[NoQA] Fix React Compiler compliance check blocked in reviewer#85067
[NoQA] Fix React Compiler compliance check blocked in reviewer#85067kacper-mikolajczak wants to merge 2 commits intoExpensify:mainfrom
Conversation
Only the command changes from npx to npm run; the single-line parsing instruction was already clear enough for the reviewer agent. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
kacper-mikolajczak
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f4853b15dc
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| claude_args: | | ||
| --model claude-opus-4-6 | ||
| --allowedTools "Task,Glob,Grep,Read,Bash(gh pr diff:*),Bash(gh pr view:*)" --json-schema '${{ steps.schema.outputs.json }}' | ||
| --allowedTools "Task,Glob,Grep,Read,Bash(gh pr diff:*),Bash(gh pr view:*),Bash(npm run react-compiler-compliance-check:*)" --json-schema '${{ steps.schema.outputs.json }}' |
There was a problem hiding this comment.
Adding Bash(npm run react-compiler-compliance-check:*) in the pull_request_target review job lets the agent execute a script that shells out with interpolated input (execSync(\npx react-compiler-healthcheck ${srcArg} --verbose`)inscripts/react-compiler-compliance-check.ts`), so a PR-controlled filepath containing shell substitution can trigger arbitrary command execution when the reviewer runs the recommended check command. This capability was previously blocked by the tool allowlist, so enabling it here introduces a new high-impact injection path unless file paths are strictly escaped or passed as argv arrays.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
@kacper-mikolajczak @adhorodyski I feel like this is a real problem as anyone could update the contents of the script, right?
2 participants
Explanation of Change
Background: The Expensify App repo uses
claude-code-actionto run automated code reviews on every PR via.github/workflows/claude-review.yml. The reviewer agent operates in a restricted sandbox where only explicitly whitelisted Bash commands are permitted through theallowedToolsparameter - currently limited togh pr diffandgh pr view. Separately, a coding standards rule (CLEAN-REACT-PATTERNS-0) instructs the reviewer to verify whether a file compiles with React Compiler before flagging manual memoization as redundant.Problem: When the reviewer agent tries to verify React Compiler compliance per the rule's instructions, it cannot execute the
npx react-compiler-healthcheckcommand due to theallowedToolswhitelist, which prevents it from distinguishing files that compile (where manual memoization is redundant) from files that don't (where manual memoization may be necessary).Solution: Replace the
npx react-compiler-healthcheckinstruction withnpm run react-compiler-compliance-check check <filepath>- an existing repo script that wraps the same healthcheck - and addBash(npm run react-compiler-compliance-check:*)to theallowedToolswhitelist so the reviewer can execute it.Changes across 3 files:
.claude/skills/coding-standards/rules/clean-react-0-compiler.md- swappednpx react-compiler-healthcheck --src "<filepath>" --verbosewithnpm run react-compiler-compliance-check check <filepath>.github/workflows/claude-review.yml- addedBash(npm run react-compiler-compliance-check:*)toallowedTools.claude/commands/review-code-pr.md- added the same pattern toallowed-toolsfrontmatterFixed Issues
$ #85070
PROPOSAL:
Tests
npm run react-compiler-compliance-check check src/components/CurrentWalletBalance.tsxnpm run react-compiler-compliance-check check src/hooks/usePaginatedReportActions.ts.github/workflows/claude-review.ymland verifyBash(npm run react-compiler-compliance-check:*)is present inallowedToolson line 77.claude/commands/review-code-pr.mdand verify the same pattern is in theallowed-toolsfrontmatter.claude/skills/coding-standards/rules/clean-react-0-compiler.mdand verify the verification command isnpm run react-compiler-compliance-check check <filepath>Offline tests
N/A - changes are to CI workflow config and reviewer instructions only, no runtime code affected.
QA Steps
// TODO: These must be filled out, or the issue title must include "[No QA]."
N/A - this is a CI/tooling change with no user-facing impact. Verification is that the reviewer agent can successfully run the compliance check on future PRs.
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectiontoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari