Widen claude-code-review's allowedTools to what the plugin actually needs

[jnasbyupgrade]

Widens .github/workflows/claude-code-review.yml's claude_args --allowedTools to the tools the /code-review plugin actually needs — Task for the subagents its steps launch to do the review, TodoWrite for the todo list its Notes require, and the seven Bash(gh ...) subcommands its own allowed-tools frontmatter declares for reading PR data and posting a no-issues summary — and wraps the whole value in double quotes so it survives claude-code-action's shell-quote-based re-tokenization as one token instead of splintering on the spaces inside each Bash(gh ...) entry.

Verification of the actual review behavior is outstanding. Per .github/workflows/CLAUDE.md, a pull_request_target workflow always runs from the base branch's copy of the file, never the PR's own — so this PR's own claude-review check runs master's old, still-broken version and cannot prove anything either way. The tokenization fix below is independently verified (see next section); only "does the plugin's review now actually complete and post findings" remains to be confirmed after merge, on the next real PR.

What was broken and how it's confirmed fixed

The action's allowedTools/allowed-tools inputs are an allowlist, not additive to a sane default: any plugin tool call not named there is silently denied. The previous state of this file granted only mcp__github_inline_comment__create_inline_comment plus the action's baseline read/git-write tools — no Task, no gh subcommand — so the plugin's subagents and its PR-data reads were denied on every run, and the run ended having posted nothing.

The observed SDK allowedTools array on two runs that reported "subtype": "success" without posting a review was exactly: Glob, Grep, LS, Read, mcp__github_comment__update_claude_comment, mcp__github_ci__get_ci_status, mcp__github_ci__get_workflow_run_details, mcp__github_ci__download_job_log, mcp__github_inline_comment__create_inline_comment, Bash(git add:*), Bash(git commit:*), Bash(.../git-push.sh:*), Bash(git rm:*). The code-review plugin's own source (anthropics/claude-code@main, plugins/code-review/commands/code-review.md) declares allowed-tools: Bash(gh issue view:*), Bash(gh search:*), Bash(gh issue list:*), Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*), Bash(gh pr list:*), mcp__github_inline_comment__create_inline_comment, and its numbered steps launch haiku/sonnet/opus subagents (Task) to do the review and validation work — none of that was in the effective allowlist.

claude_args reaches claude-code-action as a bare string that it re-tokenizes with the shell-quote npm package (base-action/src/parse-sdk-options.ts's parseClaudeArgsToExtraArgs, mirrored by src/modes/agent/parse-tools.ts's parseAllowedTools), which splits on whitespace — the spaces inside each Bash(gh ...) entry break it into multiple garbage tokens unless the whole value is one quoted token. Verified directly against the real shell-quote package by reproducing both functions' logic:

Unquoted (the obvious-looking form):

[
  "mcp__github_inline_comment__create_inline_comment",
  "Task",
  "Bash(gh",
  "issue",
  "view:*)",
  "search:*)",
  "list:*)",
  "pr",
  "comment:*)",
  "diff:*)"
]

Quoted (current), parsed from the literal claude_args string read out of the committed YAML:

[
  "mcp__github_inline_comment__create_inline_comment",
  "Task",
  "TodoWrite",
  "Bash(gh issue view:*)",
  "Bash(gh search:*)",
  "Bash(gh issue list:*)",
  "Bash(gh pr comment:*)",
  "Bash(gh pr diff:*)",
  "Bash(gh pr view:*)",
  "Bash(gh pr list:*)"
]

Bash otherwise stays scoped to the pre-existing git write commands (add/commit/push/rm); nothing broader was added, and Task does not widen what a subagent can do — tool permissions are enforced per call regardless of which agent makes it.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 04acb2e1-97cb-42f5-b235-4545df9da09b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Claude finished @jnasbyupgrade's task in 3m 11s —— View job

---

Review: widen claude-code-review's --allowedTools

Note on process: the /code-review plugin skill itself failed to execute in this session (returned an error with no output on two attempts), so this is a manual review rather than the plugin's automated one. I also could not reach the network (gh, WebFetch) from this sandboxed session to independently re-fetch anthropics/claude-code's code-review.md frontmatter and diff it against the tool list added here — so I'm evaluating the change on internal consistency and the evidence already quoted in the PR body, not a fresh fetch of the upstream plugin source.

The change itself looks correct and appropriately scoped:

• The diff (.github/workflows/claude-code-review.yml:195-212) only adds Task and seven Bash(gh ...) entries to the existing claude_args allowlist — no bare Bash, no wildcard beyond the specific gh subcommands, consistent with the PR description's claim that "nothing broader was added."
• All seven gh subcommands (issue view, search, issue list, pr comment, pr diff, pr view, pr list) are read-only or PR-comment operations; even gh pr comment:* is bounded by the job's own GITHUB_TOKEN, which per the surrounding permissions: block is scoped to this repo only, so there's no cross-repo posting risk from that grant.
• Task has no argument-level scoping mechanism (unlike Bash(...)), so granting it bare is the correct/only way to allow subagent use at all — matches the stated rationale that the plugin's steps 1–6 launch haiku/sonnet/opus subagents to do the actual review.
• The new comment block explaining the rationale (run IDs, permission_denials_count, why Task isn't in the plugin's own frontmatter) follows the file's existing comment conventions (---joined clauses, citing concrete evidence rather than assertions) and is genuinely useful for future maintainers trying to debug a similar silent failure.
• YAML is well-formed: the claude_args value stays a single-quoted scalar with no embedded quotes to escape.

One non-blocking maintainability note: plugin_marketplaces tracks upstream anthropics/claude-code's default branch unpinned (per the existing comment above plugins:), so this fix hardcodes today's snapshot of what the code-review plugin needs. If a future upstream change to the plugin's allowed-tools frontmatter adds a new gh subcommand or tool, this exact failure mode (review completes, permission_denials_count climbs, nothing gets posted) could silently reappear with no test to catch the drift. Not something this PR needs to solve, but worth keeping in mind — the two real run IDs cited in the PR body are a good template for how to diagnose it again if it recurs.

No correctness issues found. This is a minimal, well-evidenced, appropriately-scoped fix.

[github-actions]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.