From b308697d5ebfd0f1a16f5509bf9365d9d7f99baf Mon Sep 17 00:00:00 2001 From: Vlad Mocanu Date: Fri, 27 Feb 2026 12:48:21 +0200 Subject: [PATCH] fix: use Bash sub-patterns in upstream-sync for CI auto-approval Bare `Bash` in allowed_tools makes the tool available but individual commands still require interactive approval. In CI there's nobody to approve, so git push, bun test, and curl all fail with "Error: This command requires approval". Changes: - Switch to Bash(git:*), Bash(bun:*), Bash(curl:*) sub-patterns - Add GITHUB_SERVER_URL env var so Claude doesn't need `export` - Update prompt to reflect env var is pre-set Co-Authored-By: Claude Opus 4.6 --- .forgejo/kcl-ci/main.k | 5 +++-- .forgejo/workflows/upstream-sync.yml | 5 +++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/.forgejo/kcl-ci/main.k b/.forgejo/kcl-ci/main.k index d55064e..65634b5 100644 --- a/.forgejo/kcl-ci/main.k +++ b/.forgejo/kcl-ci/main.k @@ -267,7 +267,7 @@ Prefer adapter patterns (separate Forgejo files) over inline modifications to up The fewer upstream files we modify, the fewer conflicts in the next sync. ## After merge is resolved and reviewed -1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test +1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment) 2. Run typecheck: bun run typecheck 3. Check formatting: bun run format:check — if issues, fix with bun run format 4. Commit any remaining changes and push the branch @@ -541,10 +541,11 @@ fi""" github_token = h.gha_secret("CLAUDE_BOT_TOKEN") platform = "forgejo" show_full_output = "true" - allowed_tools = "Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch" + allowed_tools = "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch" } env = { GITHUB_TOKEN = h.gha_secret("CLAUDE_BOT_TOKEN") + GITHUB_SERVER_URL = "https://github.com" FORK_MODIFIED_FILES = h.gha_steps("prepare", "fork_files") AFFECTED_FORK_FILES = h.gha_steps("prepare", "affected_files") } diff --git a/.forgejo/workflows/upstream-sync.yml b/.forgejo/workflows/upstream-sync.yml index 1c82f7e..dbe9a5a 100644 --- a/.forgejo/workflows/upstream-sync.yml +++ b/.forgejo/workflows/upstream-sync.yml @@ -265,7 +265,7 @@ jobs: The fewer upstream files we modify, the fewer conflicts in the next sync. ## After merge is resolved and reviewed - 1. Run tests: export GITHUB_SERVER_URL=https://github.com && bun test + 1. Run tests: bun test (GITHUB_SERVER_URL is already set in the environment) 2. Run typecheck: bun run typecheck 3. Check formatting: bun run format:check — if issues, fix with bun run format 4. Commit any remaining changes and push the branch @@ -282,8 +282,9 @@ jobs: github_token: ${{ secrets.CLAUDE_BOT_TOKEN }} platform: forgejo show_full_output: 'true' - allowed_tools: Bash,Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch + allowed_tools: Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit,MultiEdit,Glob,Grep,WebFetch,WebSearch env: GITHUB_TOKEN: ${{ secrets.CLAUDE_BOT_TOKEN }} + GITHUB_SERVER_URL: https://github.com FORK_MODIFIED_FILES: ${{ steps.prepare.outputs.fork_files }} AFFECTED_FORK_FILES: ${{ steps.prepare.outputs.affected_files }}