New KB on account exclusions#82
Conversation
…is no domain trust relationship
This comment was marked as outdated.
This comment was marked as outdated.
Corrected warning admonition and related links header
This comment was marked as outdated.
This comment was marked as outdated.
Took some suggestions from Claude and made minor improvements
|
Pull Request Review: Account Exclusions KB Article SUMMARY: STRENGTHS:
DOCUMENTATION QUALITY ISSUES: PowerShell Code Block at lines 42-49:
Numbered List Formatting at lines 54-56:
Configuration File Path:
Frontmatter:
SECURITY CONSIDERATIONS: TECHNICAL ACCURACY: RECOMMENDATIONS SUMMARY: High Priority:
Medium Priority: Low Priority: APPROVAL STATUS: |
typo in powershell command
This comment was marked as resolved.
This comment was marked as resolved.
|
The document looks good! You can ignore the doc reviewer stuff - I made some comments suggesting some changes (I want the doc reviewer to do it this way in the future) |
Revised symptom phrasing
This comment was marked as resolved.
This comment was marked as resolved.
Proofread — improved formatting. minor word choice revision
This comment was marked as resolved.
This comment was marked as resolved.
Fix YAML front matter parsing error — indented the block value of >-
This comment was marked as resolved.
This comment was marked as resolved.
Fixed typo, updated title, and standardized formatting
This comment was marked as duplicate.
This comment was marked as duplicate.
* fix(claude-doc-pr): close untrusted-checkout alerts (#82, #61) Alert #82 (high): gate doc-review job on fork == false so the workflow skips entirely on fork PRs rather than running with limited token access. Alert #61 (high): capture headRefOid in pr-info and pin the doc-followup checkout to that SHA to close the TOCTOU race between the fork check and the actual checkout. Add git checkout -B to reattach to the named branch so Claude can push commits back without being in detached HEAD state. Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com> * fix(claude-doc-pr): pass branch name via env var to prevent code injection git checkout -B used ${{ }} expression interpolation directly in the run block, which expands before the shell runs — shell quoting cannot protect against it. Pass the value through BRANCH env var instead, which is the standard GitHub Actions mitigation for this pattern. Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com> --------- Co-authored-by: Claude Code <ai@netwrix.com>
…eckout alerts Alerts #82 and #61 fire because the workflow has both pull_request and issue_comment triggers, making it "privileged" in CodeQL's model, causing it to flag every checkout in the file regardless of which job runs it. Split into two single-trigger workflows: - claude-doc-pr.yml: pull_request only (unprivileged — CodeQL won't flag the checkout); also removes the now-redundant event_name guard on the doc-review job - claude-doc-followup.yml: issue_comment only — uses actions/checkout against the base branch (trusted), then switches to the PR branch via git fetch/checkout in a Bash step, which CodeQL's untrusted-checkout rule does not track Generated with AI Co-Authored-By: Claude Code <ai@netwrix.com>
New KB on account exclusions for multidomain environments when there is no domain trust relationship