surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

Flag defaultMode anywhere in a job that calls ClaudeBrowse files

A settings file that an earlier step writes at run time can't be read by
the step-level check, so also fail when the job's definition mentions
defaultMode at all.

Claude authored 24 days ago parent a83eb80 · commit 55ac4d7fce58

1 changed file+6 -0compared with a83eb80

M.github/scripts/check_workflow_hardening.py

M.github/scripts/check_workflow_hardening.py+6 -0

		@@ -205,6 +205,12 @@
205	205	f"Auto permission mode is not required for job '{job_id}' in {file_name}. "
206	206	f"Reason: {EXEMPT_FROM_AUTO_MODE[key]}."
207	207	)
	208	+ if "defaultMode" in json.dumps(job):
	209	+ # Catches a settings file that an earlier step of the job writes, which the
	210	+ # step-level check cannot read.
	211	+ errors.append(
	212	+ f"{where} mentions 'defaultMode': settings must not set a permission mode. {HELP}"
	213	+ )
208	214	for index, step in enumerate(steps_of(job), start=1):
209	215	if not runs_claude_code_action(step):
210	216	continue