Skip to content

feat: hook review on label #344

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marktoda merged 4 commits into from
Mar 19, 2026
Merged

feat: hook review on label #344

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
ce354de
feat: hook review on label
marktoda Mar 19, 2026
1b6eea6
fix: remove github token
marktoda Mar 19, 2026
61e296c
fix: hook review
marktoda Mar 19, 2026
7e9d7e5
fix: pin
marktoda Mar 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .github/workflows/analyze-hook.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,15 @@ name: Analyze Hook Submission

on:
issues:
types: [opened]
types: [labeled]

concurrency:
group: analyze-hook-${{ github.event.issue.number }}
cancel-in-progress: true

jobs:
analyze:
if: contains(github.event.issue.labels.*.name, 'submission') || contains(github.event.issue.title, 'hook:')
if: github.event.label.name == 'submission'
runs-on: ubuntu-latest
permissions:
contents: write
Expand All @@ -27,12 +27,12 @@ jobs:
env:
GH_TOKEN: ${{ github.token }}

- uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf
- uses: anthropics/claude-code-action@v1

@semgrep-code-uniswap semgrep-code-uniswap Bot Mar 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. Github, foundry, and uniswap made github actions are exempt.

🧼 Fixed in commit 7e9d7e5 🧼

id: claude
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
show_full_output: true
claude_args: '--allowedTools "Bash(curl:*api.etherscan.*),Bash(curl:*api-sepolia.etherscan.*),Bash(curl:*api.arbiscan.*),Bash(curl:*api-sepolia.basescan.*),Bash(curl:*api.basescan.*),Bash(curl:*api.polygonscan.*),Bash(git*),Bash(gh*),Bash(python3*),Read,Glob,Grep,Write"'
claude_args: '--allowedTools "Bash(curl *),Bash(git *),Bash(gh *),Bash(python3 *),Read,Glob,Grep,Write"'
prompt: |
Analyze the hook submission in issue #${{ github.event.issue.number }}.

Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/review-hook.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ jobs:
echo "No hook files changed, skipping review."
fi

- uses: anthropics/claude-code-action@64c7a0ef71df67b14cb4471f4d9c8565c61042bf
- uses: anthropics/claude-code-action@v1

@semgrep-code-uniswap semgrep-code-uniswap Bot Mar 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An action sourced from a third-party repository on GitHub is not pinned to a full length commit SHA. Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. Github, foundry, and uniswap made github actions are exempt.

✨ Fixed in commit 7e9d7e5 ✨

if: steps.changed.outputs.hooks == 'true'
id: claude
with:
Expand All @@ -42,7 +42,7 @@ jobs:
show_full_output: true
claude_args: >-
--json-schema '{"type":"object","properties":{"review_body":{"type":"string"},"outcome":{"type":"string","enum":["APPROVE","REQUEST_CHANGES"]}},"required":["review_body","outcome"]}'
--allowedTools "Bash(curl:*api.etherscan.*),Bash(curl:*api-sepolia.etherscan.*),Bash(curl:*api.arbiscan.*),Bash(curl:*api-sepolia.basescan.*),Bash(curl:*api.basescan.*),Bash(curl:*api.polygonscan.*),Bash(python3:*),Read,Glob,Grep"
--allowedTools "Bash(curl *),Bash(python3 *),Read,Glob,Grep"
prompt: |
Review this PR by following the instructions in .claude/prompts/review-hook.md.
Verify each hook file's flags, properties, and metadata against the on-chain source code.
Expand Down
Loading