Set allowed bot names in claude code action - #69
Conversation
Pass the set allowed bot names to claude code action.
PR SummaryLow Risk Overview The value is built by parsing the JSON array input and joining logins with commas; if the input is empty, an empty string is passed. This aligns the action’s bot allowlist with the same Reviewed by Cursor Bugbot for commit 9876631. Bugbot is set up for automated code reviews on this repo. Configure here. |
![seidroid[bot]](https://avatars.githubusercontent.com/in/2745135?s=60&v=4){kind=small}
There was a problem hiding this comment.
Single-line change forwarding the reusable workflow's allowed-bots JSON array to claude-code-action's comma-separated allowed_bots input; the conversion and default ('[]' → empty string) are correct and login formatting stays consistent with the preflight allowlist. One non-blocking robustness note: the new unguarded fromJSON makes an empty-string allowed-bots a hard failure on every event, unlike the other two consumers of that input.
Findings: 0 blocking | 1 non-blocking | 1 posted inline
Blockers
- None at the file/PR level.
Non-blocking
- None at the file/PR level.
- 1 suggestion(s)/nit(s) flagged inline on specific lines.
| anthropic_service_account_id: ${{ vars.PLATFORM_CODE_AGENT_ANTHROPIC_SVAC_ID }} | ||
| bot_id: ${{ vars.PLATFORM_CODE_AGENT_USER_ID }} | ||
| bot_name: 'seidroid[bot]' | ||
| allowed_bots: ${{ join(fromJSON(inputs.allowed-bots), ',') }} |
There was a problem hiding this comment.
[suggestion] fromJSON is evaluated unconditionally here, on every event including the automatic pull_request path. Elsewhere the workflow deliberately tolerates an empty value — the authorization script uses JSON.parse(process.env.ALLOWED_BOTS || "[]") (line 325), and the preflight if: only reaches fromJSON(inputs.allowed-bots) on comment events. So a caller that passes allowed-bots: '' instead of the documented '[]' would previously still get automatic reviews, but will now fail this job with an expression-evaluation error on every PR.
Guarding keeps the tolerance consistent:
allowed_bots: ${{ inputs.allowed-bots != '' && join(fromJSON(inputs.allowed-bots), ',') || '' }}
Testing here since this is a bot authored PR. See: sei-protocol/uci#69
1 participant
Pass the set allowed bot names to claude code action.