v2.3.2

Codex reviewer reliability + Claude reviewer model upgrade.

• fix(codex-code): pin codex-version 0.135.0 — stops the floating-latest --server-info handshake flapping (#78)
• ci(claude-code): bump reviewer model to claude-opus-4-8 (#77)

Callers should re-pin to this tag. Codex callers can also bump model gpt-5.4 → gpt-5.5 (validated accessible).

v2.0.10 — external-contrib-notify: parameterize Harden-Runner

Summary

Closes the last cross-workflow asymmetry. All four workflows that use Harden-Runner (go-ci, go-security, claude-code, external-contrib-notify) now parameterize it via the same 3-input pattern.

Changes to external-contrib-notify.yml

• Added enable-harden-runner (bool, default true)
• Added harden-runner-policy (audit | block, default audit)
• Added harden-runner-allowed-endpoints (newline-separated, default "")

Defaults preserve today's behavior. Zero caller breakage.

For callers who want to enable block mode

jobs:
  notify:
    uses: praetorian-inc/public-workflows/.github/workflows/external-contrib-notify.yml@135c50049eeef6e664bd7ea4aacaa33118083e30  # v2.0.10
    with:
      harden-runner-policy: "block"
      harden-runner-allowed-endpoints: |
        api.github.com:443
        api.linear.app:443
        slack.com:443
        hooks.slack.com:443
    secrets: inherit

Why this matters

external-contrib-notify.yml handles high-value secrets (LINEAR_API_KEY, SLACK_BOT_TOKEN, GitHub App private key). Block mode prevents exfiltration to attacker-controlled domains if the workflow ever runs compromised code.

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/external-contrib-notify.yml@135c50049eeef6e664bd7ea4aacaa33118083e30  # v2.0.10

Backwards compatible — rebump at your convenience.

v2.0.9 — preflight + Harden-Runner

Summary

Two centralized additions to the reusable Claude PR reviewer:

1. Preflight job skips Claude on docs-only PRs (saves ~$5-10k/yr in Opus tokens). Short-circuits to run when @claude mentioned (override preserved). Paginated file list (handles PRs >100 files per cli/cli#5368).
2. Harden-Runner on both jobs — closes the asymmetry with go-ci.yml / go-security.yml. Parameterized (enable-harden-runner, harden-runner-policy, harden-runner-allowed-endpoints). Default audit mode = no caller breakage.

Caller pin

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@c4e898f83b9c4008cc3dbe295cc420e53ec6b16b  # v2.0.9

Bot-review credits

• Codex + CodeRabbit (independently) caught the @claude override regression on docs-only PRs — fixed.
• Codex caught the gh pr view --json files 100-file cap — fixed via paginated gh api.

v2.0.8 — cost opt: Opus + first-open + no MCP + simpler prompt

Summary

Cost-optimizes the Claude reviewer to ~3x cheaper while raising review quality:

• Opus 4.7 hardcoded — senior-engineer model for the single review
• First-open only — drops synchronize trigger; CodeRabbit + Codex handle per-push
• No MCP inline tool — cuts 3-5k tokens/turn overhead; CodeRabbit covers inline review
• Simpler prompt — 3 sections (Critical / Security / Test coverage), defers style nits to CodeRabbit + Codex
• --max-turns 15 — headroom for Opus to complete simpler prompt

Caller pin

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@98b351a8f9a0876d65c8c80c4d5a273d2310ba99  # v2.0.8

Cost estimate (46 repos × 10 PRs/week)

• Before v2.0.8 (Sonnet + MCP + every push): ~$60-72k/yr
• After v2.0.8 (Opus + first-open + no MCP): ~$15-25k/yr

Security posture unchanged — same head.repo check, --disallowedTools floor, defensive system prompt, CODEOWNERS.

v2.0.6 — root-cause fix (public repos auto-review)

Root cause diagnosed

v2.0.3-v2.0.5 silently skipped every Claude run on public repos. Empirical debug on titus PR #180 proved github.event.pull_request.author_association returned CONTRIBUTOR (not MEMBER) in the webhook event payload for org members on public repos, even though the REST API returned MEMBER.

Fix

Replace author_association check with:

github.event.pull_request.head.repo.full_name == github.repository

Strictly stronger: deterministic, no quirky per-repo field resolution, equally secure (blocks fork PRs and the comment-and-control path).

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@4e998eb54df4946e9b8547e20da8148f2a57499a  # v2.0.6

All v2.0.3-v2.0.5 callers should bump to v2.0.6 immediately — prior versions silently skip on public repos.

v2.0.5 — fix author_association skip bug

Fix

contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), X) was silently evaluating to false in the reusable-workflow job-level if:, causing v2.0.3/v2.0.4 to skip all runs for valid insider PRs. Replaced with explicit string equality.

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@37b9b30d48f40522305e01a1ea5eaf32bc346d7a  # v2.0.5

All callers on v2.0.3/v2.0.4 should bump to v2.0.5 to actually get Claude reviewing PRs. No semantic changes — just the skip bug.

v2.0.4 — P0 comment-and-control fix

P0 fix (CVSS 9.4, Anthropic bounty-acknowledged)

Closes the "comment and control" attack path that was still reachable in v2.0.3:

1. External contributor opens PR with prompt-injection payload in body/diff
2. Internal maintainer comments @claude to request review
3. v2.0.3's author_association check on the commenter passes (MEMBER)
4. Claude reads PR body/diff = external content → follows injected instructions
5. Within allowed tools (Bash(gh pr comment:*)), Claude exfiltrates secrets/env

Fixes

• P0-1: pull_request_review_comment now requires BOTH the commenter AND the PR author to be insiders. @claude on external PR blocked at trigger.
• P0-2: Explicit track_progress: "false" — locks the action against #860 union-merge if upstream default ever flips.
• Expanded --disallowedTools: + Bash(git add|commit|push|rm:*).
• --append-system-prompt defensive preamble: system-level instruction to treat PR content as untrusted, never read secrets/env, stop on injection attempts.

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@1da9a5e29de06e850035b01e1ab5c0e19435ba30  # v2.0.4

All prior v2.0.x callers should bump to v2.0.4 — see ENG-3113.

v2.0.3 — hardened Claude PR reviewer

Bundles #18 + #19 into one release.

What's in v2.0.3

PR #18 — core hardening:

• author_association gate blocks prompt-injection from external PRs
• --allowedTools restricts Claude to Bash(gh pr comment/diff/view:*), Read, Grep, Glob
• direct_prompt → prompt (v1 idiom with hardened content handling)
• --max-turns 10

PR #19 — inline review + defense-in-depth:

• mcp__github_inline_comment__create_inline_comment added — CodeRabbit-style line-anchored review, Anthropic's purpose-built MCP, scoped to current PR
• --disallowedTools floor blocks curl/wget/gh api/gh auth/Write/Edit/MultiEdit even if allowlist is ever re-expanded (defense vs claude-code-action#860)
• CODEOWNERS requires praetorian-inc/security-engineering review on future claude-code.yml changes

Caller pin line

uses: praetorian-inc/public-workflows/.github/workflows/claude-code.yml@704fc675c55d6af6e5536a1e416a1400a1e28c2f  # v2.0.3

Migration tracking

• ENG-3113 — 45 existing callers (12 stale-SHA urgent, 33 @main pin-for-hygiene)
• ENG-3114 — 3 direct anthropics/claude-code-action callers to migrate