Skip to content

fix(ci): make the AI review workflow run under pull_request_target #1153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ocandocrypto-uniswap merged 2 commits into from
Sep 2, 2026
Merged

fix(ci): make the AI review workflow run under pull_request_target #1153

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
24a89b4
fix(ci): make the AI review workflow run under pull_request_target
wkoutre Sep 2, 2026
00963c0
fix(ci): describe allowed_non_write_users as the action's own docs do
wkoutre Sep 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion .github/workflows/claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ concurrency:
permissions:
contents: read
pull-requests: write
id-token: write # OIDC exchange for the Claude GitHub App token

jobs:
review:
Expand All @@ -48,6 +47,20 @@ jobs:
- uses: anthropics/claude-code-action@1298632ce7736903d02a1435002705aa2a594a6c # v1.0.175
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
# By default the action trades an OIDC token for a Claude GitHub App
# token, and Anthropic's exchange rejects tokens minted under
# `pull_request_target` (anthropics/claude-code-action#713). Passing the
# job token skips that exchange. Under `pull_request_target` the job
# token carries this workflow's declared permissions, so it can post
# comments. Comments appear as github-actions[bot], not claude[bot].
github_token: ${{ secrets.GITHUB_TOKEN }}
# The action refuses actors without write access, and community
# authors never have it here. This input is the action's escape hatch.
# Its docs restrict it to workflows with very limited permissions, and
# this one qualifies: a job token scoped to `pull-requests: write`, the
# PR head never checked out, and tools limited to reading the diff and
# posting comments.
allowed_non_write_users: '*'

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 2, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Remove shell-expanded comments before allowing every author

For any public fork PR authored by a non-writer, this wildcard lets attacker-controlled diff text reach Claude while the action has both the Claude OAuth credential and a writable GitHub token. The existing Bash(gh pr comment:*) permission can be prompt-injected into running a still-allowed command such as gh pr comment ... --body "$CLAUDE_CODE_OAUTH_TOKEN"; shell expansion exposes the secret without needing a separate forbidden read command, and gh explicitly accepts arbitrary text via --body (GitHub CLI manual). Replace the shell-capable comment permission with a structured comment tool, or otherwise prevent credentials from being available to that shell, before permitting *.

Useful? React with 👍 / 👎.

prompt: |
REPO: ${{ github.repository }}
PR NUMBER: ${{ github.event.pull_request.number }}
Expand Down
Loading