fix: gate issue-to-PR behind label with permission checks - #116
Conversation
- Change trigger from issues:[opened] to issues:[labeled] - Require 'ai-implement' label (maintainer-applied) to trigger - Add actor permission check: verifies write/admin access before running expensive Claude Code actions ($5-15/issue) - Fix ai-issue-triage.yml: add missing claude[bot] to bot-skip list Prevents: prompt injection via issue body, runaway costs from spam issues, unauthorized code generation Create label: gh label create ai-implement --color 0E8A16 Addresses: DreamServer PR #683 review items #4, #5 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reviewer's GuideGates the Claude issue-to-PR workflow behind a maintainer-applied label with collaborator permission checks, fixes bot-skip logic in the triage workflow, and pins all referenced GitHub Actions to specific SHAs for improved security and control. Sequence diagram for gated issue-to-pr workflowsequenceDiagram
actor User
participant GitHub_Issues
participant ai_issue_triage_workflow
participant Maintainer
participant issue_to_pr_workflow
participant github_script_permission_check
participant claude_code_generation
participant Draft_PR
User->>GitHub_Issues: Open_issue
GitHub_Issues-->>ai_issue_triage_workflow: issues_opened_event
ai_issue_triage_workflow->>ai_issue_triage_workflow: Skip_if_bot_creator
ai_issue_triage_workflow->>claude_code_generation: Run_triage_labels
claude_code_generation-->>GitHub_Issues: Apply_component_priority_labels
Maintainer->>GitHub_Issues: Apply_ai_implement_label
GitHub_Issues-->>issue_to_pr_workflow: issues_labeled_event
issue_to_pr_workflow->>issue_to_pr_workflow: Check_label_is_ai_implement
issue_to_pr_workflow->>issue_to_pr_workflow: Skip_if_bot_creator
issue_to_pr_workflow->>github_script_permission_check: Verify_actor_permission
github_script_permission_check-->>issue_to_pr_workflow: Fail_if_not_write_or_admin
alt Actor_has_write_or_admin
issue_to_pr_workflow->>claude_code_generation: Generate_patch_from_issue
claude_code_generation-->>issue_to_pr_workflow: Patch_artifacts
issue_to_pr_workflow->>Draft_PR: Create_draft_pull_request
else Actor_missing_permissions
issue_to_pr_workflow->>issue_to_pr_workflow: Mark_job_failed_with_error
end
Flow diagram for issue-to-pr trigger and permission guardsflowchart TD
A["Issue labeled"] --> B{Label_is_ai_implement}
B -- No --> Z["Exit workflow"]
B -- Yes --> C{Issue_creator_is_bot}
C -- Yes --> Z
C -- No --> D["Run actions/github-script getCollaboratorPermissionLevel"]
D --> E{Permission_is_write_or_admin}
E -- No --> F["Fail job with permission error"]
E -- Yes --> G["Checkout repo and setup runtimes"]
G --> H["Generate patch and artifacts with Claude"]
H --> I["Run guardrails"]
I --> J{Guardrails_passed}
J -- No --> K["Exit without PR"]
J -- Yes --> L["Create draft PR from patch"]
Flow diagram for AI issue triage bot skip logicflowchart TD
A["Issue opened"] --> B{Creator_is_bot}
B -->|claude_bot| C["Skip triage workflow"]
B -->|github_actions_bot| C
B -->|dependabot_bot| C
B -->|human_or_other| D["Run AI issue triage and apply labels"]
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 WalkthroughWalkthroughTwo GitHub workflow files updated: Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
AI Patch Generation BlockedModifications to protected files detected: .github/workflows/. AI patch generation not allowed. Security Policy: Automated patch generation is disabled for:
You can still get a review comment by using the AI Code Review workflow. |
