fix: move state files into workspace and address bash sandbox denials

[mtrunkat]

Why

Two real-world runs against apify/apify-core showed ~10 permission denials per run, each costing Claude a turn. Three causes, all addressed here:

Cause	Fix
$RESULT_PATH / $CHANGED_FILES_PATH live in $RUNNER_TEMP, outside the bash sandbox	Move both into $GITHUB_WORKSPACE/__mongo_index_check/
Common text tools (awk, wc, sed, sort) not in allowlist	Add them — read-only, no security surface
Claude doesn't know bash output redirection / chained commands are blocked, so it retries	Document the sandbox in the prompt and require Write for the result file

What changes

action.yaml

• Validate step now seeds $RESULT_PATH and $CHANGED_FILES_PATH to $GITHUB_WORKSPACE/__mongo_index_check/{result.txt,changed-files.json} via $GITHUB_ENV. The state dir naming mirrors the existing __mongo_index_check_apify_core/ sparse-checkout dir.
• Pre-check step re-exposes $CHANGED_FILES_PATH under the name preCheck() reads (OUTPUT_CHANGED_FILES_PATH) via the step's env: block — no JS-side process.env mutation needed.
• Render step drops its inline CHANGED_FILES_PATH (inherited from $GITHUB_ENV now).
• Claude allowedTools gains Bash(awk:*), Bash(wc:*), Bash(sed:*), Bash(sort:*).

prompts/review.md

• New "Bash sandbox notes" section right before the hard-constraints list:
  • Output redirection (>, >>, tee to a file) is blocked even within the workspace → use Write.
  • Chained commands (&&, ;) are rejected → one command per Bash call.
  • Paths outside $GITHUB_WORKSPACE are blocked for bash → state paths now live inside the workspace.
• Step 4 tightened: "Use the Write tool — printf > $RESULT_PATH will fail."

Out of scope

• max-turns stays at 100. Iterating the allowlist + prompt should bring real runs well under that on their own.
• show_full_output: true stays on for now. Can revisit once we've seen a few more runs.

Test plan

• python3 -c "import yaml; yaml.safe_load(...)" — action.yaml valid
• pnpm run lint / type-check / test — clean, 35/35
• envsubst allowlist still aligned with all $VAR placeholders in the prompt (no new placeholders introduced — $GITHUB_WORKSPACE in the prompt body is left literal on purpose so Claude reads the env var name)
• Real run: re-trigger the index check against an apify-core PR. Expected: permission_denials_count drops substantially. The remaining denials, if any, will be more useful signal.

Side effect

The action now creates __mongo_index_check/ inside the caller's workspace at every run. Mirrors the existing __mongo_index_check_apify_core/ pattern, doesn't get committed (ephemeral runner, actions/checkout@v6 cleans untracked files on next run anyway).

---

Generated by Claude Code

[Copilot]

Pull request overview

This PR updates the MongoDB query index check action to reduce Claude bash sandbox permission denials by moving state files into the workspace, expanding the bash allowlist, and documenting sandbox constraints in the review prompt.

Changes:

• Move $RESULT_PATH / $CHANGED_FILES_PATH from $RUNNER_TEMP into $GITHUB_WORKSPACE/__mongo_index_check/ and seed them via $GITHUB_ENV.
• Expand Claude’s --allowedTools bash allowlist to include common text utilities (awk, wc, sed, sort).
• Add “Bash sandbox notes” to the prompt and require using Write (not output redirection) for $RESULT_PATH.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
mongodb-query-index-check/action.yaml	Moves state files into the workspace, wires paths through env, and expands the allowed bash tools.
mongodb-query-index-check/prompts/review.md	Documents bash sandbox limitations and tightens result persistence guidance to use Write.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.