ci: fix Claude Code review workflow context and history#717
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add missing tools that Claude needed during review: - Bash(git *) wildcard instead of individual subcommands (pull was missing) - echo, ls, grep, mkdir, mktemp, pwd for basic shell operations Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Restore explicit git subcommand list (diff, log, fetch, branch, rev-parse, show, pull, checkout) instead of wildcard. Add shell utilities (echo, ls, grep, mkdir, mktemp, pwd) that Claude needs for skill script execution. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Shallow clone (depth=1) prevented git diff/log/merge-base from working. Agent couldn't read env vars for PR context due to tool permission restrictions. Now fetches full history and instructs agent to use MCP GitHub tools for PR metadata, passing context explicitly to sub-agents. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Contributor
📝 WalkthroughWalkthroughUpdated the Claude code-review GitHub Actions workflow to fetch full git history, add an extra plugin contributor, expand the review prompt with Dash Platform and PR metadata instructions, and broaden the allowed Git/shell/tool command list and max-turns. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Previous 30-turn limit caused failures when agent spent turns on permission errors. With those fixed, 150 gives ample room for complex multi-file reviews with sub-agents. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/claude-code-review.yml (1)
81-81: Verify the scope of permissive Bash patterns.The newly added shell utilities (
echo,ls,grep,mkdir,mktemp,pwd) are reasonable for review tasks. However, note thatBash(bash *)andBash(python3 *)are quite broad and could theoretically allow arbitrary command execution.Current mitigations appear adequate:
.claude/settings.jsondenies editingscripts/**and.github/workflows/**- Workflow permissions limit write access to issues and pull-requests only
If these permissive patterns were intentional (e.g., for running analysis scripts), the setup looks acceptable.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/claude-code-review.yml at line 81, The allowedTools entry contains overly permissive shell patterns—specifically the tokens Bash(bash *) and Bash(python3 *)—which permit arbitrary command execution; narrow these by replacing them with exact commands or constrained argument patterns (e.g., Bash(bash -c "specific-script.sh") or Bash(python3 path/to/script.py) or remove them entirely) and/or add explicit deny rules for editing sensitive paths referenced in .claude/settings.json; update the allowedTools string (the line containing allowedTools and the Bash(...) tokens) to the tightened patterns and rerun the workflow to confirm no needed functionality is broken.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/claude-code-review.yml:
- Line 81: The allowedTools entry contains overly permissive shell
patterns—specifically the tokens Bash(bash *) and Bash(python3 *)—which permit
arbitrary command execution; narrow these by replacing them with exact commands
or constrained argument patterns (e.g., Bash(bash -c "specific-script.sh") or
Bash(python3 path/to/script.py) or remove them entirely) and/or add explicit
deny rules for editing sensitive paths referenced in .claude/settings.json;
update the allowedTools string (the line containing allowedTools and the
Bash(...) tokens) to the tightened patterns and rerun the workflow to confirm no
needed functionality is broken.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: fa2be79e-95af-4b3e-8682-f0dd76aec5a4
📒 Files selected for processing (1)
.github/workflows/claude-code-review.yml
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/claude-code-review.yml:
- Line 81: The allowedTools string currently includes overly broad entries
