From 732fb1a21c67fcd77445224848d16f46bfc5382c Mon Sep 17 00:00:00 2001
From: Shengliang Xu <shengliangx@nvidia.com>
Date: Sat, 31 Oct 2026 01:19:45 +0000
Subject: [PATCH] Let the Claude review bot submit its review again

#3149 replaced Bash(gh pr review:*) with Bash(gh api repos/*/pulls/*/reviews:*) in the bot's
allowed tools. A Bash rule ending in ":*" is a literal prefix, in which an inner "*" matches only
itself, so the rule never matched "gh api repos/NVIDIA/Model-Optimizer/pulls/<N>/reviews ...".
Since then the CLI has refused every review and approval with "This command requires approval".

Spell the rule as this PR's reviews endpoint, from the workflow's REPO and PR_NUMBER, and expand
the same endpoint in the prompt's two publish commands, so the command the bot is told to run is
the one the rule admits. Tell the bot to run it as written: other spellings, such as
"gh api -X POST <endpoint>" or "gh pr review", are refused.

Signed-off-by: Shengliang Xu <shengliangx@nvidia.com>
---
 .github/workflows/claude_review.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/claude_review.yml b/.github/workflows/claude_review.yml
index 360c5c8a6af..41c0a9652b3 100644
--- a/.github/workflows/claude_review.yml
+++ b/.github/workflows/claude_review.yml
@@ -81,8 +81,10 @@ jobs:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           trigger_phrase: "/claude review"
           show_full_output: true
+          # A Bash rule ending in ":*" is a literal prefix, where an inner "*" matches only itself,
+          # so the reviews rule spells out this PR's endpoint, as the prompt's command does.
           claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api repos/*/pulls/*/reviews:*),Bash(git diff:*),Bash(git show:*),Bash(git log:*),Read,Grep,Glob"
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api repos/${{ env.REPO }}/pulls/${{ env.PR_NUMBER }}/reviews:*),Bash(git diff:*),Bash(git show:*),Bash(git log:*),Read,Grep,Glob"
             --disallowedTools "Task,Read(//proc/**)"
             --model "${{ vars.CLAUDE_MODEL }}"
           prompt: |
@@ -315,6 +317,8 @@ jobs:
             If it differs from HEAD SHA, stop without publishing a stale review.
             Submit one review with the summary as its body (do not duplicate it as a PR comment):
             - Eligible `approve`:
-              `gh api repos/$REPO/pulls/$PR_NUMBER/reviews --method POST -f commit_id=<HEAD SHA> -f event=APPROVE -f body="<summary>"`
+              `gh api repos/${{ env.REPO }}/pulls/${{ env.PR_NUMBER }}/reviews --method POST -f commit_id=<HEAD SHA> -f event=APPROVE -f body="<summary>"`
             - All other cases:
-              `gh api repos/$REPO/pulls/$PR_NUMBER/reviews --method POST -f commit_id=<HEAD SHA> -f event=COMMENT -f body="<summary>"`
+              `gh api repos/${{ env.REPO }}/pulls/${{ env.PR_NUMBER }}/reviews --method POST -f commit_id=<HEAD SHA> -f event=COMMENT -f body="<summary>"`
+            Run it exactly as written, with the endpoint right after `gh api`: the tool allow-list
+            refuses any other form, such as `gh api -X POST <endpoint>` or `gh pr review`.