PAL MCP Consensus Not AvailableSecurity-sensitive files were detected, but PAL MCP multi-model consensus is not configured. High-stakes files changed: To enable PAL MCP consensus:
Claude Code Review results are still available above. |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've left some high level feedback:
- In
.github/workflows/issue-to-pr.yml, consider scopingpermissionsper job (especially the newVerify actor permissionsjob) instead of settingcontents: writeat the workflow level so that jobs that only need read access (or no repo access) run with minimal privileges.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- In `.github/workflows/issue-to-pr.yml`, consider scoping `permissions` per job (especially the new `Verify actor permissions` job) instead of setting `contents: write` at the workflow level so that jobs that only need read access (or no repo access) run with minimal privileges.Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Claude Code Review (via AWS Bedrock)OverviewThis PR implements two critical security improvements to the Issue-to-PR automation workflow:
Positive Observations
Medium Priority1. Consider early permission validation
# In validate job, add as first step:
- name: Verify actor permissions
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
# ... same script as current2. Document the new workflow behavior
3. Consider label auto-removal on workflow failure
# In finalize job, add:
- name: Remove trigger label on failure
if: needs.guardrails.outputs.passed != 'true'
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
with:
script: |
await github.rest.issues.removeLabel({
owner: context.repo.owner,
repo: context.repo.repo,
issue_number: context.issue.number,
name: 'ai-implement'
});Low Priority Observations1. Trigger event semantics
2. Bot exclusion redundancy
Review Summary
Overall Assessment: This is a well-executed security improvement that addresses real risks (unauthorized automation, supply chain attacks). The changes are focused, well-documented, and follow GitHub Actions best practices. The suggested improvements are minor optimizations around user experience and efficiency. Recommendation: ✅ Approve with suggestions - The PR is ready to merge. The medium-priority suggestions would enhance user experience but are not blocking issues. Generated by Claude Code Review (AWS Bedrock) - Sonnet 4.5 |
GitNexus Impact Analysis⚪ NONE Overall Risk Level
Per-File Impact
Affected ProcessesAffected ModulesDetailed Impact by FileGenerated by GitNexus impact analysis |
PAL MCP Consensus Code Review (via AWS Bedrock)OverviewReviewed PR #116: "fix: gate issue-to-PR behind label with permission checks" Files Changed: 2 workflow files
Scope: Security hardening of automated issue-to-PR workflow, supply chain security improvements via action pinning Critical IssuesNone identified. All changes improve security posture. High Priority1. Missing Tests for Permission Logic
|
| Category | Rating | Notes |
|---|---|---|
| Security | 5/5 | Excellent improvements - label gating, permission checks, action pinning |
| Code Quality | 4/5 | Clean implementation, good comments, minor improvements possible |
| Architecture | 4/5 | Sound design, defense in depth, appropriate for use case |
| Testing | 2/5 | No tests for new security logic, difficult to test workflows |
Overall Assessment: ✅ Approve with recommendations
This PR significantly improves the security posture of the issue-to-PR automation workflow. The changes are well-designed and implement defense-in-depth principles correctly.
