chore(deps): bump claude-code-action to v1.0.185, quote --allowedTools - #559
chore(deps): bump claude-code-action to v1.0.185, quote --allowedTools#559wkoutre wants to merge 4 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
● Reviewed · against Caution Changes requested — two quoting issues in Bumps AssessmentThe pin is verified against the annotated tag, the v1.0.183→v1.0.185 source delta doesn't touch Must address
Suggestions
Iteration history · 4 reviews2026-08-05 18:37 UTC · 🚨 changes requested · 1 finding ·
|
📚 Documentation Check ✅Verdict: Passed All 7 changed files are under .github/workflows/; none touch packages/plugins/, so the mandatory plugin version-bump rule doesn't apply. Changes are mechanical CI maintenance (SHA/version bump + quoting a shell variable) with no stale doc references found. SummaryPR #559 bumps Scope check: All 7 changed files live in CLAUDE.md check: README check: Changelog: Informational only per the task rules — no changelog entry exists for this kind of routine dependency maintenance, consistent with the prior identical commits ( No blocking issues found; verdict is PASS. ✨ No Documentation Updates NeededAll documentation appears to be up to date with the code changes. 🤖 Generated by Claude Documentation Validator | Mode: |
github-actions
Bot
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| required: false | ||
| type: string | ||
| default: "claude-opus-4-8" | ||
| default: "claude-opus-5" |
There was a problem hiding this comment.
🔵 info · correctness — generate-pr-title-description.yml:51 passes no model under the comment # Use default model (claude-sonnet-5), so it silently inherits this default and now runs title/description generation on Opus 5. The comment was already wrong before this bump; either fix the comment or pass an explicit model.
There was a problem hiding this comment.
Caution
…ter arg parser v1.0.183 escapes () before shell-quote tokenization, so unquoted grants containing a space (e.g. Bash(npm run:*)) now fragment into rules that match nothing instead of being read as one token. Quote each affected --allowedTools/--allowedTools expansion, matching the existing --system-prompt "$VAR" convention already used in _claude-main.yml. Addresses review feedback on PR #559.
|
@request-claude-review Fixed. v1.0.183 now escapes
Left the |
![semgrep-code-uniswap[bot]](https://avatars.githubusercontent.com/u/36115574?s=60&v=4){kind=small}
| # - npm run / npx nx / bun run: linters, formatters, type checkers | ||
| # Bash(node:*) is intentionally excluded — it permits arbitrary JS execution. | ||
| claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*),WebSearch,WebFetch" | ||
| claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools \"Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*),WebSearch,WebFetch\"" |
There was a problem hiding this comment.
Semgrep identified an issue in your code:
Reusable workflow (on: workflow_call) uses bun run. Bun auto-loads bunfig.toml from CWD, and its preload array executes arbitrary code before the intended script. If the workflow checks out fork PR code, this enables RCE with access to the caller's secrets. Fix: set BUN_CONFIG_FILE=/dev/null in the job env.
To resolve this comment:
✨ Commit fix suggestion
| claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools \"Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*),WebSearch,WebFetch\"" | |
| claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),WebSearch,WebFetch" |
View step-by-step instructions
-
Add
BUN_CONFIG_FILE: /dev/nullto the reusable workflow jobenvthat contains the Claude step and any otherbun runusage.
This disables Bun's automatic loading ofbunfig.tomlfrom the checked-out working directory, so preload code in fork-controlled files does not execute. -
Place the setting at the job level so every step in that job inherits it, for example by updating the job to include
env: { BUN_CONFIG_FILE: /dev/null }or:
env:
BUN_CONFIG_FILE: /dev/null -
Keep the existing
claude_argsonly if the workflow still needs Bun-based commands.
Alternatively, if no Bun command is actually required in this reusable workflow, removeBash(bun run:*)from--allowedToolsto reduce exposure further.
💬 Ignore this finding
Reply with Semgrep commands to ignore this finding.
/fp <comment>for false positive/ar <comment>for acceptable risk/other <comment>for all other reasons
Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by bun-run-in-reusable-workflow.
