From e7dca480d313b2227638a3e8a53554b3d28d2c8e Mon Sep 17 00:00:00 2001
From: kaitranntt <kaitran.ntt@gmail.com>
Date: Wed, 14 Jan 2026 10:06:05 -0500
Subject: [PATCH] fix(ci): add Write tool to allowedTools for PR comment
 posting

Root cause: Claude's allowedTools pattern matching is literal string
matching. Multiline content in --body breaks the `Bash(gh pr comment *)`
pattern. The Bash(cat *) pattern only matches reading, not writing with
redirection.

Changes:
- Add Write tool to allowedTools (enables temp file creation)
- Remove Bash(cat *) (not needed, Write replaces it)
- Update prompt to require Write + --body-file pattern
- Explicitly warn against inline --body with multiline content

Tested locally: Successfully posted comment using Write + --body-file
---
 .github/workflows/ai-review.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 284080e4..44e37e3d 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -148,15 +148,17 @@ jobs:
             > 🤖 Reviewed by `${{ env.REVIEW_MODEL }}`
 
             ## IMPORTANT: Posting the Review
-            After completing your analysis, post the review as a PR comment using:
-            ```bash
-            gh pr comment ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} --body "YOUR_REVIEW"
-            ```
-            You may use heredocs, pipes, or --body-file as needed for multi-line content.
+            After completing your analysis, post the review as a PR comment.
+
+            REQUIRED METHOD (use Write tool + --body-file):
+            1. Write your review to /tmp/pr_review.md using the Write tool
+            2. Post with: gh pr comment ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }} --body-file /tmp/pr_review.md
+
+            DO NOT use inline --body with multiline content - it will fail pattern matching.
 
           claude_args: |
             --model ${{ env.REVIEW_MODEL }}
-            --allowedTools "Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Bash(echo *),Bash(cat *),Read,Glob,Grep"
+            --allowedTools "Bash(gh pr comment *),Bash(gh pr diff *),Bash(gh pr view *),Bash(echo *),Write,Read,Glob,Grep"
         continue-on-error: true
 
       - name: Add success reaction