fix(workflows): bump claude-code-action to v1.0.185, quote tool lists - #559
fix(workflows): bump claude-code-action to v1.0.185, quote tool lists#559wkoutre wants to merge 7 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
● Reviewed · against Note Approved — four doc nits on the tool-grant examples; the pin bump itself is verified end to end. Bumps AssessmentThe functional surface is complete: Suggestions4 non-blocking items
Iteration history · 7 reviews2026-08-10 16:27 UTC · ✅ approved · 1 finding ·
|
📚 Documentation Check ✅Verdict: Passed No files under packages/plugins/ were touched, so the mandatory plugin version-bump gate does not apply. No CLAUDE.md or README needs updating for these changes. One informational, non-blocking inconsistency remains. Test minimal call to isolate schema error. Suggestions (1)
🤖 Generated by Claude Documentation Validator | Mode: |
github-actions
Bot
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
…ter arg parser v1.0.183 escapes () before shell-quote tokenization, so unquoted grants containing a space (e.g. Bash(npm run:*)) now fragment into rules that match nothing instead of being read as one token. Quote each affected --allowedTools/--allowedTools expansion, matching the existing --system-prompt "$VAR" convention already used in _claude-main.yml. Addresses review feedback on PR #559.
|
@request-claude-review Fixed. v1.0.183 now escapes
Left the |
![semgrep-code-uniswap[bot]](https://avatars.githubusercontent.com/u/36115574?s=60&v=4){kind=small}
github-actions
Bot
changed the title
|
↻ Reviewing now · view run ↗ This comment will update when the review completes. Findings will appear in the sticky summary above. |
|
Refreshed pin to |
github-actions
Bot
changed the title
- Quote --disallowedTools in _claude-main.yml's arg-builder (line 417), matching the --allowedTools quoting already applied on the line above. Unquoted, a caller's Bash(git push:*) deny rule fragments on the space inside the parens and silently fails open (v1.0.183+ argument parser). - Fix the stale "Use default model (claude-sonnet-5)" comment in generate-pr-title-description.yml — _generate-pr-metadata.yml's actual default is claude-opus-5. - Replace the broken multi-line allowed_tools: | examples (with comments, blank lines, and non-existent tool names like read_file/list_files) in REUSABLE_WORKFLOWS.md and the workflow examples with the comma-separated form the reusable workflows actually document and parse. The multi-line form, if quoted (as this PR's fix does elsewhere), collapses to a single token that never splits on ",", silently dropping all tool grants. Resolved comments from: github-actions[bot] (Claude PR review) PR: #559
github-actions
Bot
changed the title
There was a problem hiding this comment.
Note
✅ Approved — see full review in the sticky comment ↑
…ntax Addresses the 3 new bot review threads and the docs-check FAIL on 112f60b: - REUSABLE_WORKFLOWS.md's _claude-main.yml reference section (input table + Default Allowed Tools block) still described allowed_tools as a "YAML string" with the legacy read_file/write_file/... tool-name list; switch it to the comma-separated real-tool-name contract used everywhere else in the same doc. - examples/07-claude-main-custom.yml's TOOL CONFIGURATION REFERENCE and TROUBLESHOOTING sections had the same stale fake tool names (read_file/write_file/edit_file/list_files/search_files/search_code); rewrite with the real names (Read/Write/Edit/Grep/Glob/Bash). - Bash prefix-arg grants used the wrong wildcard form (Bash(git log*), Bash(ls*), etc.) instead of the colon form every working grant in the repo actually uses (Bash(git log:*) — see _claude-code-review.yml, _claude-docs-check.yml, _generate-pr-metadata.yml). Fixed in REUSABLE_WORKFLOWS.md, 06-claude-main-basic.yml, and 07-claude-main-custom.yml. Swept the rest of .github/ for any other fake tool names, missing-colon Bash wildcards, or multi-line allowed_tools blocks; none remain.
| # - list_files | ||
| # - Bash(git *) | ||
| # allowed_tools is a comma-separated list (no newlines) | ||
| # allowed_tools: "Read,Glob,Bash(git *)" |
There was a problem hiding this comment.
Bash(git *) isn't a prefix form; without the colon it's an exact match on the literal command git *, so this grants nothing. This is the only allowed_tools guidance in the basic example, and the corrected grants at line 139 of this file already use the colon form.
| # allowed_tools: "Read,Glob,Bash(git *)" | |
| # allowed_tools: "Read,Glob,Bash(git:*)" |
| # - Bash(npm list) # Exact command only | ||
| # - Bash(npm test) # Exact command only | ||
| # - Bash(node --version) # Exact command with specific args | ||
| # - Bash(git *) # All git commands |
There was a problem hiding this comment.
