Match claude-review's allowed-tools to the plugin's own frontmatter - #94
Merged
Merged
Conversation
The previous claude_args only allowlisted the final posting step (gh pr comment + the inline-comment MCP tool), on the assumption those were the only calls that mattered. The verbose log from #93 (commit 644d3f4, job 91330470808) showed otherwise: claude_args replaces the effective tool allowlist rather than adding to it, so the narrower list also denied gh pr diff, gh pr view, and other calls the plugin's own steps make to gather context before it ever reaches the posting step - it never even attempted gh pr comment or the inline tool. Replace the list with the code-review plugin's own declared allowed-tools (plugins/code-review/commands/code-review.md's frontmatter in anthropics/claude-code) so its own steps aren't blocked.
2 tasks
Contributor
|
This was referenced Aug 1, 2026
d-morrison
added a commit
to imelainew/ucd-serg.github.io
that referenced
this pull request
Aug 1, 2026
The code-review plugin gates all posting on a --comment argument: "If --comment argument was NOT provided, stop here. Do not post any GitHub comments." (step 7 of plugins/code-review/commands/code-review.md in anthropics/claude-code.) We have never passed it, so every review this repo has run has been working as designed -- reviewing, printing to the job log, and posting nothing behind a green check. claude has zero review comments across UCD-SERG#78, UCD-SERG#79, UCD-SERG#80, UCD-SERG#86, UCD-SERG#87, UCD-SERG#92, UCD-SERG#93 and UCD-SERG#94. This was not a permissions problem. UCD-SERG#91's pull-requests: write and UCD-SERG#92/UCD-SERG#94's allowlist work were treating a symptom. Closes UCD-SERG#96 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01HMmB6db4xpbuqcqaQKArZb
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
show_full_output: truerevealed why the review still wasn't posting despitepermission_denials_countdropping to ~1:claude_args's--allowed-toolsreplaces the effective tool allowlist rather than adding to it.Bash(gh pr comment *)+ the inline-comment tool) denied the plugin's own read-side steps too — the verbose log from run 30685553432 (PR Skip PR preview deploy for fork pull requests #87, commit644d3f4) shows denied calls togh pr diff,gh pr view(via manualgh apiworkarounds),git diff,cat,grep,python3, and a recursiveSkillcall — and zero attempts atgh pr commentor the inline-comment tool at all. The agent never got far enough to post.plugins/code-review/commands/code-review.mdinanthropics/claude-code) rather than relying on an AI-summarized fetch (which is what led to the incomplete list in Allow claude-review to actually post its comment/inline review #92). Its frontmatter declares the full tool set it needs:claude_argsto match that list exactly, and removes Temporarily enable show_full_output on claude-review (diagnostic) #93's temporaryshow_full_output: truenow that it's served its purpose.Test plan
claudereview comment (summary and/or inline) actually appears on a same-repo PR after this merges — this repo's first genuine one, per the historical audit in Restore pull-requests: write for claude-review #91's discussionpermission_denials_countis 0 (or only reflects genuinely out-of-scope calls) in the run's resultGenerated by Claude Code