fix: Grant Bash permissions to Claude for pre-commit hooks

[lgallard]

Summary

• Resolves Grant Bash permissions to Claude for pre-commit #131
• Add allowed_tools parameter to both Claude workflows to enable pre-commit automation

Changes Made

• .github/workflows/claude-code-review.yml: Added Bash permissions for pre-commit tools
• .github/workflows/claude.yml: Added Bash permissions for pre-commit tools

Permissions Added

• Bash(pre-commit run --files) - Run pre-commit hooks on specific files
• Bash(terraform fmt) - Format Terraform files
• Bash(terraform validate) - Validate Terraform syntax
• Bash(terraform-docs) - Generate/update documentation

Security

• Permissions are scoped to specific pre-commit related commands only
• Maintains existing security boundaries while enabling automation

Test Plan

• YAML syntax validation passed
• Pre-commit hooks validated on commit
• Test Claude workflows can now run pre-commit commands in practice

[lgallard]

codebot hunt

[claude]

Claude finished @lgallard's task —— View job

---

🕵️ Bug Hunt Complete ✅

Todo List

• Read and analyze .github/workflows/claude-code-review.yml
• Read and analyze .github/workflows/claude.yml
• Check for security vulnerabilities in Bash permissions
• Validate YAML syntax and workflow structure
• Look for potential command injection or permission escalation issues
• Provide actionable feedback on findings

---

🔍 Security Analysis Results

Overall Assessment: ✅ SECURE - The Bash permissions are appropriately scoped and safe.

📋 Findings Summary

✅ No Critical Issues Found

• The added Bash permissions are correctly scoped to specific pre-commit related commands
• Command injection risks are minimal due to the restricted command patterns
• YAML syntax is valid in both files

🔧 Detailed Analysis

Bash Permissions Added (Both Files)

allowed_tools: "Bash(pre-commit run --files),Bash(terraform fmt),Bash(terraform validate),Bash(terraform-docs)"

Security Assessment:

• ✅ Scoped Commands: Permissions are limited to specific, known-safe commands
• ✅ No Wildcards: No dangerous patterns like Bash(*) or Bash(.*)
• ✅ Pre-commit Focus: Commands are focused on code quality and documentation
• ✅ No Shell Features: No access to shell operators like &&, ||, ;, or pipes

Command Analysis

1. Bash(pre-commit run --files) - ✅ Safe

   • Limited to running pre-commit hooks on specific files
   • Cannot execute arbitrary commands

2. Bash(terraform fmt) - ✅ Safe

   • Code formatting only, no destructive operations
   • Standard Terraform command

3. Bash(terraform validate) - ✅ Safe

   • Read-only validation of Terraform syntax
   • No state modifications

4. Bash(terraform-docs) - ✅ Safe

   • Documentation generation tool
   • No destructive operations

YAML Structure Validation

• ✅ Both workflows have valid YAML syntax
• ✅ Proper indentation and structure maintained
• ✅ No syntax errors detected

💡 Recommendations

Current Implementation: Already Secure ✅

The PR correctly implements the requested Bash permissions with appropriate security boundaries. No changes needed.

Optional Enhancement (Future Consideration):

# Consider adding version constraints for tools (not required for security)
allowed_tools: "Bash(pre-commit run --files*),Bash(terraform fmt*),Bash(terraform validate*),Bash(terraform-docs*)"

This would allow for command flags while maintaining security, but the current implementation is already safe and functional.

---

🎯 Summary

This PR successfully addresses issue #131 by adding the necessary Bash permissions for pre-commit automation while maintaining strong security boundaries. The implementation follows security best practices and poses no additional risk to the workflow environment.

Recommendation: ✅ Approve and merge

---