You can view more details about this finding in the Semgrep AppSec Platform.
github-actions
Bot
changed the title
| # Add allowed tools (camelCase format) | ||
| if [[ -n "$INPUT_ALLOWED_TOOLS" ]]; then | ||
| ARGS="$ARGS--allowedTools $INPUT_ALLOWED_TOOLS"$'\n' | ||
| ARGS="$ARGS--allowedTools \"$INPUT_ALLOWED_TOOLS\""$'\n' |
There was a problem hiding this comment.
--disallowedTools $INPUT_DISALLOWED_TOOLS at line 417 is still unquoted, and disallowedTools is in the same ACCUMULATING_FLAGS set. A caller's Bash(git push:*) deny rule fragments into Bash(git / push:*) — matching no rule — so the tool they forbade becomes available with no error in the log. v1.0.133 over-denied here; v1.0.183 fails open. Apply the same quoting as this line: ARGS="$ARGS--disallowedTools \"$INPUT_DISALLOWED_TOOLS\""$'\n'.
|
↻ Reviewing now · view run ↗ This comment will update when the review completes. Findings will appear in the sticky summary above. |
|
Refreshed pin to |
github-actions
Bot
changed the title
1 participant
Summary
Maintenance pass on Claude Code Action workflows. Applies three classes of edit atomically:
v1.0.183(be7b93b) — see https://github.com/anthropics/claude-code-action/releases/tag/v1.0.1839b405c7(Uniswap/ai-toolkitnextHEAD)haiku→claude-haiku-4-5-20251001opus→claude-opus-5sonnet→claude-sonnet-5Per-file changes
.github/workflows/_claude-code-review.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)anthropics/claude-code-action:787c5a0→be7b93b(v1.0.183).github/workflows/_claude-docs-check.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)anthropics/claude-code-action:787c5a0→be7b93b(v1.0.183).github/workflows/_claude-main.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5.github/workflows/_claude-task-worker.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5claude-opus-4-8→claude-opus-5.github/workflows/_generate-pr-metadata.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)anthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5.github/workflows/_update-action-versions-worker.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183).github/workflows/dev-ai-newsletter.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5Opened by the
sync-claude-code-actionmaintenance job. The job runs weekly and bumps SHAs + applies known migrations; review the diff before merging.AI-Generated Description
Summary
Weekly
sync-claude-code-actionmaintenance pass, plus the one code change the bump turned out to require. 7 workflow files, +15 / −15:anthropics/claude-code-action:787c5a0(v1.0.133, pinned in chore(deps): bump claude-code-action to v1.0.133 and model versions #527) →9db594c(v1.0.185) — all 10 pins in the repo. Release notes.--allowedToolsvalues quoted (b19fb05) — v1.0.183 changed howclaude_argsis tokenized, which silently breaks every unquoted grant containing a space. Without this, the bump would have gone green and degraded.Two things about this diff that differ from the sync job's boilerplate:
6148481), and this week's run bumped again to v1.0.185 (6a54c3f) — pure SHA lines, nothing else. Net againstnextit is a single hop,787c5a0→9db594c.claude-opus-4-8 → claude-opus-5sweep landed independently as chore(workflows): update model references to claude-opus-5 #558 and this branch mergednextin atfb70db5, so those edits are in the common ancestor.git diffagainstnextcontains zero model-ID changes. Theai-toolkit → c4820d6bullet is likewise a no-op: this repo's own references resolve symbolically (@main,toolkit_ref: 'main'), so there is no SHA to move.Why the quoting fix is load-bearing
v1.0.183 escapes
(and)before handingclaude_argsto shell-quote tokenization. An unquoted grant containing a space therefore splits on whitespace, and because--allowedToolsis variadic both halves are consumed as rules:None of those match anything. The run stays green; the agent quietly loses the grants it was supposed to have and its
git log/git diffcalls start getting denied mid-run. Quoting keeps the value one token, matching the--system-prompt "$VAR"convention used two lines away in_claude-main.yml.4 of the 5 sites were broken on their default path, not hypothetically:
