From df7769bea0e12e25718cb810155e972eb6807c73 Mon Sep 17 00:00:00 2001 From: Nathan Heskew Date: Fri, 17 Apr 2026 13:27:19 -0700 Subject: [PATCH] workflow: allow Read, Grep, Glob tools for Claude review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit First live review (PR #36) hit max_turns with 9 permission denials — Claude couldn't read CLAUDE.md or inspect code because the default v1 action tool policy denies everything not explicitly allowed. Adding --allowedTools Read,Grep,Glob gives read-only access sufficient for baseline review. Deliberately omitting Edit/Write/Bash — reviewer shouldn't need to modify files or run shell commands, and the implicit deny list keeps attack surface minimal. If a future review needs git history inspection, add Bash(git:*). Co-Authored-By: Claude Opus 4.7 (1M context) --- .github/workflows/claude-review.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index da0a6e3..ba76db6 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -36,6 +36,7 @@ jobs: claude_args: | --model claude-sonnet-4-6 --max-turns 8 + --allowedTools Read,Grep,Glob prompt: | You are reviewing a pull request on HarperFast/oauth.