Uh oh!
There was an error while loading. Please reload this page.
ci(deep-review): pin claude-code CLI to dodge bwrap sandbox regression - #2823
Merged
Conversation
claude-code-action >=2.1.216 has a bwrap sandbox regression: when
subprocess isolation is on (auto-enabled by allowed_non_write_users),
bwrap aborts every Bash call trying to mask a repo-root .mcp.json
("bwrap: Can't create file at /home/.mcp.json: Permission denied").
This kills git/gh and the reviewer fan-out, so the review posts an
"environment failure" comment while the job still reports success.
The action hardcodes its CLI version with no version input, so pin
2.1.215 (last pre-regression release) via path_to_claude_code_executable,
asserting the installed binary reports the pinned version. Add a
permanent smoke check that fails the job loud if the execution
transcript carries the sandbox-failure signature, so a broken sandbox
can never again post a zero-coverage review under a green checkmark.
Unpin once upstream fixes the regression (tracked in HDX-4907).
Upstream: anthropics/claude-code-action#1547The latest updates on your projects. Learn more about Vercel for GitHub. 2 Skipped Deployments
|
|
Contributor
🟢 Tier 1 — TrivialDocs, images, lock files, a dependency bump, or an automated release. No functional code changes detected. Why this tier:
Review process: Auto-merge once CI passes. No human review required. Stats
|
Contributor
Greptile SummaryThe PR pins Deep Review to Claude Code CLI 2.1.215 and adds transcript-based sandbox health detection.
Confidence Score: 4/5The PR should not merge until the platform-native package used by the pinned CLI is independently authenticated. The mutable installer issue is fixed by verifying the top-level tarball, but npm still resolves the platform-native optional dependency without a lockfile or pinned integrity value and the resulting executable receives the workflow's Anthropic and GitHub credentials. Files Needing Attention: .github/workflows/deep-review.yml
|
| Filename | Overview |
|---|---|
| .github/workflows/deep-review.yml | Pins the Claude CLI, verifies the top-level package, and adds fail-closed sandbox transcript checks while preserving completed review comments. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
A[Download pinned CLI tarball] --> B[Verify SHA-512]
B --> C[npm install dependencies]
C --> D[Run install.cjs]
D --> E[Run credentialed deep review]
E --> F[Inspect execution transcript]
F -->|Healthy| G[Post review with state marker]
F -->|Unhealthy| H[Post review without state marker]
H --> I[Fail workflow]
Reviews (7): Last reviewed commit: "Merge branch 'main' into brandon/fix-dee..." | Re-trigger Greptile
Uh oh!
There was an error while loading. Please reload this page.
…ing a remote installer The pin previously piped a mutable remote install script to bash and trusted the result via the binary's spoofable --version output -- compromise of the installer delivery chain could run arbitrary code on the runner and substitute the executable the credentialed review action later invokes. Fetch the immutable npm tarball for the pinned version instead, verify it against a SHA-512 hardcoded in the workflow (npm dist.integrity of @anthropic-ai/claude-code@2.1.215), and install from the verified local tarball with --ignore-scripts. The only lifecycle script executed is install.cjs from the hash-verified tarball, invoked explicitly to link the platform-native binary, which itself is an optionalDependency exact-pinned by the verified package.json -- anchoring the whole chain to the hash in this file. The version assertion remains as a sanity check only.
Contributor
E2E Test Results✅ All tests passed • 277 passed • 1 skipped • 1125s
Tests ran across 4 shards in parallel. |
Contributor
Deep Review✅ No critical issues found. The CLI pin + sandbox guard are net improvements over the base workflow, and the happy path (pin to known-good 🟡 P2 -- recommended
🔵 P3 nitpicks (4)
Reviewers (7): correctness, security, adversarial, reliability, testing, maintainability, project-standards. Testing gaps:
|
…g completed reviews Address the deep review's P0/P1 findings on the sandbox smoke check: - The bwrap signature test was unanchored and matched anywhere in any errored tool_result -- including transcripts that merely QUOTE the error text, which this workflow file now permanently contains. Require matches to (a) correlate to a Bash tool_use by id and (b) carry the bwrap signature at the start of a line, as real bwrap stderr does (quoted occurrences are diff-/comment-prefixed). - The guard failed the job before Extract/Post, whose bare if: is implicitly ANDed with success() -- so a guard failure discarded the already-completed review, posted nothing, and skipped the state marker, re-running the full fan-out on the next push. The guard now only detects and records; Extract/Post run under always() (still gated on the review step succeeding) so the review always posts, and a final step fails the job loud afterwards. Unhealthy runs omit the parseable state marker so the gate fail-opens and the next run re-reviews instead of trusting a zero-coverage review. A sandbox check that itself errors is treated as unhealthy, not fail-open. Verified against fixture transcripts: real bwrap failure (string and array content) -> broken; quoted signature in errored Bash output, non-Bash errored tool_result, healthy run -> pass; missing transcript -> broken; omitted marker does not parse under the gate's MARKER_RE.
jordan-simonovski
previously approved these changes
Aug 5, 2026
Address the deep review P0 on the sandbox health check: jq emits nothing (exit 0) on an existing-but-empty execution_file, leaving BROKEN_COUNT empty; [ "" -gt 0 ] then errors but is set-e-exempt as an if condition, so the check fell through to broken=false, stamped a valid state marker, and left the job green on a sandbox it never actually inspected -- with the gate suppressing re-review. Reject degraded transcripts up front (empty file, or anything that is not a non-empty JSON array) and case-validate that the derived count is numeric before comparing it. Verified against fixtures: empty file, null, [], and malformed JSON all now record broken=true; the five prior fixtures (real bwrap failures, quoted signature, non-Bash tool, healthy run) are unchanged.
Uh oh!
There was an error while loading. Please reload this page.
wrn14897
approved these changes
Aug 7, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Deep Review action can post "environment failure" comments (zero-coverage reviews) while the job reports success.
Root cause is an upstream regression in the Claude Code CLI that
anthropics/claude-code-action@v1bundles and auto-bumps (~daily): anthropics/claude-code-action#1547. CLI>= 2.1.216breaks the bwrap sandbox — whenever subprocess isolation is enabled (which ourallowed_non_write_users: '*'auto-enables viaCLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1), bwrap aborts every Bash call while trying to mask a repo-root.mcp.json:That kills
git/ghand the reviewer sub-agent fan-out, so no diff is ever obtained.2.1.215is the last known-good version; the regression is not fixed forward through the current2.1.220.What changed
deep-review.yml:2.1.215(temporary). The action hardcodes its CLI version with no version input, so the only supported override ispath_to_claude_code_executable. A new step fetches the immutable npm tarball for the pinned version, verifies it against a SHA-512 hardcoded in the workflow (the npmdist.integrityof@anthropic-ai/claude-code@2.1.215), and installs from the verified local tarball with--ignore-scripts— the only lifecycle script executed isinstall.cjsfrom the hash-verified tarball, run explicitly to link the platform-native binary (itself an optionalDependency exact-pinned by the verifiedpackage.json). Trust rests on the hash in the workflow, not on a mutable remote installer or the binary's spoofable--versionoutput (kept as a sanity check only). Version + hash are single-sourced in env vars so they cannot drift. Unpin once upstream fixes the regression (tracked in HDX-4907).execution_filetranscript (tool_resultblocks withis_error: truecarrying the bwrap signature) rather than the free-text review body, which would false-positive on any PR that merely discusses the error.