Skip to content

fix: workflow permission check bypass#23

Merged
EdwardIrby merged 2 commits intomainfrom
fix/workflow-permission-check-bypass
Feb 8, 2026
Merged

fix: workflow permission check bypass#23
EdwardIrby merged 2 commits intomainfrom
fix/workflow-permission-check-bypass

Conversation

@EdwardIrby
Copy link
Member

Summary

  • Fixes the exit 0 permission check bypass in claude-code-review.yml by gating all steps with authorized output flag (closes security: fix workflow permission check bypass #21)
  • Adds PR feedback gathering instructions to Claude review prompt
  • Refactors publish.yml to use major/minor/patch dropdown selector instead of manual version entry
  • Renames .plaited/ to .agents/ across the codebase (package.json, AGENTS.md, symlinks, tests, SKILL.md)
  • Updates install instructions to recommend npx skills add / bunx skills add

Test plan

  • bun run check passes (0 warnings)
  • bun test passes (68/68)
  • Verify publish workflow dropdown renders correctly in GitHub Actions UI
  • Trigger a test PR to verify claude-code-review permission gating

🤖 Generated with Claude Code

- Gate all claude-code-review steps with authorized output flag (closes #21)
- Add PR feedback gathering to review prompt
- Replace manual version input with major/minor/patch selector in publish workflow
- Rename .plaited/ to .agents/ and update all references
- Update install instructions to use npx/bunx skills add

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove scoped package subpath export tests that depended on
@modelcontextprotocol/sdk and update testing rule example to
reference `typescript` instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@EdwardIrby EdwardIrby merged commit 7d86916 into main Feb 8, 2026
1 of 2 checks passed
@EdwardIrby EdwardIrby deleted the fix/workflow-permission-check-bypass branch February 8, 2026 04:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

security: fix workflow permission check bypass

1 participant