CNTRLPLANE-3534: ci: add --allowedTools to address-review-comments workflow

[bryan-cox]

Summary

• Add --allowedTools "Bash Read Write Edit Grep Glob WebFetch" to the Claude Code invocation in the address-review-comments GHA workflow
• Without this flag, Claude prompts for tool permissions in non-interactive mode and exits without doing any work (failed run)
• Matches the same allowlist used by the Prow review-agent job in openshift/release
• Add a "Link to run" step that posts a comment on the PR with a direct link to the workflow run, since issue_comment-triggered runs don't appear in the PR checks tab

Jira

https://redhat.atlassian.net/browse/CNTRLPLANE-3534

Test plan

• Trigger /address-review-comments on a PR after merge and verify Claude processes reviews

🤖 Generated with Claude Code

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@bryan-cox: This pull request explicitly references no jira issue.

Details

In response to this:

Summary

• Add --allowedTools "Bash Read Write Edit Grep Glob WebFetch" to the Claude Code invocation in the address-review-comments GHA workflow
• Without this flag, Claude prompts for tool permissions in non-interactive mode and exits without doing any work (failed run)
• Matches the same allowlist used by the Prow review-agent job in openshift/release

Test plan

• Trigger /address-review-comments on a PR after merge and verify Claude processes reviews

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates the address-review-comments GitHub Actions workflow by adding a "Link to run" step that posts the current workflow run URL to the target PR using gh pr comment, and by changing the claude invocation to include an explicit --allowedTools allowlist ("Bash Read Write Edit Grep Glob WebFetch").

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant gh
  participant PullRequest
  participant Claude
  GitHubActions->>gh: execute `gh pr comment` to post run link
  gh->>PullRequest: add workflow run URL as comment
  GitHubActions->>Claude: call `/utils:address-reviews` with --allowedTools
  Claude->>PullRequest: perform review-addressing actions

Loading

Possibly related PRs

• openshift/hypershift#8621: Sets up the address-reviews command and workflow configuration that this PR further configures by adding explicit tool restrictions.

Suggested reviewers

• sdminonne
• Nirshal

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies a GitHub Actions workflow file, not test code. Contains no Ginkgo test definitions (It(), Describe(), etc.) to assess for dynamic test names.
Test Structure And Quality	✅ Passed	PR modifies only .github/workflows/address-review-comments.yaml, a GitHub Actions workflow file with no Ginkgo test code changes. Test structure check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only GitHub Actions workflow file, not deployment manifests or operator code. No scheduling constraints introduced, so topology-aware check not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR modifies GitHub Actions workflow config only (.github/workflows/address-review-comments.yaml); no Ginkgo e2e tests are added, so IPv6/disconnected network compatibility check does not apply.
No-Weak-Crypto	✅ Passed	The PR adds a GitHub Actions workflow file with no weak cryptography usage: no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB algorithms, custom crypto, or insecure secret comparisons detected.
Container-Privileges	✅ Passed	PR only modifies GitHub Actions workflow file, not K8s/container manifests. Custom check targets container privilege configurations that are not present in this change.
No-Sensitive-Data-In-Logs	✅ Passed	Workflow uses secure practices: curl with -s flag silences token output, gh CLI masks tokens in logs, outputs contain only non-sensitive data (branch, repo), and environment variables are not logged.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding the --allowedTools flag to the address-review-comments workflow to restrict available tools for Claude Code execution.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/address-review-comments.yaml:
- Line 71: The workflow step invoking the Claude agent for
"/utils:address-reviews" currently grants high-risk tools via the --allowedTools
flag (notably "Bash" and "WebFetch"); tighten the toolset to least privilege by
removing "Bash" and "WebFetch" and only include the minimal tools that the
/utils:address-reviews action actually needs (e.g., keep "Read", "Write",
"Edit", "Grep", "Glob" if those are required), update the command string that
contains --allowedTools accordingly, and ensure no unnecessary network/shell
capabilities are granted (so the claude -p "/utils:address-reviews $PR_NUMBER"
invocation no longer exposes shell or web access).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e60b4831-500c-4236-9052-15d029ec305b

📥 Commits

Reviewing files that changed from the base of the PR and between 9f16502 and 31c54d5.

📒 Files selected for processing (1)

• .github/workflows/address-review-comments.yaml

[coderabbitai]

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Restrict high-risk Claude tools to reduce prompt-injection blast radius.

Allowing both Bash and WebFetch for an agent processing PR review content creates a direct exfiltration path if prompt-injected (the step also exposes GH_TOKEN). Please tighten --allowedTools to the minimum set required for /utils:address-reviews (avoid network/shell unless strictly necessary).

Suggested hardening

-          claude -p "/utils:address-reviews $PR_NUMBER" --model claude-opus-4-6 --max-turns 100 --allowedTools "Bash Read Write Edit Grep Glob WebFetch"
+          claude -p "/utils:address-reviews $PR_NUMBER" --model claude-opus-4-6 --max-turns 100 --allowedTools "Read Write Edit Grep Glob"

As per coding guidelines, "Agentic CI actions: audit for prompt injection via issue/PR title/body flowing into LLM prompts" and "Least privilege: minimize GITHUB_TOKEN permissions".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/address-review-comments.yaml at line 71, The workflow step
invoking the Claude agent for "/utils:address-reviews" currently grants
high-risk tools via the --allowedTools flag (notably "Bash" and "WebFetch");
tighten the toolset to least privilege by removing "Bash" and "WebFetch" and
only include the minimal tools that the /utils:address-reviews action actually
needs (e.g., keep "Read", "Write", "Edit", "Grep", "Glob" if those are
required), update the command string that contains --allowedTools accordingly,
and ensure no unnecessary network/shell capabilities are granted (so the claude
-p "/utils:address-reviews $PR_NUMBER" invocation no longer exposes shell or web
access).

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@bryan-cox: This pull request references CNTRLPLANE-3534 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Add --allowedTools "Bash Read Write Edit Grep Glob WebFetch" to the Claude Code invocation in the address-review-comments GHA workflow
• Without this flag, Claude prompts for tool permissions in non-interactive mode and exits without doing any work (failed run)
• Matches the same allowlist used by the Prow review-agent job in openshift/release
• Add a "Link to run" step that posts a comment on the PR with a direct link to the workflow run, since issue_comment-triggered runs don't appear in the PR checks tab

Jira

https://redhat.atlassian.net/browse/CNTRLPLANE-3534

Test plan

• Trigger /address-review-comments on a PR after merge and verify Claude processes reviews

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[bryan-cox]

/test security

[bryan-cox]

/verified later @bryan-cox

[openshift-ci-robot]

@bryan-cox: This PR has been marked to be verified later by @bryan-cox.

Details

In response to this:

/verified later @bryan-cox

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[csrwng]

/lgtm

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.