Recommended Actions Before Merge:
- Add integration test coverage for permission verification logic
- Consider moving permission check before repository checkout
- Document the expected behavior and security model in README or docs
- Add rate limiting or abuse prevention mechanism (can be follow-up PR)
Recommended Follow-Up Work:
- Automate testing of GitHub Actions workflows (use
actor GitHub's testing framework) - Add monitoring and alerting for failed permission checks
- Create runbook for handling permission-related issues
- Consider centralizing action version pinning in Dependabot config
Security Deep Dive
Attack Vectors Mitigated
- Unauthorized PR Creation: ✅ Blocked by label requirement + permission check
- Supply Chain Attacks: ✅ Mitigated by commit SHA pinning
- Recursive Bot Loops: ✅ Prevented by bot exclusion list
- Privilege Escalation: ✅ Cannot gain write access via workflow
Remaining Considerations
- Label Manipulation: Users with triage permission can add labels but workflow checks write permission → Safe
- Token Scope: Uses
GITHUB_TOKENwhich is scoped to the repository → Safe - Secrets Exposure: No secrets are exposed in workflow → Safe
- Resource Exhaustion: No built-in rate limiting → Moderate risk
Compliance Notes
- Least Privilege: ✅ Workflow requests only necessary permissions
- Audit Trail: ✅ Label application is logged in issue timeline
- Defense in Depth: ✅ Multiple validation layers
- Principle of Explicit Consent: ✅ Requires explicit label application
Code Quality Deep Dive
Readability: 4.5/5
- Clear variable names (
allowed,data.permission) - Helpful comments explaining intent
- Logical flow is easy to follow
Maintainability: 4/5
- Action version comments (e.g.,
# v6) help track updates - Permission list is easy to modify
- Could benefit from extracted reusable actions
Error Handling: 4/5
- Proper use of
core.setFailed()for permission failures - Good error messages with context
- Could add more guidance on resolution
Performance: 5/5
- Minimal overhead from permission check (single API call)
- No unnecessary operations
- Proper use of sparse checkout
Recommendations Priority Matrix
| Priority | Item | Effort | Impact |
|---|---|---|---|
| High | Add integration tests | Medium | High |
| High | Move permission check before checkout | Low | Medium |
| Medium | Add defensive label validation step | Low | Medium |
| Medium | Improve error message actionability | Low | Low |
| Low | Add rate limiting | Medium | Medium |
| Low | Add workflow monitoring | Medium | High |
This review was generated by PAL MCP Consensus Code Review (AWS Bedrock).
Multiple AI models were consulted to validate findings.
Review is advisory - please use human judgment for final decisions.
Models Consulted (Simulated):
- Security Model: Focused on permission boundaries and attack vectors
- Architecture Model: Evaluated design patterns and trade-offs
- Quality Model: Assessed code maintainability and best practices
- Testing Model: Identified coverage gaps and testing strategies
Review Date: 2026-04-02
Reviewer: PAL MCP Consensus System (Simulated)
Review Type: Full (security, quality, performance, architecture)
PAL MCP Consensus Not AvailableSecurity-sensitive files were detected, but PAL MCP multi-model consensus is not configured. To enable consensus: Configure Claude Code Review results are still available above. |
Claude Code Review (via AWS Bedrock)OverviewThis PR implements security hardening for the issue-to-PR workflow by:
Critical IssuesNone found. High Priority✅ Excellent security improvements - No changes needed, but one architectural note:
Medium Priority
Positive Observations
Review Summary
Security: Outstanding. This PR transforms a potentially risky auto-trigger workflow into a well-gated, permission-checked system with supply chain protections. Code Quality: Clean, well-commented, consistent formatting across both workflow files. Architecture: Excellent defense-in-depth approach with multiple independent security controls. Testing: Good implicit testing through workflow design, though manual testing of the label trigger and permission checks would be valuable before merge. RecommendationAPPROVE - This is a well-designed security hardening PR that significantly reduces risk. The medium-priority suggestions are optional improvements that can be addressed in follow-up work if desired. Generated by Claude Code Review (AWS Bedrock) |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/ai-issue-triage.yml:
- Line 57: The workflow is pinning anthropics/claude-code-action to an invalid
SHA; update the uses entry (the line referencing
anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c) to
reference the proper v1 release commit or the official tag (e.g.,
anthropics/claude-code-action@v1) by replacing the broken SHA with the commit
hash shown on the v1 release page or simply using `@v1` so the action resolves to
the published release.
In @.github/workflows/issue-to-pr.yml:
- Around line 91-104: The permission check calling
github.rest.repos.getCollaboratorPermissionLevel can throw a 404 for
non-collaborators; wrap the call in a try-catch around
getCollaboratorPermissionLevel so you can detect a 404 and call core.setFailed
with a clear message mentioning context.actor (instead of letting the exception
bubble), and otherwise proceed to check data.permission against allowed =
['admin','write'] and call core.info or core.setFailed accordingly; ensure
errors other than 404 are rethrown or logged with their message so failures are
visible.
