mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-01-22 22:44:13 +08:00
0085208689
SECURITY FIX: Addresses authorization_bypass vulnerability (LOW severity) The allowed_non_write_users='*' configuration previously bypassed write permission checks for all users with only a warning. This created a security misconfiguration risk. Changes: - Added new input 'bypass_write_permission_check_acknowledgment' required when using wildcard (*) - Modified checkWritePermissions() to throw error if wildcard used without explicit acknowledgment flag - Updated all documentation (security.md, usage.md) with new requirement - Updated example workflows to include acknowledgment flag - Added tests for new validation behavior This prevents accidental security misconfigurations while maintaining the feature for intentional use cases like issue triage workflows. Affected file: src/github/validation/permissions.ts:27 Category: authorization_bypass Severity: LOW
31 lines
1.0 KiB
YAML
31 lines
1.0 KiB
YAML
name: Claude Issue Triage
|
|
description: Run Claude Code for issue triage in GitHub Actions
|
|
on:
|
|
issues:
|
|
types: [opened]
|
|
|
|
jobs:
|
|
triage-issue:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: read
|
|
issues: write
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Run Claude Code for Issue Triage
|
|
uses: anthropics/claude-code-action@v1
|
|
with:
|
|
# NOTE: /label-issue here requires a .claude/commands/label-issue.md file in your repo (see this repo's .claude directory for an example)
|
|
prompt: "/label-issue REPO: ${{ github.repository }} ISSUE_NUMBER${{ github.event.issue.number }}"
|
|
|
|
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
|
|
allowed_non_write_users: "*" # Required for issue triage workflow, if users without repo write access create issues
|
|
bypass_write_permission_check_acknowledgment: true # Required when using wildcard
|
|
github_token: ${{ secrets.GITHUB_TOKEN }}
|