From 01343f1c1a68d46a941b6238ca2978328f3e75eb Mon Sep 17 00:00:00 2001 From: Marcelo Gobetti Date: Mon, 6 Jul 2026 16:36:29 -0300 Subject: [PATCH] Steer PR review to the search tools, not shell grep MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The review allow-list permits bash only for git log/diff/show, but Sonnet 5 still reaches for `grep -rn`, `find`, `cat`, and `python` when verifying a finding across files. Each is denied and costs a turn plus a retry. On a repo with a tight max_turns the waste is enough to exhaust the budget mid-review on even a 4-file PR — the run dies with error_max_turns and posts no review at all. Tell the model up front that bash is git-only and to search and read with the Read/Grep/Glob tools, reviewing primarily from the diff and opening extra files only when a finding needs cross-file confirmation. Removes the denial class and curbs over-exploration without raising any cap. Follow-up to 8fe29fd. --- .github/workflows/claude-review.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml index f0174eb..a58a93b 100644 --- a/.github/workflows/claude-review.yml +++ b/.github/workflows/claude-review.yml @@ -61,13 +61,17 @@ jobs: ## Environment constraints - This review runs with a restricted toolset: only Read, Glob, Grep, LS, and - `git log`/`git diff`/`git show` are available. There is no ability to run - builds, linters, or test suites, install dependencies, or reach the network. - Do not attempt repo setup, linting, or test commands, and do not retry a - denied tool call — go straight to a static review of the diff with the - allowed tools. If something genuinely requires a disallowed tool, note that - once in the final comment instead of retrying. + This review runs with a restricted toolset: Read, Glob, Grep, LS, and + `git log`/`git diff`/`git show`. There is no ability to run builds, + linters, or test suites, install dependencies, or reach the network, so + do not attempt repo setup, linting, or test commands. To search and read + code use the Read, Grep, and Glob tools, not shell `grep`, `find`, `cat`, + or `python`: bash is git-only, so any other shell command is denied and + wastes a turn. Review primarily from the diff + (`git diff origin/...HEAD`), opening additional files only when a + finding needs cross-file confirmation. Do not retry a denied tool call — + if something genuinely requires a disallowed tool, note it once in the + final comment. The review rubric below already incorporates the organization-wide code review guidelines. Apply it IN ADDITION to any repository-specific