Skip to content
Closed
Show file tree
Hide file tree
Changes from 11 commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .claude/settings.json
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
{
"allowedTools": ["Bash(*)"]
}
9 changes: 1 addition & 8 deletions .fortlsrc
Original file line number Diff line number Diff line change
Expand Up @@ -8,14 +8,7 @@
],
"excl_paths": [
"benchmarks/",
"examples/",
"tests/",
"misc/",
"src/pre_process/include/2dHardcodedIC.fpp",
"src/pre_process/include/3dHardcodedIC.fpp",
"src/pre_process/include/ExtrusionHardcodedIC.fpp",
"**/m_nvtx*",
"**/syscheck.fpp"
"examples/"
],
"include_dirs": [
"src/common/include/",
Expand Down
11 changes: 10 additions & 1 deletion .github/workflows/claude-code-review.yml
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,17 @@ jobs:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
github_token: ${{ github.token }}

show_full_output: true

Copilot AI Feb 22, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

show_full_output: true can leak sensitive information into workflow logs (including anything the review tool prints while it has access to tokens/secrets). If you keep this enabled, ensure secrets are never available in this job for untrusted PRs (especially with pull_request_target) or keep full output disabled.

Suggested change
show_full_output: true
show_full_output: false

Copilot uses AI. Check for mistakes.

plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'
plugins: 'code-review@claude-code-plugins'
prompt: '/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}'

claude_args: |
--allowedTools "Bash(*)"

Copilot AI Feb 22, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using pull_request_target while enabling Claude's Bash(*) tool and passing CLAUDE_CODE_OAUTH_TOKEN creates a high-risk privilege escalation path: the workflow has access to secrets on pull_request_target, and Bash can execute arbitrary commands against the checked-out fork HEAD. Consider removing Bash tool access, switching to pull_request (no secrets), or gating secret usage so it never runs for forked PRs (e.g., only for trusted actors/branches).

Suggested change
claude_args: |
--allowedTools "Bash(*)"

Copilot uses AI. Check for mistakes.
prompt: |
/code-review:code-review ${{ github.repository }}/pull/${{ github.event.pull_request.number }}
Post the results as one top-level PR comment titled "Claude Code Review".

additional_permissions: |
actions: read