_claude-code-review.yml$ALLOWED_TOOLS)Bash(git log/diff/show/blame/rev-parse:*)— 5, from the defaultTOOLSarray at L1092_claude-code-review.ymlclaude_args(literal)Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*)_claude-docs-check.ymlBash(git log:*),Bash(git diff:*),Bash(git show:*)_generate-pr-metadata.yml$ALLOWED_TOOLS)Bash(git log/diff/show/rev-parse:*)— 4, from the defaultTOOLSarray at L868_claude-main.yml$INPUT_ALLOWED_TOOLSallowed_toolsdefaults to""_claude-task-worker.yml:606needed no change — its list was already quoted.Changes
--allowedToolsquoted.github/workflows/_claude-code-review.yml.github/workflows/_claude-docs-check.yml.github/workflows/_claude-main.yml.github/workflows/_claude-task-worker.yml.github/workflows/_generate-pr-metadata.yml.github/workflows/_update-action-versions-worker.yml.github/workflows/dev-ai-newsletter.ymlpackages/plugins/files touched → no plugin version bump applies.Two
--allowedTools-class sites left unquoted_claude-docs-check.yml:1047(auto-fixclaude_args) — not broken: its only Bash grant isBash(git:*), no space, nothing fragments. It is however now the only unquoted--allowedToolsleft, in the same file as L686 which was quoted. Adding a space-containing grant there later reintroduces the bug with no signal._claude-main.yml:417—--disallowedTools $INPUT_DISALLOWED_TOOLS— still unquoted, and the parser change is flag-agnostic.disallowed_toolsdefaults to"", so no path in this repo is affected, but an external caller passing e.g.Bash(rm -rf:*)gets the same fragmentation. For a deny list that fails open, which inverts the severity relative to the allow-list case. This is the one residual gap worth deciding on before merge rather than after.Verification
anthropics/claude-code-actionpins are on9db594c/v1.0.185.grepfor787c5a0,be7b93b,v1.0.133, andv1.0.183across.yml,.md, and.tsreturns nothing — no intermediate SHA left behind and nothing stale in the docs._update-action-versions-worker.yml:274and thegrep/sedpatterns inupdate-claude-code-action.ymlthat drive this job..github/actions/,.github/workflows/examples/, or the docs, so those 10 are the complete set.generate-pr-title-description.yml:47callsuses: ./.github/workflows/_generate-pr-metadata.yml, a local ref — so this title and description were generated by the patched workflow on9db594c, and thegit diff/git grep/git logreads behind the tables above resolved rather than being denied. That exercises L905, the site with 4 space-containing grants.Two things not checkable from this runner:
9db594c↔v1.0.185mapping comes from the sync job; no network access to the upstream repo, so the SHA was not independently re-verified against the tag.actionlintand a YAML parse-check were both blocked by this runner's command policy. The\"escapes are standard in both contexts they appear in (bash double-quoted strings for L1190/686/412/905, a YAML double-quoted scalar for L1730), but CI is the first real parse.Test plan
_generate-pr-metadata.yml— exercised by this PR itself, patched, on9db594c_claude-docs-check.yml— also called locally (claude-docs-check.yml:66), so this PR live-exercises L686, the second demonstrably-broken site. A green docs-check is the confirmation._claude-main.yml— spot-check with an@claudemention on this PR (claude-code.yml:35, local ref). Note this does not cover L412 unlessallowed_toolsis passed._claude-code-review.yml— not exercised here. Since refactor(ci): review ai-toolkit's own PRs with @uniswap/review-cli #556 ai-toolkit reviews its own PRs with@uniswap/review-cli, so its 2 pins and both quoting fixes (L1190, L1730) run only in consumer repos. L1190 is on the default review path, so validate against a consumer orUniswap/ai-sandboxbefore this reaches them._update-action-versions-worker.yml/dev-ai-newsletter.yml— not triggered by a PR event; next scheduled or manual run is the real check._claude-main.yml:417(--disallowedTools) — fix now or file it.Opened by the
sync-claude-code-actionmaintenance job. It runs weekly, bumps SHAs, and applies known migrations — review the diff before merging. The--allowedToolsquoting commit was added by hand in response to review feedback; the job did not catch that the bump was breaking.