Stop wasting AI-review turns on denied shell commands

[gobetti]

What

Adopts into the reusable review workflow the permission model we've been piloting repo-locally on ht-json and ht-android. Every repo consumes this workflow, so this is the org-wide rollout of that design.

See it running

It's been live on both pilot repos — you can watch real runs and, at the end of each review job, the Post Harden runner egress step reports the egress audit trail (every host the runner contacted):

• ht-android: https://github.com/isapp/ht-android/actions/workflows/claude-review.yml
• ht-json: https://github.com/isapp/ht-json/actions/workflows/claude-review.yml

Why

On large or repetitive PRs the reviewer often ran out of turns and posted no review at all. The main avoidable cause: under the exclusive command allow-list, every shell construct it reached for that wasn't enumerated (find, sed, awk, python, echo, loops) was denied, and in headless CI each denial costs a turn plus a retry — that denial tax, on top of per-file re-analysis, pushed runs past max_turns into error_max_turns. This removes the tax, not the budget: a genuinely undersized max_turns can still exhaust a very large PR, but reviews stop burning turns on denials.

What changed

A full read shell, with the allow-list's other two jobs moved to fitter mechanisms:

• Turn budget: --allowedTools 'Read,Glob,Grep,LS,Bash' — find/sed/awk/python3/pipes/loops just work, so repeated per-file checks batch into one command.
• Scope (no builds/tests): a narrow --disallowedTools deny-list of package managers, build/test runners, and network tools.
• Safety: contents: read (was write); denies on the git add/commit/rm/push commands claude-code-action injects by default (deny beats allow from every source); a step-security/harden-runner egress step in audit mode (egress audit trail + known-bad-endpoint blocking); the ephemeral runner.
• Prompt: environment-constraints section rewritten to match and to encourage batching.

Preserved unchanged: the workflow_call inputs (model, max_turns, timeout_minutes, extra_prompt), the ${{ inputs.extra_prompt }} append point, the rubric, and the instructions. actions/checkout stays at its current pin (@v5); version bumps are a separate per-repo concern.

Safety model

The deny-list and egress audit are defense-in-depth, not the boundary — a deny-list can't fence bash /dev/tcp or python sockets, and audit mode logs novel-host egress rather than blocking it. The real boundary is the trigger model, documented as a hard adoption precondition in the workflow header: consume this only on pull_request, never pull_request_target, and never send secrets to fork PRs — so fork/untrusted PRs get no secrets and the review can't even authenticate. Block-mode egress and OIDC federation (to drop the static ANTHROPIC_API_KEY) are optional future hardening, not part of this change.

Rollout

After this merges, each consuming repo adopts by restoring its claude.yml pull_request trigger and deleting the repo-local pilot claude-review.yml (currently parked on ht-json and ht-android). Repos that already call @main pick it up on their next PR.

Evidence

In a local A/B repro of ht-json's worst-case review (~9,500-line survey PR), the old allow-list completed 0 of 1 runs with 6 denials; this design completed 2 of 3 with 0 denials and identical findings. Since merging on ht-json, real production reviews run clean — success, under the turn cap, 0 permission denials, comment posted under contents: read (26/34/45 turns across three PRs).

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

📝 Auto-filled