Temporarily enable show_full_output on claude-review (diagnostic) - #93
Merged
Conversation
permission_denials_count dropped from 17 to 1 after the allowed-tools fix, but the review still isn't posted (still zero comments/reviews on same-repo PRs). The action hides Claude's tool-call stream by default, so there's no way to see which specific call the remaining denial is from the log alone. Enable verbose output to capture it, then revert this once diagnosed.
Contributor
|
This was referenced Aug 1, 2026
d-morrison
pushed a commit
to imelainew/ucd-serg.github.io
that referenced
this pull request
Aug 1, 2026
The previous claude_args only allowlisted the final posting step (gh pr comment + the inline-comment MCP tool), on the assumption those were the only calls that mattered. The verbose log from UCD-SERG#93 (commit 644d3f4, job 91330470808) showed otherwise: claude_args replaces the effective tool allowlist rather than adding to it, so the narrower list also denied gh pr diff, gh pr view, and other calls the plugin's own steps make to gather context before it ever reaches the posting step - it never even attempted gh pr comment or the inline tool. Replace the list with the code-review plugin's own declared allowed-tools (plugins/code-review/commands/code-review.md's frontmatter in anthropics/claude-code) so its own steps aren't blocked.
This was referenced Aug 1, 2026
d-morrison
added a commit
to imelainew/ucd-serg.github.io
that referenced
this pull request
Aug 1, 2026
The code-review plugin gates all posting on a --comment argument: "If --comment argument was NOT provided, stop here. Do not post any GitHub comments." (step 7 of plugins/code-review/commands/code-review.md in anthropics/claude-code.) We have never passed it, so every review this repo has run has been working as designed -- reviewing, printing to the job log, and posting nothing behind a green check. claude has zero review comments across UCD-SERG#78, UCD-SERG#79, UCD-SERG#80, UCD-SERG#86, UCD-SERG#87, UCD-SERG#92, UCD-SERG#93 and UCD-SERG#94. This was not a permissions problem. UCD-SERG#91's pull-requests: write and UCD-SERG#92/UCD-SERG#94's allowlist work were treating a symptom. Closes UCD-SERG#96 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HMmB6db4xpbuqcqaQKArZb
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
permission_denials_countfrom 17 → 1 (confirmed on PR #87, run 30684616369), but the review still isn't posted — stillNo buffered inline commentsand zeroclaudecomments/reviews on the PR.claude-code-actionhides Claude's detailed tool-call stream by default ("full output hidden for security"), so there's no way to see which specific call the remaining single denial corresponds to from the log alone — only the count.show_full_output: trueso the next run's log reveals the exact blocked tool call, so the actual fix (extending--allowed-toolscorrectly) can be targeted instead of guessed.This is a diagnostic-only change — intent is to revert
show_full_outputonce the cause is identified.Test plan
claude-reviewon a same-repo PR and inspect the verbose log for the specific denied tool callshow_full_outputback to unset/falseGenerated by Claude Code