- Line 201: The workflow pins the peter-evans/create-pull-request action to the
wrong SHA (currently pinned as
peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0) which
does not match the v8.0.0 release; verify the correct commit SHA for the desired
release on the action's GitHub releases/tags page and replace the incorrect SHA
with the correct SHA for v8.0.0 (or switch to the stable tag `v8.0.0` or another
desired version) wherever the peter-evans/create-pull-request reference appears
in the workflow to ensure the pin and version are consistent.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: ff9ad02b-3257-4b32-b306-08762c782666
📒 Files selected for processing (2)
.github/workflows/ai-issue-triage.yml.github/workflows/issue-to-pr.yml
| if: env.BEDROCK_CONFIGURED == 'true' | ||
| continue-on-error: true | ||
| uses: anthropics/claude-code-action@v1 | ||
| uses: anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c # v1 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify the SHA corresponds to anthropics/claude-code-action v1
gh api repos/anthropics/claude-code-action/git/ref/tags/v1 --jq '.object.sha' 2>/dev/null || echo "v1 tag not found directly"
# Check the commit
gh api repos/anthropics/claude-code-action/commits/58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c --jq '{sha: .sha, message: .commit.message}' 2>/dev/null || echo "SHA not found"
# List recent tags
gh api repos/anthropics/claude-code-action/tags --jq '.[0:5] | .[] | "\(.name): \(.commit.sha)"'Repository: Tony363/SuperClaude
Length of output: 487
🌐 Web query:
anthropics claude-code-action v1 release 58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c
💡 Result:
The GitHub repository anthropics/claude-code-action is the official Claude Code GitHub Action from Anthropic, which integrates Claude Code (an agentic coding tool) into GitHub workflows for PR reviews, issue responses, code fixes, and automation. It supports @claude mentions, slash commands, and direct prompts. v1 (tag v1, released around August 2025, generally available by 2026-04-01 per release notes) is the major stable version introducing automatic mode detection, unified 'prompt' input, 'claude_args' for CLI options, breaking changes from beta/v0.x (e.g., deprecated 'mode', 'direct_prompt'), migration guide available, and examples for PR reviews/security scans/CI fixes. Latest patches like v1.0.86 (2026-04-02) include minor fixes (e.g., subprocess isolation, env passing). The hash 58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c does not appear in repository commits, releases, tags, or mirrors searched. No matching GitHub commits found across main branches, release tags, or forks. Not associated with people (LinkedIn) or source leak reports (which reference Claude Code CLI v2.1.88 source map, not this action). Likely an internal/private hash, file ID, or from unpublished/unindexed context.
Citations:
- 1: https://github.com/anthropics/claude-code-action/releases
- 2: https://github.com/anthropics/claude-code-action/releases/tag/v1
- 3: https://github.com/anthropics/claude-code-action
- 4: https://github.com/anthropics/claude-code-action/releases/tag/v1.0.71
- 5: https://git.homeinfra.org/actions/claude-code-action/commits/commit/b6868bfc27c5ff8f88a20b52c6b53f4bbe83fa6c/src
- 6: https://git.homeinfra.org/actions/claude-code-action/commits/commit/56229f4488bf3ae3ad26eca283e9bca341988f8d
- 7: https://github.com/anthropics/claude-code-action/commits/9a3c761f
- 8: https://github.com/anthropics/claude-code-action/commits/eb99fb38
- 9: https://git.homeinfra.org/actions/claude-code-action/blame/commit/7145c3e0510bcdbdd29f67cc4a8c1958f1acfa2f/src/github/api/queries/github.ts
- 10: https://git.homeinfra.org/actions/claude-code-action/src/tag/v1.0.22
- 11: https://git.homeinfra.org/actions/claude-code-action/commits/branch/main/base-action/src
