Conversation
Updated Claude Code Review workflow to modify permissions and arguments.
Updated Claude Code Review workflow with new permissions and improved prompt instructions.
|
CodeAnt AI is reviewing your PR. Thanks for using CodeAnt! 🎉We're free for open-source projects. if you're enjoying it, help us grow by sharing. Share on X · |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review infoConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis pull request removes the allowedTools configuration from Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related PRs
Suggested labels
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
codeant-ai
bot
added
the
size:M
Sequence DiagramThe workflow was changed to run in pull_request_target, checkout the base repo only, run the Claude code-review action with a safer skip-permissions flag and expanded allowed gh/json tools, and publish a single top-level PR comment (or fall back to the job summary). This diagram shows the main success path for generating and posting the review. sequenceDiagram
participant GitHub as "GitHub PR Event"
participant Actions as "Actions Runner (pull_request_target)"
participant Claude as "anthropics/claude-code-action"
participant GHAPI as "GitHub API / gh CLI"
GitHub->>Actions: pull_request_target triggers workflow
Actions->>Actions: Checkout BASE repository only (safe on forks)
Actions->>Claude: Run Claude action (--dangerously-skip-permissions, allowedTools...)
Claude->>GHAPI: Fetch PR metadata, files, and diff via gh / API
GHAPI-->>Claude: PR files and diff
Claude->>GHAPI: Post single top-level "Claude Code Review" comment (or update)
alt Posting blocked
Claude->>Actions: Write full review to Actions job summary (fallback)
end
Generated by CodeAnt AI |
![codeant-ai[bot]](https://avatars.githubusercontent.com/in/646884?s=60&v=4){kind=small}
| - cat CLAUDE.md | ||
| Prefer jq/python3 for JSON parsing instead of shell loops. | ||
|
|
||
| Output requirements (even if no issues): |
There was a problem hiding this comment.
Suggestion: Update the workflow prompt so that the Claude reviewer explicitly reads and follows MFC's contribution and GPU documentation, and focuses on correctness and the documented PR-pattern triggers rather than style, as required by the project's AI review rules. [custom_rule]
Severity Level: Minor
| Output requirements (even if no issues): | |
| Before reviewing code, fetch and skim these MFC-specific docs from the base repository: | |
| - docs/documentation/contributing.md (especially "Common Pitfalls", "What to Review", and PR-pattern triggers) | |
| - docs/documentation/gpuParallelization.md (GPU macro API and GPU rules) | |
| Prioritize correctness, numerical and physics issues, MPI/GPU correctness, precision mixing, and memory issues over formatting or lint-only concerns, which are enforced by pre-commit/CI. | |
Why it matters? ⭐
The project's AI review rules (provided in the prompt for this task) require reviewers to prioritize correctness, numerical/physics/MPI/GPU issues, and to consult the repo's contribution and GPU documentation (docs/documentation/contributing.md and docs/documentation/gpuParallelization.md). The proposed improved prompt explicitly instructs the automated reviewer to read those MFC docs and to emphasize correctness-related checks over style (which is already enforced by pre-commit). This directly enforces a documented custom rule and is therefore a substantive, beneficial change rather than a cosmetic tweak. The improved YAML is syntactically valid and clearly narrows the review focus to the repository's stated priorities.
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** .github/workflows/claude-code-review.yml
**Line:** 72:72
**Comment:**
*Custom Rule: Update the workflow prompt so that the Claude reviewer explicitly reads and follows MFC's contribution and GPU documentation, and focuses on correctness and the documented PR-pattern triggers rather than style, as required by the project's AI review rules.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
|
CodeAnt AI finished reviewing your PR. |
There was a problem hiding this comment.
Pull request overview
Updates the GitHub Actions workflow that runs Claude-based automated code review on pull_request_target, aiming to make fork PR handling safer and to adjust the Claude tool configuration.
Changes:
- Switches checkout behavior to only fetch the base repository (not the fork PR head).
- Updates Claude invocation (plugins, prompt instructions, and the allowed tool list).
- Removes
.claude/settings.json, consolidating tool allowlisting into the workflow.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| .github/workflows/claude-code-review.yml | Adjusts permissions, checkout behavior, and Claude tool/prompt configuration for PR reviews. |
| .claude/settings.json | Deleted; previous allowed-tools configuration removed from repo config. |
| --allowedTools | ||
| "Bash(gh pr view:*)" | ||
| "Bash(gh pr diff:*)" | ||
| "Bash(gh pr comment:*)" | ||
| "Bash(gh api repos/*/pulls/*:*)" | ||
| "Bash(gh api repos/*/issues/*/comments:*)" | ||
| "Bash(gh pr list:*)" | ||
| "Bash(gh pr status:*)" | ||
| "Bash(gh issue comment:*)" | ||
| "Bash(gh api:*)" | ||
| "Bash(cat:*)" | ||
| "Bash(ls:*)" | ||
| "Bash(grep:*)" | ||
| "Bash(find:*)" | ||
| "Bash(sed:*)" | ||
| "Bash(awk:*)" | ||
| "Bash(head:*)" | ||
| "Bash(tail:*)" | ||
| "Bash(wc:*)" | ||
| "Bash(sort:*)" | ||
| "Bash(uniq:*)" | ||
| "Bash(cut:*)" | ||
| "Bash(xargs:*)" | ||
| "Bash(jq:*)" | ||
| "Bash(python3:*)" |
There was a problem hiding this comment.
The current --allowedTools list is very broad (gh api:* plus python3:* and many shell text utilities). In a pull_request_target job with secrets, a prompt-injected PR can use python3 (or other tooling) to read environment variables and leak tokens via PR comments/logs. Tighten this to only the exact gh commands/endpoints and parsing tools required (prefer jq over python3 here), and avoid wildcard gh api:* if possible.
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| issues: read | ||
| issues: write | ||
| actions: read | ||
| id-token: write |
There was a problem hiding this comment.
issues: write expands the workflow token scope compared to the previous issues: read. If this job only needs to post PR comments, keep this permission read-only (or omit it) and remove gh issue comment:* from the allowed tools; otherwise, please justify why issue write access is required in a pull_request_target workflow that runs with secrets on forked PRs.
|
|
||
| claude_args: > | ||
| --dangerouslyDisableSandbox | ||
| --dangerously-skip-permissions |
There was a problem hiding this comment.
The --dangerously-skip-permissions flag is risky in a pull_request_target workflow because it can undermine the whole point of restricting capabilities via --allowedTools. Consider removing this flag and relying on a minimal allowedTools set plus least-privilege GitHub token permissions to reduce prompt-injection blast radius.
| --dangerously-skip-permissions |
CodeAnt-AI Description
Improve Claude code review workflow for safer and clearer PR reviews
What Changed
Impact
✅ Fewer security exposures from forked PRs✅ Clearer, consistent PR review comments✅ Fewer blocked reviews when posting comments (job summary fallback)💡 Usage Guide
Checking Your Pull Request
Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.
Talking to CodeAnt AI
Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:
This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.
Example
Preserve Org Learnings with CodeAnt
You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:
This helps CodeAnt AI learn and adapt to your team's coding style and standards.
Example
Retrigger review
Ask CodeAnt AI to review the PR again, by typing:
Check Your Repository Health
To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.
Summary by CodeRabbit