feat(docs): add claude review workflow for community PRs#1139
Conversation
just-toby
changed the title
911d730 to
bf434ec
Compare
![semgrep-code-uniswap[bot]](https://avatars.githubusercontent.com/u/36115574?s=60&v=4){kind=small}
| # via --add-dir below, but never the working directory. | ||
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} |
There was a problem hiding this comment.
Workflow triggers on pull_request_target and checks out the PR head. pull_request_target runs with base repository secrets and write permissions. Checking out the PR head places attacker-controlled code in the working directory where any build tool can execute it. Fix: use pull_request instead, or add a fork guard.
✨ Fixed in commit c8dbbba ✨
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | ||
| with: | ||
| ref: ${{ github.event.pull_request.head.sha }} | ||
| path: pr-head | ||
| persist-credentials: false |
There was a problem hiding this comment.
This GitHub Actions workflow file uses pull_request_target and checks out code from the incoming pull request. When using pull_request_target, the Action runs in the context of the target repository, which includes access to all repository secrets. Normally, this is safe because the Action only runs code from the target repository, not the incoming PR. However, by checking out the incoming PR code, you're now using the incoming code for the rest of the action. You may be inadvertently executing arbitrary code from the incoming PR with access to repository secrets, which would let an attacker steal repository secrets. This normally happens by running build scripts (e.g., npm build and make) or dependency installation scripts (e.g., python setup.py install). Audit your workflow file to make sure no code from the incoming PR is executed. Please see https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ for additional mitigations.
🧁 Fixed in commit c8dbbba 🧁
Uses the official anthropics/claude-code-action with fork-safe pull_request_target handling. Replaces the earlier review-cli port, which security flagged as unsafe to expose on a public repo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
bf434ec to
c8dbbba
Compare
| # so no attacker-controlled file ever touches the runner's disk. This is | ||
| # the action's preferred pattern for privileged triggers: | ||
| # https://github.com/anthropics/claude-code-action/blob/main/docs/security.md | ||
| # - Claude's tools are restricted to reading the diff and posting comments. |
| REPO: ${{ github.repository }} | ||
| PR NUMBER: ${{ github.event.pull_request.number }} | ||
|
|
||
| You are reviewing a pull request to the Uniswap documentation site |
There was a problem hiding this comment.
After #1138 this repo becomes a content mirror of the dev portal, which renders it with fumadocs (fumadocs-mdx). Suggest updating the review prompt to check the conventions that actually break our build:
Frontmatter: every .mdx/.md page starts with YAML frontmatter with title (required) and ideally description. Missing or malformed frontmatter fails the portal build
Navigation: new pages must be added to their section's meta.json (pages array, filenames without the extension), otherwise they don't show up in the sidebar
MDX parsing: literal {...} outside fenced code blocks is parsed as a JSX expression and breaks the build. Same for unclosed JSX tags
There was a problem hiding this comment.
2 participants
Description
Adds an automatic Claude review for PRs to this repo, using the official
anthropics/claude-code-action(pinned to v1.0.175 by SHA). One workflow file, no internal dependencies.How it works:
Fork safety (this repo is public and takes community PRs):
pull_request_target, notpull_request— the plain trigger withholds secrets from fork PRs, which would silently skip exactly the community contributions this exists for. Withpull_request_target, the workflow definition and secrets always come from the base branch; a fork can't modify what runs.gh pr diff(the API), so no attacker-controlled file ever touches the runner. This is the action's preferred pattern for privileged triggers, and it resolves the Semgrep pwn-request findings from the earlier revision.gh pr diff/view/comment+ inline comments). Worst case for a prompt-injection attempt in PR content is a bad comment — no pushes, no approvals, no secret access. The prompt also instructs Claude to treat PR content as data, not instructions.Type(s) of changes
Motivation for PR
This repo is being reopened to community contributions (see #1138). Community PRs are content-only, but content mistakes in crypto docs are high-stakes — a changed contract address or a swapped link is exactly what an automated first-pass review catches. Discussed and aligned with security in Slack.
How Has This Been Tested?
YAML validated locally; the workflow is the action's documented auto-review pattern with the documented
pull_request_targethardening. Sincepull_request_targetworkflows run from the default branch, real verification happens on the first PR opened after this merges.Setup required before it works (repo settings, not code):
CLAUDE_CODE_OAUTH_TOKENrepo secret needs a real value — security team is provisioning a token (the secret exists as a placeholder; must not be a personal token).Uniswap/docs(it's already active on universe; may just need this repo added to its installation).Applicable screenshots
N/A
Follow-up PR
None planned. Version bumps of the action are a one-line SHA update.
🤖 Generated with Claude Code