From 0a27c6a12f53dd050dc8104ce8d82e2cb4bcef3f Mon Sep 17 00:00:00 2001 From: kaitranntt Date: Tue, 13 Jan 2026 16:43:27 -0500 Subject: [PATCH] fix(ci): expand allowedTools patterns for flexible comment posting Add Bash(echo *) and Bash(cat *) patterns to allow heredocs and pipes. This gives the AI reviewer flexibility to use any method for posting multi-line review comments while remaining safe (shell-operator aware). --- .github/workflows/ai-review.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml index f95821c1..284080e4 100644 --- a/.github/workflows/ai-review.yml +++ b/.github/workflows/ai-review.yml @@ -148,15 +148,15 @@ jobs: > 🤖 Reviewed by `${{ env.REVIEW_MODEL }}` ## IMPORTANT: Posting the Review - After completing your analysis, post the review as a PR comment. Use this exact pattern: + After completing your analysis, post the review as a PR comment using: ```bash - gh pr comment ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} --body "YOUR_REVIEW_HERE" + gh pr comment ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} --body "YOUR_REVIEW" ``` - For multi-line reviews, escape newlines or use simple string. Do NOT use heredocs, cat, echo, or pipes - just put the content directly in --body quotes. + You may use heredocs, pipes, or --body-file as needed for multi-line content. claude_args: | --model ${{ env.REVIEW_MODEL }} - --allowedTools "Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Read,Glob,Grep" + --allowedTools "Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Bash(echo *),Bash(cat *),Read,Glob,Grep" continue-on-error: true - name: Add success reaction