NO-JIRA: Add Claude Code settings configuration #15819

sg00dwin · 2025-12-08T16:29:11Z

Configures permissions for Claude Code AI assistant with allow/deny/ask rules for common development commands including testing, linting, git operations, and cluster management.

coderabbitai · 2025-12-08T16:29:20Z

Walkthrough

Adds a new JSON configuration file .claude/settings.json that defines three CLI permission categories: allow (permitted commands), deny (prohibited commands), and ask (commands requiring confirmation).

Changes

Cohort / File(s)	Summary
Configuration file `/.claude/settings.json`	Added new JSON config listing CLI command permission sets: `allow` (tests, lint, build, version checks, common git/docker/kubectl/tooling commands), `deny` (destructive git/kubectl/docker/remove commands), and `ask` (installs, upgrades, PR/git operations, builds/dev server starts)

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

sg00dwin · 2025-12-09T03:22:17Z

/test e2e-gcp-console

sg00dwin · 2025-12-12T15:25:54Z

/test e2e-gcp-console

openshift-ci-robot · 2025-12-12T15:26:16Z

@sg00dwin: This pull request explicitly references no jira issue.

Details

In response to this:

Configures permissions for Claude Code AI assistant with allow/deny/ask rules for common development commands including testing, linting, git operations, and cluster management.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

sg00dwin · 2026-01-05T15:08:12Z

/retest-required

jhadvig

Adding couple of comments. @sg00dwin please review for which command are using the semicolon syntax since git, oc, .... are not

jhadvig · 2026-01-05T18:19:11Z

.claude/settings.json

+      "Bash(git diff:*)",
+      "Bash(git log:*)",
+      "Bash(git branch:*)",
+      "Bash(git show:*)",


lest also add git stash * & git remove *

jhadvig · 2026-01-05T18:21:56Z

.claude/settings.json

+
+      "Bash(git stash drop:*)",
+      "Bash(git stash clear:*)",
+


lets add:

"Bash(git revert --no-commit *)", "Bash(git branch -D *)", "Bash(git branch --delete --force *)",

jhadvig · 2026-01-05T18:23:20Z

.claude/settings.json

+      "Bash(gh pr diff:*)",
+      "Bash(gh pr checks:*)",
+
+      "WebFetch(domain:github.com)",


lets add:

"WebFetch(domain:docs.openshift.com)", "WebFetch(domain:kubernetes.io)",

jhadvig · 2026-01-05T18:25:06Z

.claude/settings.json

+      "Bash(yarn lint:*)",
+      "Bash(yarn lint)",
+      "Bash(yarn eslint:*)",
+      "Bash(yarn gherkin-lint:*)",


lets add:

"Bash(yarn prettier *)", "Bash(yarn tsc)", "Bash(yarn type-check)",

jhadvig · 2026-01-05T18:29:03Z

.claude/settings.json

+{
+  "permissions": {
+    "allow": [
+      "Bash(yarn test:*)",


we are not using yarn command with the semi colon

jhadvig · 2026-01-05T18:30:22Z

.claude/settings.json

+
+      "Bash(tree:*)",
+
+      "Bash(git fetch:*)",


git cmd down not used subcommands with semicolon, meaning there is no git diff:HEAD only git diff HEAD

Configures permissions for Claude Code AI assistant with allow/deny/ask rules for common development commands including testing, linting, git operations, and cluster management. Assisted by Claude Code

sg00dwin · 2026-01-05T19:08:03Z

/label tide/merge-method-squash

coderabbitai

Actionable comments posted: 1

Fix all issues with AI Agents 🤖

In @.claude/settings.json:
- Line 33: The entry "Bash(git remove *)" is using an invalid Git command;
update that settings entry to use the correct command "git rm" (e.g., change the
string "Bash(git remove *)" to "Bash(git rm *)") so the configured Bash action
invokes the valid git rm command.

🧹 Nitpick comments (2)

.claude/settings.json (2)

66-101: Consider adding additional destructive operations to deny list.

The deny list covers most critical destructive operations, but consider adding:

Docker cleanup: Bash(docker system prune *) and Bash(docker volume prune *)

Package removal: Bash(yarn remove *) and Bash(npm uninstall *)

These operations can have significant impact and may warrant explicit denial or moving to the ask list.

3-130: Consider consistent wildcard usage patterns.

Some commands have both wildcard and non-wildcard versions (e.g., yarn test * and yarn test), while others only have one form. Consider establishing a consistent pattern:

Use both forms when commands can accept arguments (e.g., yarn test unit.test.js)

Use only non-wildcard for commands that don't accept arguments (e.g., git status)

This improves maintainability and makes the permission rules clearer.

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 24830e3 and aca4c0d.

