fix(ci): make the AI review workflow run under pull_request_target - #1153
Conversation
The review job has failed on every PR since it landed. The action trades an OIDC token for a Claude GitHub App token, and Anthropic's exchange rejects tokens minted under `pull_request_target` (anthropics/claude-code-action#713). Pass the job token instead, which skips the exchange, and allow non-write actors so community PRs are reviewed. Drop the now-unused `id-token: write` permission. Comments will post as github-actions[bot].
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
Thanks for contributing to Uniswap Docs! 🦄 Quick heads up on how this repo works: the docs you see on developers.uniswap.org are built from a separate source repo. When we accept a change here, we port it over there, so your fix might show up on the live site before it lands in this repo. Updates to this repo come in batches on a regular cadence. When yours is included, you'll be credited as a co-author on the commit, so the contribution counts on your GitHub profile and in Uniswap/docs. We review every PR but can't merge everything. Either way, someone from the docs team will follow up here once we've taken a look. One legal bit: by submitting a PR you agree your contribution is licensed under the repo's MIT license. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24a89b4a10
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| # exactly this shape: a job token scoped to `pull-requests: write`, the | ||
| # PR head never checked out, and tools limited to reading the diff and | ||
| # posting comments. | ||
| allowed_non_write_users: '*' |
There was a problem hiding this comment.
For any public fork PR authored by a non-writer, this wildcard lets attacker-controlled diff text reach Claude while the action has both the Claude OAuth credential and a writable GitHub token. The existing Bash(gh pr comment:*) permission can be prompt-injected into running a still-allowed command such as gh pr comment ... --body "$CLAUDE_CODE_OAUTH_TOKEN"; shell expansion exposes the secret without needing a separate forbidden read command, and gh explicitly accepts arbitrary text via --body (GitHub CLI manual). Replace the shell-capable comment permission with a structured comment tool, or otherwise prevent credentials from being available to that shell, before permitting *.
Useful? React with 👍 / 👎.
2 participants
Summary
The
AI reviewcheck has failed on every PR since the workflow landed in #1139. The action trades an OIDC token for a Claude GitHub App token, and Anthropic's exchange rejects tokens minted underpull_request_target(see anthropics/claude-code-action#713, open since December with no fix released).This passes the job token to the action instead, which skips the exchange entirely. It also allows non-write actors so community PRs are reviewed, since the action otherwise refuses them.
id-token: writeis dropped because nothing uses it anymore.Comments will post as
github-actions[bot]instead ofclaude[bot]. Nothing else about the review changes: the PR head is still never checked out, and the tools are still limited to reading the diff and posting comments.Type of change
How has this been verified?
Read the action source at the pinned commit: when
github_tokenis set,setupGitHubToken()returns it before any OIDC request, andallowed_non_write_usersis the documented bypass for the write-permission check. This is also the shape the action maintainers describe forpull_request_targetin their draft docs.actionlintpasses on the file.A PR that changes this workflow cannot test itself:
pull_request_targetruns the base branch's definition. The first real run is the next PR opened after this merges.Anything else reviewers should know?
The "Actor does not have write permissions" refusal is a separate check from the OIDC exchange. Fixing only the token would move the failure to that check for every community author, so both settings are needed together.