MHSanaei 5939fda397 fix(ci): let the PR review save its body, and scope the write-check bypass ...

Run 38187893539 reviewed PR #6784 in full but posted nothing: the model's
Write to /tmp/review.md was refused. Claude Code checks file permissions
against Edit(path) rules only and never consults a Write(path) rule, so the
allow rule was dead - and so were the Write(//home/**) and Write(//opt/**)
deny rules meant to keep $GITHUB_ENV out of reach. All three are Edit rules
now; a local headless run confirms Write(path) is refused, Edit(path) lets
the file through, and an Edit deny still blocks a Write under it.

allowed_non_write_users="*" skipped the action's write-permission check for
every actor and warned each run. Only a pull_request_target from a fork
needs it; an `@claude review` requester is already OWNER/MEMBER/COLLABORATOR
and passes the action's own check.

2026-10-12 02:32:55 +02:00

..

claude

perf(tests): copy a migrated template DB instead of migrating per test

2026-09-27 03:04:50 +02:00

ISSUE_TEMPLATE

fix(ci): resync the bot prompts with the repo and close the gaps an audit found

2026-08-17 02:41:21 +02:00

workflows

fix(ci): let the PR review save its body, and scope the write-check bypass

2026-10-12 02:32:55 +02:00

dependabot.yml

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

FUNDING.yml

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

pull_request_template.md

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00