📒 Files selected for processing (1)

.claude/settings.json

🔇 Additional comments (1)

.claude/settings.json (1)

30-32: No action needed. Deny rules take precedence over allow wildcards in Claude Code's permission system, so git branch * and git stash * in the allow list do not inadvertently permit the destructive operations blocked in the deny list (git branch -D, git stash drop, git stash clear).

Likely an incorrect or invalid review comment.

coderabbitai · 2026-01-05T19:10:12Z

.claude/settings.json

+      "Bash(git branch *)",
+      "Bash(git show *)",
+      "Bash(git stash *)",
+      "Bash(git remove *)",


⚠️ Potential issue | 🔴 Critical

Invalid git command.

The command git remove does not exist. The correct command is git rm for removing files from the working tree and index.

🔎 Proposed fix

- "Bash(git remove *)", + "Bash(git rm *)",

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

"Bash(git remove *)",

"Bash(git rm *)",

🤖 Prompt for AI Agents

In @.claude/settings.json around line 33, The entry "Bash(git remove *)" is using an invalid Git command; update that settings entry to use the correct command "git rm" (e.g., change the string "Bash(git remove *)" to "Bash(git rm *)") so the configured Bash action invokes the valid git rm command.

jhadvig · 2026-01-05T19:25:52Z

.claude/settings.json

+      "Bash(git branch *)",
+      "Bash(git show *)",
+      "Bash(git stash *)",
+      "Bash(git remove *)",


should be:
"Bash(git remote *)",

coderabbitai

Actionable comments posted: 0

🧹 Nitpick comments (3)

.claude/settings.json (3)
3-64: Well-structured allow list with appropriate safe commands.

The allow list properly covers read-only and non-destructive operations. Good incorporation of past feedback including git stash *, git remote *, yarn linting tools, and documentation domains.

Optional improvement: Consider adding git pull to the ask list since it can modify the working directory and merge changes, which might warrant user confirmation.

66-101: Strengthen the deny list with additional destructive commands.

The deny list appropriately blocks dangerous operations including force push, hard reset, and cluster modifications. Past feedback regarding git revert --no-commit, git branch -D, and force deletion has been properly incorporated.

Consider adding these destructive commands to the deny list:

"Bash(git rm *)" - removes files from working tree and index

"Bash(rm -r *)" - recursive removal without force flag is still destructive
🔎 Suggested additions
       "Bash(git branch --delete --force *)",
+
+      "Bash(git rm *)",
+      "Bash(git rm -r *)",
+      "Bash(git rm -rf *)",
 
       "Bash(rm -rf *)",
       "Bash(rm -fr *)",
+      "Bash(rm -r *)",
103-130: Enhance the ask list with package removal commands.

The ask list appropriately requires confirmation for installs, git write operations, PR management, and builds.

Consider adding package removal commands for consistency:

"Bash(yarn remove *)"

"Bash(npm uninstall *)"

"Bash(npm remove *)"

"Bash(npm rm *)"

These commands modify dependencies similar to install/add operations and should warrant user confirmation.
🔎 Suggested additions
       "Bash(npm install *)",
       "Bash(npm i *)",
+      "Bash(yarn remove *)",
+      "Bash(npm uninstall *)",
+      "Bash(npm remove *)",
+      "Bash(npm rm *)",
       "Bash(go get *)",
       "Bash(go mod *)",

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between aca4c0d and c5de6ea.

📒 Files selected for processing (1)

.claude/settings.json

🔇 Additional comments (1)

.claude/settings.json (1)

1-132: Configuration successfully addresses past feedback and achieves PR objectives.

The Claude Code settings configuration is well-structured with clear separation of allow/deny/ask permissions. Key improvements from previous reviews have been incorporated:

✅ Git commands corrected (git remote instead of git remove)

✅ Destructive git operations added to deny list

✅ Documentation domains added to WebFetch

✅ Additional yarn linting tools included

The JSON structure is valid and the permission sets appropriately cover testing, linting, git operations, and cluster management as described in the PR objectives.

jhadvig

/lgtm
/approve

openshift-ci · 2026-01-05T21:52:40Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhadvig, sg00dwin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [jhadvig]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

jhadvig · 2026-01-06T11:06:12Z

Overriding since this PR is only adding AI settings.
/override ci/prow/e2e-gcp-console ci/prow/okd-scos-images

openshift-ci · 2026-01-06T11:07:03Z

@jhadvig: Overrode contexts on behalf of jhadvig: ci/prow/e2e-gcp-console, ci/prow/okd-scos-images

Details

In response to this:

Overriding since this PR is only adding AI settings.
/override ci/prow/e2e-gcp-console ci/prow/okd-scos-images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci-robot · 2026-01-06T19:32:31Z

