From 534ae8593b67fa083f8479703b0ea8e2a9e902fc Mon Sep 17 00:00:00 2001 From: Spencer Bryngelson Date: Mon, 12 Oct 2026 22:31:40 -0400 Subject: [PATCH 1/2] Review PRs without a shell The review prompt only reads prepared inputs -- the diff, the changed-file list, the bounded context directory and three docs -- and writes one file, .claude-review/output.md, which a later step publishes. It never needed to run commands, so grant Read/Write/Glob/Grep instead of Bash and drop --dangerously-skip-permissions. The two prompt steps that said "cat" now say "Read". This is worth having on its own, and it is a precondition for opening the review to authors without write access: shell access in a job holding the OAuth token is the payload a prompt injection in a PR diff would want. --- .github/workflows/claude-code-review.yml | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index fc3ad88d1..5f8a80acd 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -186,10 +186,9 @@ jobs: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ github.token }} claude_args: > - --dangerously-skip-permissions --max-turns 40 --allowedTools - "Bash" + "Read,Write,Glob,Grep" prompt: | You are running in GitHub Actions review automation. @@ -208,10 +207,10 @@ jobs: - Do not comment on code outside the changed files, and do not give general repo suggestions or style nitpicks. Required steps, in order; do not skip any: - 1) cat .claude/CLAUDE.md + 1) Read .claude/CLAUDE.md 2) Read the Common Pitfalls section of docs/documentation/contributing.md. If the diff touches GPU macros or src/simulation, also read docs/documentation/gpuParallelization.md. - 3) cat the changed files list and the diff. + 3) Read the changed files list and the diff. 4) For each changed Fortran or Python file that has a context file, open it and check each changed hunk against its surroundings: declarations, loop bounds, callers and callees within the file, comments that state what the code does, and the matching code paths in other directions, targets or branches. From bb9621fe0ebfd00b3a4a577f29b06b3dd3cd19c4 Mon Sep 17 00:00:00 2001 From: Spencer Bryngelson Date: Mon, 12 Oct 2026 22:39:07 -0400 Subject: [PATCH 2/2] Review every PR, including from authors without write access claude-code-action refuses to run when the triggering actor lacks write access ("Actor does not have write permissions to the repository"), so outside contributors' PRs got no review -- just the fallback comment saying the review produced no output. #2038 and #1926 are both in that state. Set allowed_non_write_users: "*", the action's supported way to lift that check. It only takes effect because github_token is already passed below it. allowed_bots is left at its default, so bots still cannot trigger a review. The action's docs call this bypass risky and ask that it be paired with a limited permission scope, which is why the preceding commit took the shell away: Claude now has Read/Write/Glob/Grep, cannot reach the token or the GitHub API, and only writes .claude-review/output.md for a later step to publish. The checkout stays on the base ref, so a PR's code is never executed here. Note this opens the OAuth token's budget to anyone who opens a PR. --- .github/workflows/claude-code-review.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 5f8a80acd..da7c1ccfd 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -185,6 +185,11 @@ jobs: with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} github_token: ${{ github.token }} + # Review every PR, not just those from authors with write access. The action + # otherwise stops on "Actor does not have write permissions"; it needs + # github_token above to honour this. allowed_bots stays empty, so bots still + # cannot trigger a review. + allowed_non_write_users: "*" claude_args: > --max-turns 40 --allowedTools