safe-global / safe-client-gateway / 31181376382

88%

push

github

ci: close the number-prefix gap in the arch-review gh allowlist (#3330)

The Architecture Check workflow pins its allowed `gh` commands to the triggering PR's number, but the bare `<N>:*` entries are string-prefix matches: a pin to PR 123 also allowed `gh pr comment 1234`. Since the agent reads the (untrusted) PR diff, a successful prompt injection could have steered the verdict comment at any same-repo PR whose number string-extends the triggering one — defeating the pin's stated intent.
Each entry now bounds the number with the space-delimited token the prompt already mandates (`--json`, `--name-only`, `--body`), plus an exact match for the bare `gh pr diff <N>`, so the pin is number-exact and the "cannot redirect" comment in the workflow (and in docs/agents/agent-tooling.md) is accurate as written. Impact was low — worst case a bogus bot comment on a neighboring PR — but the fix is one line.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

3812 of 4542 branches covered (83.93%)

Branch coverage included in aggregate %.

9854 of 10915 relevant lines covered (90.28%)

509.8 hits per line