/retest-required

Remaining retests: 0 against base HEAD d00353d and 2 for PR HEAD c5de6ea in total

openshift-ci-robot · 2026-01-06T22:32:36Z

/retest-required

Remaining retests: 0 against base HEAD 9c70ba0 and 1 for PR HEAD c5de6ea in total

jhadvig · 2026-01-07T13:16:02Z

/override ci/prow/okd-scos-images

openshift-ci · 2026-01-07T13:16:20Z

@jhadvig: Overrode contexts on behalf of jhadvig: ci/prow/okd-scos-images

Details

In response to this:

/override ci/prow/okd-scos-images

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jhadvig · 2026-01-07T13:23:25Z

Overriding since we are only adding AI settings in this PR.
/override ci/prow/backend ci/prow/e2e-gcp-console ci/prow/frontend ci/prow/images ci/prow/analyze

openshift-ci · 2026-01-07T13:23:43Z

@jhadvig: Overrode contexts on behalf of jhadvig: ci/prow/analyze, ci/prow/backend, ci/prow/e2e-gcp-console, ci/prow/frontend, ci/prow/images

Details

In response to this:

Overriding since we are only adding AI settings in this PR.
/override ci/prow/backend ci/prow/e2e-gcp-console ci/prow/frontend ci/prow/images ci/prow/analyze

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

jhadvig · 2026-01-07T14:59:57Z

Overriding the TC since we are only adding a AI config file
/override ci/prow/backend

openshift-ci · 2026-01-07T15:00:17Z

@jhadvig: Overrode contexts on behalf of jhadvig: ci/prow/backend

Details

In response to this:

Overriding the TC since we are only adding a AI config file
/override ci/prow/backend

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-01-07T15:03:52Z

@sg00dwin: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 8, 2025

openshift-ci bot requested review from rhamilto and spadgett December 8, 2025 16:29

sg00dwin changed the title ~~[WIP] Add Claude Code settings configuration~~ NO-JIRA: Add Claude Code settings configuration Dec 12, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Dec 12, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 12, 2025

sg00dwin assigned jhadvig Dec 12, 2025

jhadvig requested changes Jan 5, 2026

View reviewed changes

sg00dwin added 2 commits January 5, 2026 13:39

Add Claude Code settings configuration

17903f3

Configures permissions for Claude Code AI assistant with allow/deny/ask rules for common development commands including testing, linting, git operations, and cluster management. Assisted by Claude Code

Update commands to no include colon

aca4c0d

sg00dwin force-pushed the claude-code-settins branch from 31d648c to aca4c0d Compare January 5, 2026 19:07

openshift-ci bot added the tide/merge-method-squash Denotes a PR that should be squashed by tide when it merges. label Jan 5, 2026

coderabbitai bot reviewed Jan 5, 2026

View reviewed changes

jhadvig reviewed Jan 5, 2026

View reviewed changes

Replace git remove with git remote

c5de6ea

coderabbitai bot reviewed Jan 5, 2026

View reviewed changes

jhadvig approved these changes Jan 5, 2026

View reviewed changes

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Jan 5, 2026

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jan 5, 2026

jhadvig added docs-approved Signifies that Docs has signed off on this PR qe-approved Signifies that QE has signed off on this PR labels Jan 6, 2026

jhadvig added px-approved Signifies that Product Support has signed off on this PR plugin-api-approved Indicates a PR with plugin API changes has been approved by an API reviewer labels Jan 6, 2026

sg00dwin added the verified Signifies that the PR passed pre-merge verification criteria label Jan 6, 2026

openshift-merge-bot bot merged commit 2552602 into openshift:main Jan 7, 2026
8 checks passed

NO-JIRA: Add Claude Code settings configuration #15819

NO-JIRA: Add Claude Code settings configuration #15819

Conversation

sg00dwin commented Dec 8, 2025

Uh oh!

coderabbitai bot commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

sg00dwin commented Dec 9, 2025

Uh oh!

sg00dwin commented Dec 12, 2025

Uh oh!

openshift-ci-robot commented Dec 12, 2025

Uh oh!

sg00dwin commented Jan 5, 2026

Uh oh!

jhadvig left a comment

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

sg00dwin commented Jan 5, 2026

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

jhadvig Jan 5, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai bot left a comment

Choose a reason for hiding this comment

Uh oh!

jhadvig left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jan 5, 2026

Uh oh!

jhadvig commented Jan 6, 2026

Uh oh!

openshift-ci bot commented Jan 6, 2026

Uh oh!

openshift-ci-robot commented Jan 6, 2026

Uh oh!

openshift-ci-robot commented Jan 6, 2026

Uh oh!

jhadvig commented Jan 7, 2026

Uh oh!

openshift-ci bot commented Jan 7, 2026

Uh oh!

jhadvig commented Jan 7, 2026

Uh oh!

openshift-ci bot commented Jan 7, 2026

Uh oh!

jhadvig commented Jan 7, 2026

Uh oh!

openshift-ci bot commented Jan 7, 2026

Uh oh!

Uh oh!

coderabbitai bot commented Dec 8, 2025 •

edited

Loading