From 33ed59e6cdcbecdb5572958a7eee4d9374856272 Mon Sep 17 00:00:00 2001 From: fullstackjam Date: Fri, 10 Jul 2026 19:58:48 +0800 Subject: [PATCH] ci: allowlist the tools Claude review needs to post MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The review workflow ran to success but never posted. #136 granted pull-requests/issues write, which moved it from "0 tool denials, posts nothing" to "1 denial, posts nothing" — the /code-review plugin now tries mcp__github_inline_comment__create_inline_comment but the action's default allowlist blocks it, so the review buffers and is dropped ("No buffered inline comments"). Allowlist that tool plus the gh commands the review reads context with. Auth and the plugin prompt are unchanged — both already work. Note: this can't self-verify — claude-code-action skips its run on any PR that edits its own workflow file (anti-tamper). It activates on the next PR that doesn't touch the workflow. Claude-Session: https://claude.ai/code/session_01HLoiSd2k9EJJ1HPjjDgUgo --- .github/workflows/claude-code-review.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index b5f5b62..ffa6666 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -43,6 +43,12 @@ jobs: plugin_marketplaces: 'https://github.com/anthropics/claude-code.git' plugins: 'code-review@claude-code-plugins' prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}' + # Allowlist the tools the review needs to POST back. Without the + # inline-comment MCP tool the run buffers a review then silently drops + # it: with pull-requests:read it never reaches the tool (0 denials); + # with write it tries and hits the permission gate (1 denial, "No + # buffered inline comments"). The gh commands let it read diff/context. + claude_args: '--allowed-tools mcp__github_inline_comment__create_inline_comment,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh pr comment:*)' # See https://github.com/anthropics/claude-code-action/blob/main/docs/usage.md # or https://code.claude.com/docs/en/cli-reference for available options