surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| 1 | # CLAUDE.md |
| 2 | |
| 3 | Guidance for Claude Code and other coding agents working in this repository. |
| 4 | |
| 5 | ## Security hardening for GitHub Actions |
| 6 | |
| 7 | Workflow jobs in this repository that call Claude run with three protections. |
| 8 | Keep them when you add or edit a workflow. |
| 9 | |
| 10 | 1. **Egress-firewall runner.** The job has `runs-on: ubuntu-24.04-firewall`, |
| 11 | a GitHub-hosted runner that filters the job's outbound network traffic. Do |
| 12 | not move a job that calls Claude to another runner. |
| 13 | 2. **Network allow list.** `.github/egress-firewall.yaml` lists the hosts |
| 14 | those jobs may reach, besides any that GitHub's firewall allows by default. |
| 15 | Keep `mode: enforce`, which is what makes the firewall block the rest. Follow |
| 16 | that file's header when you add a host. |
| 17 | 3. **Auto permission mode.** Every step that runs the Claude Code action |
| 18 | (`uses: anthropics/claude-code-action`, or a local action with a |
| 19 | `claude_args` input) passes `--permission-mode auto` in `claude_args`. A tool |
| 20 | call that needs permission and that the allowed tools do not cover then runs |
| 21 | only if Claude Code's safety review passes it. Allow only the tools the job |
| 22 | needs, and keep any `--disallowedTools` list a step has. Use `claude-opus-4-6` |
| 23 | or a newer model: on an older one Claude Code falls back to its default |
| 24 | permission mode. |
| 25 | |
| 26 | `claude.yml` answers `@claude` mentions. The Claude Code action sets |
| 27 | `--permission-mode acceptEdits` for those, and the `--permission-mode auto` in |
| 28 | the workflow's `claude_args`, which comes after it, replaces it. |
| 29 | |
| 30 | `.github/workflows/workflow-hardening.yml` fails when a job that runs the Claude |
| 31 | Code action or mentions `ANTHROPIC_FEDERATION_RULE_ID` breaks protection 1 or 3, |
| 32 | or when the allow list is missing, empty, not `mode: enforce`, or names a host |
| 33 | with `*`. It cannot see a job that calls Claude another way, so check new |
| 34 | workflows by hand too. If a job cannot meet protection 1 or 3, add it with the |
| 35 | reason to the matching exemption table in |
| 36 | `.github/scripts/check_workflow_hardening.py`. A job in `EXEMPT_FROM_AUTO_MODE` |
| 37 | must set no permission mode at all. Do not skip or weaken the check. |
| 38 | |
| 39 | Keep each workflow's `permissions:` block minimal, and never print tokens or |
| 40 | environment variables in workflow logs. |