Bash(git *) contradicts the syntax reference four lines up (Bash(command:*)) and matches nothing — a paren body without the trailing :* is an exact command string. Line 259 below already uses the colon form. Lines 294-295 ("e.g., Bash(git *) not Bash(git*)" and "Test with permissive config first (Bash(*))") repeat the same dead forms.
| # - Bash(git *) # All git commands | |
| # - Bash(git:*) # All git commands |
| # All bash commands | ||
| - Bash(*) | ||
| # allowed_tools is a comma-separated list (no newlines) | ||
| allowed_tools: 'Read,Write,Edit,Grep,Glob,Bash' |
There was a problem hiding this comment.
🔵 info · documentation — _claude-main.yml defaults allowed_tools to "" and omits --allowedTools entirely when empty, so the actual default is unrestricted — not this six-tool list. A consumer copying this as "the default" silently drops WebSearch, WebFetch, and the mcp__github__* tools.
|
Refreshed pin to |
| | Input | Required | Default | Description | | ||
| | ------------------------------- | -------- | -------------------------------- | ------------------------------------------------------------------------------------ | | ||
| | `model` | No | `'claude-sonnet-5'` | Claude model to use (Sonnet 5, Opus 5, or Haiku 4.5) | | ||
| | `allowed_tools` | No | (permissive defaults, see below) | Comma-separated list of allowed tools (no newlines) — file operations, bash commands | |
There was a problem hiding this comment.
🔵 info · documentation — the sweep missed .github/workflows/CLAUDE.md:1476: the guide's only _claude-main.yml calling example is allowed_tools: 'read-write', which isn't a tool name. Copied verbatim it becomes --allowedTools "read-write" — one rule matching nothing, zero grants. The git grep for read_file/list_files structurally can't catch this form.
1 participant
Summary
Maintenance pass on Claude Code Action workflows. Applies three classes of edit atomically:
v1.0.183(be7b93b) — see https://github.com/anthropics/claude-code-action/releases/tag/v1.0.1839b405c7(Uniswap/ai-toolkitnextHEAD)haiku→claude-haiku-4-5-20251001opus→claude-opus-5sonnet→claude-sonnet-5Per-file changes
.github/workflows/_claude-code-review.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)anthropics/claude-code-action:787c5a0→be7b93b(v1.0.183).github/workflows/_claude-docs-check.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)anthropics/claude-code-action:787c5a0→be7b93b(v1.0.183).github/workflows/_claude-main.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5.github/workflows/_claude-task-worker.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5claude-opus-4-8→claude-opus-5.github/workflows/_generate-pr-metadata.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)anthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5.github/workflows/_update-action-versions-worker.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183).github/workflows/dev-ai-newsletter.ymlanthropics/claude-code-action:787c5a0→be7b93b(v1.0.183)claude-opus-4-8→claude-opus-5Opened by the
sync-claude-code-actionmaintenance job. The job runs weekly and bumps SHAs + applies known migrations; review the diff before merging.AI-Generated Description
Summary
Weekly
sync-claude-code-actionmaintenance pass, plus the two fixes the bump turned out to require. 11 files, +69 / −178.anthropics/claude-code-action:787c5a0(v1.0.133) →9db594c(v1.0.185) — all 10 pins in the repo. Release notes.claude_argsis tokenized, silently breaking every unquoted grant that contains a space. Without this the bump goes green and degrades.allowed_toolsdocs corrected — the copy-pasteable examples advertised a YAML block-list of tool names the input has never accepted.No input contract, permission, or logic changed. No
packages/plugins/files touched → no plugin version bump applies.Why the quoting fix is load-bearing
v1.0.183 escapes
(and)before handingclaude_argsto shell-quote tokenization. An unquoted grant containing a space therefore splits on whitespace, and because--allowedToolsis variadic both halves are consumed as rules:None of those match anything. The run stays green; the agent quietly loses the grants it was supposed to have and its
git log/git diffcalls start getting denied mid-run. Quoting keeps the value one token, matching the--system-prompt "$VAR"convention used two lines away in_claude-main.yml.4 of the 6 sites were broken on their default path, not hypothetically:
