hathach 2fc46b6909 ci(claude): drop Bash allowlist entirely (Codex P1, round 2) ...

Codex correctly noted that allowing python3/python (and really cmake/make
too) is arbitrary code + network execution: a command allowlist cannot
contain a prompt-injected or malicious fork PR when this job holds the
OAuth secret + write token, and the review workflow directs fork PRs to
@claude.

The Bash allowlist was beyond the original scope (auto-commit/PR) anyway.
Remove it: Claude edits files and the action commits/opens the PR, and the
resulting commit is verified by the existing CircleCI matrix. Keep
use_commit_signing and --max-turns 30.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-02 11:18:14 +07:00

..

actions

Update several actions to latest version

2026-03-18 00:31:01 +07:00

ISSUE_TEMPLATE

correct flash/ram for v307 and v305

2025-07-28 11:43:20 +07:00

workflows

ci(claude): drop Bash allowlist entirely (Codex P1, round 2)

2026-06-02 11:18:14 +07:00

FUNDING.yml

Set GitHub Sponsors username in FUNDING.yml

2026-05-25 12:59:30 +07:00

membrowse_pr_message.j2

set new membrowse comment github workflow with comment message

2026-03-10 07:10:53 +00:00