Skip to content

chore(deps): bump claude-code-action to v1.0.185, quote --allowedTools #559

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wkoutre wants to merge 4 commits into
base: next
Choose a base branch
from
+15 −15
Open

chore(deps): bump claude-code-action to v1.0.185, quote --allowedTools #559

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6148481
chore(deps): maintain Claude Code Action workflows (cca=v1.0.183, ait…
wkoutre Aug 3, 2026
fb70db5
Merge branch 'next' into chore/sync-claude-code-action
wkoutre Aug 3, 2026
b19fb05
fix(workflows): quote --allowedTools lists broken by v1.0.183's stric…
wkoutre Aug 3, 2026
6a54c3f
chore(deps): maintain Claude Code Action workflows (cca=v1.0.185, ait…
wkoutre Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/_claude-code-review.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1187,7 +1187,7 @@ jobs:
COMPACT_SCHEMA=$(echo "$JSON_SCHEMA" | jq -c .)
CLAUDE_ARGS="$CLAUDE_ARGS
--json-schema '$COMPACT_SCHEMA'
--allowedTools $ALLOWED_TOOLS"
--allowedTools \"$ALLOWED_TOOLS\""

echo "allowed_tools=$ALLOWED_TOOLS" >> $GITHUB_OUTPUT
# Per-call unguessable heredoc delimiter; defense in depth against
Expand Down Expand Up @@ -1219,7 +1219,7 @@ jobs:
- name: Run Claude Code Review
if: steps.cache-check.outputs.cache-hit != 'true' && steps.diff-size.outputs.is_too_large != 'true'
id: claude
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
# Authentication: provide either API key or OAuth token (validated in earlier step)
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
Expand Down Expand Up @@ -1712,7 +1712,7 @@ jobs:
- name: Run Claude Auto-Fix
id: claude-fix
if: steps.auto-fix-check.outputs.should_fix == 'true' && steps.pr-branch.outputs.repo_full_name == github.repository
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand All @@ -1727,7 +1727,7 @@ jobs:
# - git: commit, push, status, diff operations
# - npm run / npx nx / bun run: linters, formatters, type checkers
# Bash(node:*) is intentionally excluded — it permits arbitrary JS execution.
claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*),WebSearch,WebFetch"
claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools \"Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*),WebSearch,WebFetch\""

@semgrep-code-uniswap semgrep-code-uniswap Bot Aug 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep identified an issue in your code:
Reusable workflow (on: workflow_call) uses bun run. Bun auto-loads bunfig.toml from CWD, and its preload array executes arbitrary code before the intended script. If the workflow checks out fork PR code, this enables RCE with access to the caller's secrets. Fix: set BUN_CONFIG_FILE=/dev/null in the job env.

To resolve this comment:

✨ Commit fix suggestion

Suggested change
claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools \"Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*),WebSearch,WebFetch\""
claude_args: "--model ${{ inputs.auto_fix_model || inputs.model }} --allowedTools Read,Edit,Write,Grep,Glob,Bash(git:*),Bash(npm run:*),Bash(npx nx:*),WebSearch,WebFetch"
View step-by-step instructions

  1. Add BUN_CONFIG_FILE: /dev/null to the reusable workflow job env that contains the Claude step and any other bun run usage.
    This disables Bun's automatic loading of bunfig.toml from the checked-out working directory, so preload code in fork-controlled files does not execute.

  2. Place the setting at the job level so every step in that job inherits it, for example by updating the job to include env: { BUN_CONFIG_FILE: /dev/null } or:
    env:
    BUN_CONFIG_FILE: /dev/null

  3. Keep the existing claude_args only if the workflow still needs Bun-based commands.
    Alternatively, if no Bun command is actually required in this reusable workflow, remove Bash(bun run:*) from --allowedTools to reduce exposure further.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

  • /fp <comment> for false positive
  • /ar <comment> for acceptable risk
  • /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by bun-run-in-reusable-workflow.

You can view more details about this finding in the Semgrep AppSec Platform.

