From ac7b324d4989883c7a8e92030891e51bfc040cc3 Mon Sep 17 00:00:00 2001
From: kaitranntt <kaitran.ntt@gmail.com>
Date: Wed, 14 Jan 2026 13:31:18 -0500
Subject: [PATCH] fix(ci): expand ai-review allowedTools to prevent token waste

- Add more allowed bash patterns: gh issue view, gh api, git commands
- Add base tools: Edit, LS for better flexibility
- Update prompt to write pr_review.md in working dir (not /tmp/)
- Add step to Read before Write to avoid security block
- Add explicit rules about avoiding shell operators (||, &&, <<)
- Allow rm pr_review.md for cleanup

Previous run had 9 tool rejections wasting ~5000 tokens due to:
- gh issue view not allowed (only gh pr view was)
- /tmp/ outside working directory
- Write without Read blocked
- Complex shell operators blocked
---
 .github/workflows/ai-review.yml | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 18fee2e4..518904f8 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -160,15 +160,19 @@ jobs:
             ## IMPORTANT: Posting the Review
             After completing your analysis, post the review as a PR comment.
 
-            REQUIRED METHOD (use Write tool + --body-file):
-            1. Write your review to /tmp/pr_review.md using the Write tool
-            2. Post with: gh pr comment ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} --body-file /tmp/pr_review.md
+            STEP 1: First, use the Read tool to check if pr_review.md exists (it may not exist yet, that's OK)
+            STEP 2: Use the Write tool to write your review to pr_review.md in the current working directory
+            STEP 3: Post with: gh pr comment ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} --body-file pr_review.md
 
-            DO NOT use inline --body with multiline content - it will fail pattern matching.
+            IMPORTANT RULES:
+            - Write to pr_review.md (in working directory), NOT /tmp/pr_review.md
+            - Do NOT use shell operators like || or && in bash commands
+            - Do NOT use heredoc (<<) syntax in bash commands
+            - Use simple, single-purpose bash commands only
 
           claude_args: |
             --model ${{ env.REVIEW_MODEL }}
-            --allowedTools "Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Bash(echo *),Write,Read,Glob,Grep"
+            --allowedTools "Edit,Glob,Grep,LS,Read,Write,Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Bash(gh issue view *),Bash(gh api *),Bash(git diff *),Bash(git log *),Bash(git status *),Bash(cat *),Bash(ls *),Bash(rm pr_review.md)"
         continue-on-error: true
 
       - name: Add success reaction