is scoped to a curated allowlist rather than wide-open: the job `if` + # gate trusts the *commenter*, but @claude can be summoned on a fork PR + # (claude-code-review.yml even directs fork PRs here), so the checked-out + # PR content is potentially attacker-controlled. Scoping blocks prompt + # injection from steering Claude into arbitrary shell/network commands + # while this job holds the OAuth secret + write token. Keep `bash`/`sh`/ + # `curl`/`wget`/`eval` OUT of this list. + claude_args: >- + --allowedTools "Bash(git:*),Bash(cmake:*),Bash(ninja:*),Bash(make:*),Bash(ctest:*),Bash(python3:*),Bash(python:*),Bash(pre-commit:*),Bash(clang-format:*),Bash(codespell:*)" + --max-turns 30 -- cgit v1.3.1 From 2fc46b690996f776e3b36bcaa9865e7d2a8f8c89 Mon Sep 17 00:00:00 2001 From: hathach Date: Tue, 2 Jun 2026 11:18:14 +0700 Subject: ci(claude): drop Bash allowlist entirely (Codex P1, round 2) Codex correctly noted that allowing python3/python (and really cmake/make too) is arbitrary code + network execution: a command allowlist cannot contain a prompt-injected or malicious fork PR when this job holds the OAuth secret + write token, and the review workflow directs fork PRs to @claude. The Bash allowlist was beyond the original scope (auto-commit/PR) anyway. Remove it: Claude edits files and the action commits/opens the PR, and the resulting commit is verified by the existing CircleCI matrix. Keep use_commit_signing and --max-turns 30. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/claude.yml | 24 +++++++++--------------- 1 file changed, 9 insertions(+), 15 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 66a1098ab..66e36897c 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -57,18 +57,12 @@ jobs: # No custom prompt: Claude performs the instructions in the @claude comment. - # Let summoned runs actually fix bugs: allow the repo's build/test/lint - # commands so Claude can verify the change before it commits, plus enough - # turns to investigate. File edits (Edit/Write) and git push are handled - # by the action itself. - # - # Bash is scoped to a curated allowlist rather than wide-open: the job `if` - # gate trusts the *commenter*, but @claude can be summoned on a fork PR - # (claude-code-review.yml even directs fork PRs here), so the checked-out - # PR content is potentially attacker-controlled. Scoping blocks prompt - # injection from steering Claude into arbitrary shell/network commands - # while this job holds the OAuth secret + write token. Keep `bash`/`sh`/ - # `curl`/`wget`/`eval` OUT of this list. - claude_args: >- - --allowedTools "Bash(git:*),Bash(cmake:*),Bash(ninja:*),Bash(make:*),Bash(ctest:*),Bash(python3:*),Bash(python:*),Bash(pre-commit:*),Bash(clang-format:*),Bash(codespell:*)" - --max-turns 30 + # Deliberately NO Bash in the tool allowlist. @claude can be summoned on a + # fork PR (claude-code-review.yml even directs fork PRs here), and this job + # holds the OAuth secret + a write token. Any build/interpreter command + # (python -c, cmake/make custom targets, etc.) run against attacker- + # controlled PR content is arbitrary code + network execution, so no + # command allowlist can safely contain it. Claude still edits files and + # the action commits/opens the PR; the resulting commit is verified by the + # repo's CircleCI matrix. --max-turns gives room to investigate + fix. + claude_args: '--max-turns 30' -- cgit v1.3.1