Repository navigation
ci(claude): rebuild review and triage so Claude has no shell, network or GitHub token - #895
Merged
Merged
Conversation
… or GitHub token The action-based setup gave Claude gh and git on fork content with secrets present, and every protective layer (read denials, the action's sandbox, a network allowlist, nested isolation) broke the next command: five live runs, no review posted. Now each job is split in three: - plain shell steps with the GitHub token fetch the PR or issue into files (fetch-pr.sh reads the head from git objects, never checks it out, and renames instruction files a PR adds so they cannot act as instructions); - the pinned Claude Code CLI runs with Read, Glob and Grep only, reading the base checkout plus that data directory, with credential paths denied, and returns structured JSON (run-claude.sh); a denied read inside the data directory fails the run instead of posting an empty review; - plain shell steps post the result: one PR review with inline comments that falls back to listing them in the body when GitHub refuses a line (post-review.sh), or allowlisted labels plus one comment (post-triage.sh). claude-code-action, the helper scripts and the @claude workflow are gone. Both paths were run end to end locally against #879 and #886 with posting in dry-run mode. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WJcXkGQrMiBPixVEFTSBJS
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the claude-code-action setup, which never posted a review in five live runs (sandbox, network and read-denial conflicts). Fetch into files with plain shell, run the pinned Claude Code CLI with Read/Glob/Grep only and structured JSON output, post with plain shell. Both paths tested end to end locally against #879 and #886 (posting dry-run). Details in the commit message.
🤖 Generated with Claude Code
https://claude.ai/code/session_01WJcXkGQrMiBPixVEFTSBJS