(notably "Bash(bash *)" and "Bash(python3 *)" and mutable git commands like
"Bash(git checkout *)" and "Bash(git pull *)") which allow arbitrary execution
and repo mutation; edit the allowedTools value to remove or narrowly scope these
entries: remove "Bash(bash *)" and "Bash(python3 *)", replace mutable git
commands ("Bash(git checkout *)", "Bash(git pull *)") with read-only
alternatives (e.g., "Bash(git show *)", "Bash(git diff *)", "Bash(git log *)",
"Bash(git rev-parse *)"), and ensure other Bash(...) entries use explicit,
minimal allowed arguments rather than wildcards in the string assigned to
allowedTools.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: aead528a-0fd6-4866-b5ea-2dc2d13c11ed
📒 Files selected for processing (1)
.github/workflows/claude-code-review.yml
| --max-turns 30 | ||
| --allowedTools "mcp__*,Read,Write,Edit,Glob,Grep,Agent,Skill,Task,TaskCreate,TaskUpdate,TaskList,TaskGet,TaskOutput,SendMessage,Bash(gh pr *),Bash(gh api *),Bash(git diff *),Bash(git log *),Bash(git fetch *),Bash(git branch *),Bash(git rev-parse *),Bash(git show *),Bash(cat *),Bash(python3 *),Bash(bash *)" | ||
| --max-turns 150 | ||
| --allowedTools "mcp__*,Read,Write,Edit,Glob,Grep,Agent,Skill,Task,TaskCreate,TaskUpdate,TaskList,TaskGet,TaskOutput,SendMessage,Bash(gh pr *),Bash(gh api *),Bash(git diff *),Bash(git log *),Bash(git fetch *),Bash(git branch *),Bash(git rev-parse *),Bash(git show *),Bash(git pull *),Bash(git checkout *),Bash(cat *),Bash(python3 *),Bash(bash *),Bash(echo *),Bash(ls *),Bash(grep *),Bash(mkdir *),Bash(mktemp *),Bash(pwd *)" |
Contributor
There was a problem hiding this comment.
Tighten allowedTools; this currently collapses the sandbox.
Bash(bash *) and Bash(python3 *) effectively grant arbitrary command execution, and Bash(git checkout *) / Bash(git pull *) let the agent leave or mutate the PR revision it is supposed to review. On untrusted PR content, that defeats the allowlist and can produce comments against a modified tree.
🔒 Suggested narrowing
- --allowedTools "mcp__*,Read,Write,Edit,Glob,Grep,Agent,Skill,Task,TaskCreate,TaskUpdate,TaskList,TaskGet,TaskOutput,SendMessage,Bash(gh pr *),Bash(gh api *),Bash(git diff *),Bash(git log *),Bash(git fetch *),Bash(git branch *),Bash(git rev-parse *),Bash(git show *),Bash(git pull *),Bash(git checkout *),Bash(cat *),Bash(python3 *),Bash(bash *),Bash(echo *),Bash(ls *),Bash(grep *),Bash(mkdir *),Bash(mktemp *),Bash(pwd *)"
+ --allowedTools "mcp__*,Read,Write,Edit,Glob,Grep,Agent,Skill,Task,TaskCreate,TaskUpdate,TaskList,TaskGet,TaskOutput,SendMessage,Bash(gh pr *),Bash(gh api *),Bash(git diff *),Bash(git log *),Bash(git fetch *),Bash(git branch *),Bash(git rev-parse *),Bash(git show *),Bash(cat *),Bash(echo *),Bash(ls *),Bash(grep *),Bash(mkdir *),Bash(mktemp *),Bash(pwd *)"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/claude-code-review.yml at line 81, The allowedTools string
currently includes overly broad entries (notably "Bash(bash *)" and
"Bash(python3 *)" and mutable git commands like "Bash(git checkout *)" and
"Bash(git pull *)") which allow arbitrary execution and repo mutation; edit the
allowedTools value to remove or narrowly scope these entries: remove "Bash(bash
*)" and "Bash(python3 *)", replace mutable git commands ("Bash(git checkout *)",
"Bash(git pull *)") with read-only alternatives (e.g., "Bash(git show *)",
"Bash(git diff *)", "Bash(git log *)", "Bash(git rev-parse *)"), and ensure
other Bash(...) entries use explicit, minimal allowed arguments rather than
wildcards in the string assigned to allowedTools.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
fetch-depth: 1→fetch-depth: 0sogit diff,git log, andgit merge-basework correctly during reviewTest plan
claudius-reviewlabel on a test PR and verify the review completes without "command requires approval" errors🤖 Generated with Claude Code
🤖 Co-authored by Claudius the Magnificent AI Agent
Summary by CodeRabbit