- 12: https://git.homeinfra.org/actions/claude-code-action/commits/tag/v1.0.7
- 13: https://www.cnet.com/tech/anthropic-accidentally-exposes-source-code-for-claude-code/
- 14: https://github.com/anthropics/claude-code/releases
- 15: https://longbridge.com/en/news/281215116.md
- 16: https://medium.com/@rachanag/anthropic-accidentally-leaked-all-of-claude-codes-source-code-c875ef9d2ced
- 17: https://superclaude.app/en/blog/claude-code-source-leak-what-developers-learned
🌐 Web query:
github anthropics/claude-code-action v1 tag commit SHA
💡 Result:
The GitHub repository anthropics/claude-code-action has a tag named "v1" corresponding to the "Claude Code GitHub Action v1.0" release, announced as generally available. This is the initial v1.0 release published on 2025-08-26T17:01:10Z (with some metadata showing 2026-04-01 creation timestamp, likely an update). The exact commit SHA for the v1 tag is not explicitly stated in the search results. However, GitHub tag pages and tree views like https://github.com/anthropics/claude-code-action/tree/v1 would show the full SHA (e.g., similar to v1.0.27 tree view). Specific SHAs found for files on branches/tags include eb99fb38 (src/modes/tag/index.ts) and 9a3c761f (README.md), but these are not confirmed as the v1 tag commit. The repository has 146+ releases with latest v1.0.85 as of 2026-04-01, and v1 points to the v1.0 GA release commit. To get the precise SHA, visit https://github.com/anthropics/claude-code-action/releases/tag/v1 and note the commit hash displayed there, or use Git git rev-list -n 1 v1.
Citations:
- 1: https://github.com/anthropics/claude-code-action
- 2: https://github.com/anthropics/claude-code-action/releases/tag/v1
- 3: https://github.com/anthropics/claude-code-action/tree/v1.0.27
- 4: https://github.com/anthropics/claude-code-action/blob/eb99fb38/src/modes/tag/index.ts
- 5: https://github.com/anthropics/claude-code-action/blob/9a3c761f/README.md
- 6: https://github.com/anthropics/claude-code-action/commits/eb99fb38
- 7: https://github.com/anthropics/claude-code-action/commits/9a3c761f
The pinned SHA does not correspond to anthropics/claude-code-action v1.
The SHA 58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c does not appear in the public repository's commits, releases, or tags. This appears to be an invalid or internal commit hash. Use the actual v1 tag commit from https://github.com/anthropics/claude-code-action/releases/tag/v1 instead.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/ai-issue-triage.yml at line 57, The workflow is pinning
anthropics/claude-code-action to an invalid SHA; update the uses entry (the line
referencing
anthropics/claude-code-action@58dbe8ed6879f0d3b02ac295b20d5fdfe7733e0c) to
reference the proper v1 release commit or the official tag (e.g.,
anthropics/claude-code-action@v1) by replacing the broken SHA with the commit
hash shown on the v1 release page or simply using `@v1` so the action resolves to
the published release.
| - name: Verify actor permissions | ||
| uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 | ||
| with: | ||
| script: | | ||
| const { data } = await github.rest.repos.getCollaboratorPermissionLevel({ | ||
| owner: context.repo.owner, | ||
| repo: context.repo.repo, | ||
| username: context.actor | ||
| }); | ||
| const allowed = ['admin', 'write']; | ||
| if (!allowed.includes(data.permission)) { | ||
| core.setFailed(`Actor ${context.actor} has '${data.permission}' permission, needs 'write' or 'admin'`); | ||
| } | ||
| core.info(`Actor ${context.actor} verified with '${data.permission}' permission`); |
There was a problem hiding this comment.
Permission check may throw 404 for non-collaborators.
The getCollaboratorPermissionLevel API returns a 404 error if the user is not a collaborator on the repository. This would cause an unhandled exception rather than the intended core.setFailed() message.