_claude-code-review.yml$ALLOWED_TOOLS)TOOLSarray at L1092_claude-code-review.ymlclaude_args(literal)Bash(npm run:*),Bash(npx nx:*),Bash(bun run:*)_claude-docs-check.ymlBash(git log:*),Bash(git diff:*),Bash(git show:*)_generate-pr-metadata.yml$ALLOWED_TOOLS)TOOLSarray at L868"", so no path in this repo hits them — but an external caller does:_claude-main.yml:412(--allowedTools) and:417(--disallowedTools). The deny-list case matters more, because a fragmented deny list fails open — a caller passingBash(rm -rf:*)would have had it silently discarded._claude-task-worker.yml:606needed no change; it was already quoted.The
allowed_toolsdocs were wrong independently of the bumpallowed_toolsis a comma-separated string ("Read,Grep,Glob,Bash(git status)"), and always has been — see the input description at_claude-main.yml:90. The docs showed a YAML block scalar with#comments and-bullets, naming tools that do not exist (read_file,list_files,search_files,search_code). Copy-pasting any of those examples produced a grant list matching nothing — the same silent-degradation failure mode as the quoting bug, reached a different way.Rewritten in 8 places across
REUSABLE_WORKFLOWS.md,examples/06-claude-main-basic.yml, andexamples/07-claude-main-custom.yml, which accounts for most of the −178. The same pass corrected the Bash arg-wildcard syntax (Bash(git log*)→Bash(git log:*),Bash(*)→Bash) and the stale model comment atgenerate-pr-title-description.yml:52, which claimed the inherited default wasclaude-sonnet-5when_generate-pr-metadata.yml:50defaults toclaude-opus-5.Changes
_claude-code-review.yml_claude-docs-check.yml_claude-main.yml_claude-task-worker.yml_generate-pr-metadata.yml_update-action-versions-worker.ymldev-ai-newsletter.ymlREUSABLE_WORKFLOWS.mdexamples/06-claude-main-basic.ymlexamples/07-claude-main-custom.ymlgenerate-pr-title-description.ymlKnown residuals
_claude-docs-check.yml:1047(auto-fixclaude_args) is the one--allowedToolsleft unquoted. It is not broken — its only Bash grant isBash(git:*), no space — but it now sits in the same file as L686, which was quoted. Adding a space-containing grant there later reintroduces the bug with no signal.examples/still show the old wildcard form (Bash(git *),Bash(*)) at06-claude-main-basic.yml:70and07-claude-main-custom.yml:258,294,295,318. These are explanatory comments rather than copy-pasteableallowed_tools:values, so they were left alone — but they are still inaccurate.Verification
9db594c/v1.0.185.git grepfor787c5a0,be7b93b,v1.0.133, andv1.0.183across.github/returns nothing — no intermediate SHA left behind, nothing stale in the docs. The 2 remaining unpinned mentions are intentional: the prompt doc string at_update-action-versions-worker.yml:274and thegrep/sedpatterns inupdate-claude-code-action.ymlthat drive this job.git grepfor the legacy tool names (read_file,write_file,edit_file,list_files,search_files,search_code) across.github/returns nothing.--allowedTools/--disallowedToolsoccurrences live in the seven_*.ymlreusable workflows; nothing under.github/actions/or.github/scripts/builds one.generate-pr-title-description.yml:47uses a local ref, so this title and description were generated by the patched_generate-pr-metadata.ymlon9db594c, and thegit diff/git grep/git logreads behind the tables above resolved rather than being denied. That exercises L905 — the site with 4 space-containing grants.Not checkable from this runner: the
9db594c↔v1.0.185mapping comes from the sync job (no network access to upstream, so the SHA was not re-verified against the tag), andactionlint/ a YAML parse-check were both blocked by the runner's command policy.Test plan
_generate-pr-metadata.yml— exercised by this PR itself, patched, on9db594c_claude-docs-check.yml— also called locally (claude-docs-check.yml:66), so this PR live-exercises L686, the second demonstrably-broken site. A green docs-check is the confirmation._claude-main.yml— spot-check with an@claudemention on this PR (claude-code.yml:35, local ref). Note this does not cover L412/L417 unlessallowed_tools/disallowed_toolsare passed._claude-code-review.yml— not exercised here. Since refactor(ci): review ai-toolkit's own PRs with @uniswap/review-cli #556 ai-toolkit reviews its own PRs with@uniswap/review-cli, so its 2 pins and both quoting fixes (L1190, L1730) run only in consumer repos. L1190 is on the default review path, so validate against a consumer orUniswap/ai-sandboxbefore this reaches them._update-action-versions-worker.yml/dev-ai-newsletter.yml— not triggered by a PR event; next scheduled or manual run is the real check.Opened by the
sync-claude-code-actionmaintenance job. It runs weekly, bumps SHAs, and applies known migrations — review the diff before merging. The quoting and docs commits were added by hand in response to review feedback; the job did not catch that the bump was breaking.