# Note: plugin_marketplaces and plugins are intentionally omitted here.
# The marketplace and plugins were already installed by the "Run Claude Code
# Review" step earlier in this job. Both steps share the same runner and
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/_claude-docs-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -683,7 +683,7 @@ jobs:
CLAUDE_ARGS="$CLAUDE_ARGS --json-schema '$COMPACT_SCHEMA'"

# Read-only tools
CLAUDE_ARGS="$CLAUDE_ARGS --allowedTools Read,Grep,Glob,Bash(git log:*),Bash(git diff:*),Bash(git show:*)"
CLAUDE_ARGS="$CLAUDE_ARGS --allowedTools \"Read,Grep,Glob,Bash(git log:*),Bash(git diff:*),Bash(git show:*)\""

# Per-call unguessable heredoc delimiter; defense in depth against
# the $GITHUB_OUTPUT duplicate-key last-write-wins injection class.
Expand All @@ -707,7 +707,7 @@ jobs:
# Run Claude
- name: Run Claude Docs Check
id: claude
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down Expand Up @@ -1032,7 +1032,7 @@ jobs:
- name: Run Claude Auto-Fix
id: claude-fix
if: steps.auto-fix-check.outputs.should_fix == 'true' && steps.pr-branch.outputs.repo_full_name == github.repository
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/_claude-main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -409,7 +409,7 @@ jobs:

# Add allowed tools (camelCase format)
if [[ -n "$INPUT_ALLOWED_TOOLS" ]]; then
ARGS="$ARGS--allowedTools $INPUT_ALLOWED_TOOLS"$'\n'
ARGS="$ARGS--allowedTools \"$INPUT_ALLOWED_TOOLS\""$'\n'

@github-actions github-actions Bot Aug 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ warning · dependency-upgrade — the quoting fix stopped one line short: --disallowedTools $INPUT_DISALLOWED_TOOLS at line 417 is still unquoted, and disallowedTools is in the same ACCUMULATING_FLAGS set. A caller's Bash(git push:*) deny rule fragments into Bash(git / push:*) — matching no rule — so the tool they forbade becomes available with no error in the log. v1.0.133 over-denied here; v1.0.183 fails open. Apply the same quoting as this line: ARGS="$ARGS--disallowedTools \"$INPUT_DISALLOWED_TOOLS\""$'\n'.

fi

# Add disallowed tools
Expand Down Expand Up @@ -457,7 +457,7 @@ jobs:
# Supports both API key and OAuth token authentication (validated in earlier step)
- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
# Authentication: provide either API key or OAuth token (validated in earlier step)
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/_claude-task-worker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -577,7 +577,7 @@ jobs:
GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
GIT_COMMITTER_NAME: "github-actions[bot]"
GIT_COMMITTER_EMAIL: "github-actions[bot]@users.noreply.github.com"
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/_generate-pr-metadata.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -480,7 +480,7 @@ jobs:
steps.quality-gate-prep.outputs.has_user_content == 'true'
id: quality-gate-eval
continue-on-error: true
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down Expand Up @@ -902,7 +902,7 @@ jobs:
fi

CLAUDE_ARGS="$CLAUDE_ARGS
--allowedTools $ALLOWED_TOOLS"
--allowedTools \"$ALLOWED_TOOLS\""

echo "allowed_tools=$ALLOWED_TOOLS" >> $GITHUB_OUTPUT
# Per-call unguessable heredoc delimiter; defense in depth against
Expand Down Expand Up @@ -937,7 +937,7 @@ jobs:
- name: Run Claude Code Generation
if: steps.cache-check.outputs.cache-hit != 'true' && steps.quality-gate.outputs.should_skip != 'true'
id: claude
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/_update-action-versions-worker.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -437,7 +437,7 @@ jobs:
# Supports both API key and OAuth token authentication (OAuth takes precedence)
- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dev-ai-newsletter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -385,7 +385,7 @@ jobs:
# Run Claude Code with MCP servers
- name: Generate newsletter with Claude
id: claude
uses: anthropics/claude-code-action@787c5a0ce96a9a6cfb050ea0c8f4c05f2447c251 # v1.0.133
uses: anthropics/claude-code-action@9db594c7a0e82298c121c18b7f08aa1579ce7341 # v1.0.185
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
prompt: |
Expand Down
Loading