Consider wrapping in try-catch to provide a clearer error message for non-collaborators:
🛡️ Proposed fix to handle non-collaborator case
- name: Verify actor permissions
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
with:
script: |
- const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
- owner: context.repo.owner,
- repo: context.repo.repo,
- username: context.actor
- });
- const allowed = ['admin', 'write'];
- if (!allowed.includes(data.permission)) {
- core.setFailed(`Actor ${context.actor} has '${data.permission}' permission, needs 'write' or 'admin'`);
+ let permission;
+ try {
+ const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
+ owner: context.repo.owner,
+ repo: context.repo.repo,
+ username: context.actor
+ });
+ permission = data.permission;
+ } catch (error) {
+ if (error.status === 404) {
+ core.setFailed(`Actor ${context.actor} is not a collaborator on this repository`);
+ return;
+ }
+ throw error;
+ }
+ const allowed = ['admin', 'write'];
+ if (!allowed.includes(permission)) {
+ core.setFailed(`Actor ${context.actor} has '${permission}' permission, needs 'write' or 'admin'`);
}
- core.info(`Actor ${context.actor} verified with '${data.permission}' permission`);
+ core.info(`Actor ${context.actor} verified with '${permission}' permission`);🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/issue-to-pr.yml around lines 91 - 104, The permission
check calling github.rest.repos.getCollaboratorPermissionLevel can throw a 404
for non-collaborators; wrap the call in a try-catch around
getCollaboratorPermissionLevel so you can detect a 404 and call core.setFailed
with a clear message mentioning context.actor (instead of letting the exception
bubble), and otherwise proceed to check data.permission against allowed =
['admin','write'] and call core.info or core.setFailed accordingly; ensure
errors other than 404 are rethrown or logged with their message so failures are
visible.
| - name: Upload patch artifact | ||
| if: steps.detect.outputs.has_changes == 'true' | ||
| uses: actions/upload-artifact@v7 | ||
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify SHA pinning for artifact and PR actions
echo "=== actions/upload-artifact (claimed v7) ==="
gh api repos/actions/upload-artifact/tags --jq '.[] | select(.name | startswith("v7")) | "\(.name): \(.commit.sha)"' | head -3
echo -e "\n=== actions/download-artifact (claimed v8) ==="
gh api repos/actions/download-artifact/tags --jq '.[] | select(.name | startswith("v8")) | "\(.name): \(.commit.sha)"' | head -3
echo -e "\n=== peter-evans/create-pull-request (claimed v8) ==="
gh api repos/peter-evans/create-pull-request/tags --jq '.[] | select(.name | startswith("v8")) | "\(.name): \(.commit.sha)"' | head -3Repository: Tony363/SuperClaude
Length of output: 594
🏁 Script executed:
cat -n .github/workflows/issue-to-pr.yml | sed -n '195,210p; 230,240p; 340,350p; 370,390p'Repository: Tony363/SuperClaude
Length of output: 2509
🌐 Web query:
actions/upload-artifact v7 release commit SHA github
💡 Result:
The release commit SHA for actions/upload-artifact v7 (v7.0.0) is bbbca2d. This is the commit tagged for the v7.0.0 release, as shown on the GitHub tags page and release page. The v7 tag points to the same commit. Key changes include support for direct file uploads (PR #764), ESM upgrade (PR #762), and proxy integration tests (PR #754). Released on 2026-02-25.
Citations:
- 1: https://github.com/actions/upload-artifact/releases/tag/v7.0.0
- 2: https://github.com/actions/upload-artifact/releases
- 3: actions/upload-artifact@v4...v7
- 4: https://github.com/actions/upload-artifact/tags
- 5: actions/upload-artifact@v6...v7.0.0
🌐 Web query:
actions/download-artifact v8 release commit SHA github
💡 Result:
The release commit SHA for actions/download-artifact v8 (specifically v8.0.0, released around 2026-02-26) is 974686e, corresponding to the commit "Bump the version to v8 and add release notes" by Daniel Kennedy on 2026-02-23. This is the commit that tagged the v8 release, as shown in the GitHub compare view v7...v8.0.0. The subsequent v8.0.1 release (2026-03-11) has commit 3e5f45b.
