Skip to content

Scope release-notes tool allowlist for Phase 3 experts #6439

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
reyortiz3 merged 4 commits into from
Aug 26, 2026
Merged

Scope release-notes tool allowlist for Phase 3 experts #6439

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
5518539
Widen release-notes tool allowlist for v0.45.0 rerun
reyortiz3 Aug 26, 2026
a907d49
Keep release-notes max-turns at 60
reyortiz3 Aug 26, 2026
4256061
Scope Bash allowlist instead of opening it fully
reyortiz3 Aug 26, 2026
2de6fc7
Merge branch 'main' into tmp/release-notes-v0.45.0-fix
reyortiz3 Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions .github/workflows/release-notes.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,9 +138,17 @@ jobs:
`release-notes-${{ steps.tag.outputs.tag }}.md` in the repo root.
- Do not post comments or run `gh release edit`. Stop after writing the file.
# Tools: gh/git for read-only data gathering, Task for the expert
# subagents, and file tools for reading the skill and writing the output.
# subagents (kubernetes-expert, mcp-protocol-expert, oauth-expert,
# toolhive-expert, site-reliability-engineer), file tools for reading
# the skill and writing the output, WebFetch/context7 for the specs
# those experts consult. The extra Bash(...) entries cover the
# local code-exploration commands those experts actually run
# (grep/find/cat/ls/go doc) without opening up network or
# write-capable commands (curl, go get/install, etc.) — this job
# runs unattended over PR/issue content it doesn't control, so
# Bash stays scoped rather than fully unrestricted.
claude_args: |
--allowedTools "Bash(gh *),Bash(git *),Task,Read,Write,Edit,Glob,Grep,TodoWrite"
--allowedTools "Bash(gh *),Bash(git *),Bash(grep *),Bash(rg *),Bash(find *),Bash(cat *),Bash(ls *),Bash(head *),Bash(tail *),Bash(go doc *),Task,Read,Write,Edit,Glob,Grep,TodoWrite,WebFetch,mcp__context7__resolve-library-id,mcp__context7__get-library-docs"
--max-turns 60

- name: Verify notes were generated
Expand Down
Loading