Louis Erbkamm 4772d2a27e ci: harden duplicate finder by sandboxing tools ...

The action denied all gh/Bash calls in CI (no allowlist), so the bot never
commented. Lock tools to two wrapper scripts via --allowedTools: a read-only gh
wrapper (issue view/list, search issues) and a fixed-format comment poster that
reads the target issue from the event payload. This both unblocks the bot and
contains prompt-injection — a hijacked prompt can't run arbitrary commands,
exfiltrate the token, or post arbitrary text. Also passes GH_TOKEN so the
scripts' gh calls are authenticated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-05-31 13:45:37 +02:00

..

comment-on-duplicates.sh

ci: harden duplicate finder by sandboxing tools

2026-05-31 13:45:37 +02:00

dedupe-gh.sh

ci: harden duplicate finder by sandboxing tools

2026-05-31 13:45:37 +02:00