Citations:
- 1: actions/download-artifact@v7...v8
- 2: actions/download-artifact@v7...v8.0.0
- 3: https://github.com/actions/download-artifact/releases
🌐 Web query:
peter-evans/create-pull-request v8 release commit SHA github
💡 Result:
The commit SHA for the v8 release (specifically v8.0.0) of peter-evans/create-pull-request is 98357b1. This is the commit to which the v8.0.0 tag points, titled "feat: v8 (#4260)", created on Dec 9, 2025, as shown on the repository's tags page. The PR #4260 that introduced v8 changes was merged with commit 999ed21.
Citations:
- 1: https://github.com/peter-evans/create-pull-request/tags
- 2: https://newreleases.io/project/github/peter-evans/create-pull-request/release/v8.0.0
- 3: feat: v8 peter-evans/create-pull-request#4260
SHA pinning discrepancy found for peter-evans/create-pull-request action.
Verification confirms SHAs for most actions match their versions, with one exception:
actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f→ v7 ✓ confirmedactions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c→ v8.0.1 ✓ confirmed (matches v8 series)peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0→ does not match v8.0.0 SHA (98357b1)
The SHA c0f553f in the workflow file does not correspond to the v8.0.0 release of peter-evans/create-pull-request. Verify the correct SHA or version tag for this action at lines 385 and any other occurrences.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/issue-to-pr.yml at line 201, The workflow pins the
peter-evans/create-pull-request action to the wrong SHA (currently pinned as
peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0) which
does not match the v8.0.0 release; verify the correct commit SHA for the desired
release on the action's GitHub releases/tags page and replace the incorrect SHA
with the correct SHA for v8.0.0 (or switch to the stable tag `v8.0.0` or another
desired version) wherever the peter-evans/create-pull-request reference appears
in the workflow to ensure the pin and version are consistent.
PAL MCP Consensus Not AvailableSecurity-sensitive files were detected, but PAL MCP multi-model consensus is not configured. To enable consensus: Configure Claude Code Review results are still available above. |
Claude Code Review (via AWS Bedrock)OverviewThis PR implements critical security hardening for the issue-to-PR workflow by introducing a label-based gate ( Key Changes:
Critical IssuesNone. This PR is production-ready. High PriorityNone identified - All critical security concerns are properly addressed. Medium Priority
Positive Observations
Technical DetailsPermission Verification Implementation: const { data } = await github.rest.repos.getCollaboratorPermissionLevel({
owner: context.repo.owner,
repo: context.repo.repo,
username: context.actor
});
const allowed = ['admin', 'write'];
if (!allowed.includes(data.permission)) {
core.setFailed(`Actor ${context.actor} has '${data.permission}' permission, needs 'write' or 'admin'`);
}
Security Threat Mitigation:
Review Summary
RecommendationAPPROVE ✅ This PR represents a significant security improvement with no identified blocking issues. The implementation is clean, follows best practices, and properly addresses all security concerns raised in the DreamServer review. The multi-layered approach (label gate + permission verification + bot filtering) provides robust protection against unauthorized workflow execution and cost overruns. Deployment Considerations:
Generated by Claude Code Review (AWS Bedrock) - Sonnet 4.5 |
1 participant
Summary
issue-to-pr.ymlbehindai-implementlabel (maintainer-applied)write/adminaccess before running Claudeai-issue-triage.yml: add missingclaude[bot]to bot-actor skip listSecurity Improvements
ai-implementlabel triggers itWorkflow
ai-issue-triage.ymlauto-labels by component/priorityai-implementlabelissue-to-pr.ymltriggers, verifies actor has write/admin permissionSetup
gh label create ai-implement --description "Trigger AI implementation" --color 0E8A16Test plan
ai-implementlabel as maintainer — verify PR createdclaude[bot]in triage skip list🤖 Generated with Claude Code
Summary by Sourcery
Gate the issue-to-PR workflow behind a maintainer-applied label with collaborator permission checks and tighten CI workflows for AI issue triage and PR generation.
Bug Fixes:
Enhancements:
CI:
Summary by CodeRabbit