tiennm99/ccs
1
0 Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-10-12 22:14:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(ai-review): switch --allowedTools to --tools for actual restriction

Browse Source 
--allowedTools is an approval list (skip permission prompts), redundant
with bypassPermissions. --tools is the actual availability whitelist.

Also simplified tool list: Bash sub-patterns (gh pr diff *, etc.) aren't
supported by --tools. The workflow token has contents:read only, so the
agent physically cannot push/delete/modify the repo even with full Bash.
This commit is contained in:
Tam Nhu Tran committed 2026-03-28 20:13:47 -04:00
1 parent 36e8cc47d9
commit 53ad2836c4
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ai-review.yml
+1 -1
View File
@@ -323,7 +323,7 @@ jobs:
--model ${{ env.REVIEW_MODEL }} --model ${{ env.REVIEW_MODEL }}
--permission-mode bypassPermissions --permission-mode bypassPermissions
--max-turns 50 --max-turns 50
--allowedTools "Agent,Glob,Grep,Read,Write,Bash(gh pr diff *),Bash(gh pr view *),Bash(git diff *),Bash(git log *),Bash(git show *),Bash(cat *),Bash(ls *),Bash(wc *),Bash(head *),Bash(tail *),Bash(find *)" --tools "Agent,Glob,Grep,Read,Write,Bash"
# Fallback: if Claude didn't write the review file, extract from execution output # Fallback: if Claude didn't write the review file, extract from execution output
- name: Extract review from execution output (fallback) - name: Extract review from execution output (fallback)