Skip to content

Add subprocess isolation setup and git credential helper#1132

Merged
OctavianGuzu merged 1 commit intomainfrom
oct/subprocess-isolation-setup
Mar 31, 2026
Merged

Add subprocess isolation setup and git credential helper#1132
OctavianGuzu merged 1 commit intomainfrom
oct/subprocess-isolation-setup

Conversation

@OctavianGuzu
Copy link
Copy Markdown
Collaborator

@OctavianGuzu OctavianGuzu commented Mar 30, 2026

  • Add optional bubblewrap setup step for Linux subprocess isolation when allowed_non_write_users is configured
  • Use git credential helper instead of embedding token in remote URL (cleaner auth flow)
  • edit-issue-labels.sh: read issue number from workflow event context instead of CLI arg
  • Add CLAUDE_CODE_SCRIPT_CAPS env for per-script call limit configuration
  • docs/security.md: note recommended github_token configuration

@OctavianGuzu OctavianGuzu force-pushed the oct/subprocess-isolation-setup branch 4 times, most recently from 8b5ce78 to e6a61c3 Compare March 30, 2026 13:21
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Mar 30, 2026

allowed_non_write_users detected

This PR adds or modifies allowed_non_write_users, which allows users without write access to trigger Claude Code Action workflows. This can introduce security risks.

If this is a new flow, please make sure you actually need allowed_non_write_users. If you are editing an existing workflow, double check that you are not adding new Claude permissions which might lead to a vulnerability.

See existing workflows in this repo for safe usage examples, or contact the AppSec team.

@OctavianGuzu OctavianGuzu force-pushed the oct/subprocess-isolation-setup branch 8 times, most recently from 1d6c19e to 2bd44ce Compare March 30, 2026 15:01
@OctavianGuzu OctavianGuzu marked this pull request as ready for review March 30, 2026 15:20
@OctavianGuzu OctavianGuzu force-pushed the oct/subprocess-isolation-setup branch from 2bd44ce to ac01071 Compare March 30, 2026 15:53
@OctavianGuzu
Add subprocess isolation setup and git credential helper
9d5b751 
- Add optional bubblewrap setup step for Linux subprocess isolation
  when allowed_non_write_users is configured
- Use git credential helper instead of embedding token in remote URL
- edit-issue-labels.sh: read issue number from workflow event payload
  instead of CLI arg
- Add CLAUDE_CODE_SCRIPT_CAPS env for per-script call limit config
- docs/security.md: note recommended github_token configuration

:house: Remote-Dev: homespace
@OctavianGuzu OctavianGuzu force-pushed the oct/subprocess-isolation-setup branch from ac01071 to 9d5b751 Compare March 30, 2026 16:21
@OctavianGuzu OctavianGuzu requested a review from ddworken March 30, 2026 17:02
@OctavianGuzu OctavianGuzu merged commit 32156b1 into main Mar 31, 2026
39 checks passed
@OctavianGuzu OctavianGuzu deleted the oct/subprocess-isolation-setup branch March 31, 2026 11:36
@FrontLeejonghun FrontLeejonghun mentioned this pull request Apr 1, 2026
Closed
1 task
@kacper-mikolajczak kacper-mikolajczak mentioned this pull request Apr 2, 2026
Merged
50 tasks
@github-actions github-actions Bot mentioned this pull request Apr 6, 2026
Merged
1 task
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Apr 6, 2026
@mergify
chore(deps): bump the github-actions group with 2 updates [skip ci]
04e7bbc 
Bumps the github-actions group with 2 updates: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [docker/login-action](https://github.com/docker/login-action).
Updates `anthropics/claude-code-action` from 1.0.82 to 1.0.88
Release notes

*Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).*

> v1.0.88
> -------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.88>
>
> v1.0.87
> -------
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.87>
>
> v1.0.86
> -------
>
> What's Changed
> --------------
>
> * Fix subprocess isolation install step not running by [`@​OctavianGuzu`](https://github.com/OctavianGuzu) in [anthropics/claude-code-action#1148](https://redirect.github.com/anthropics/claude-code-action/pull/1148)
> * Pass env to execFileSync git calls by [`@​OctavianGuzu`](https://github.com/OctavianGuzu) in [anthropics/claude-code-action#1151](https://redirect.github.com/anthropics/claude-code-action/pull/1151)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.86>
>
> v1.0.85
> -------
>
> What's Changed
> --------------
>
> * fix: fall back to repo default\_branch instead of hardcoded "main" by [`@​ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1143](https://redirect.github.com/anthropics/claude-code-action/pull/1143)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.85>
>
> v1.0.84
> -------
>
> What's Changed
> --------------
>
> * Pin Claude Code to 2.1.87 by [`@​ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1142](https://redirect.github.com/anthropics/claude-code-action/pull/1142)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.84>
>
> v1.0.83
> -------
>
> What's Changed
> --------------
>
> * Add subprocess isolation setup and git credential helper by [`@​OctavianGuzu`](https://github.com/OctavianGuzu) in [anthropics/claude-code-action#1132](https://redirect.github.com/anthropics/claude-code-action/pull/1132)
>
> **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.83>


Commits

* [`1eddb33`](anthropics/claude-code-action@1eddb33) chore: bump Claude Code to 2.1.92 and Agent SDK to 0.2.92
* [`0432df8`](anthropics/claude-code-action@0432df8) chore: bump Claude Code to 2.1.91 and Agent SDK to 0.2.91
* [`ba026a3`](anthropics/claude-code-action@ba026a3) Pass env to execFileSync git calls ([#1151](https://redirect.github.com/anthropics/claude-code-action/issues/1151))
* [`c95e735`](anthropics/claude-code-action@c95e735) Fix subprocess isolation install step never running ([#1148](https://redirect.github.com/anthropics/claude-code-action/issues/1148))
* [`58dbe8e`](anthropics/claude-code-action@58dbe8e) chore: bump Claude Code to 2.1.90 and Agent SDK to 0.2.90
* [`c281e17`](anthropics/claude-code-action@c281e17) fix: fall back to repo default\_branch instead of hardcoded "main" ([#1143](https://redirect.github.com/anthropics/claude-code-action/issues/1143))
* [`408a40e`](anthropics/claude-code-action@408a40e) Pin Claude Code to 2.1.87 ([#1142](https://redirect.github.com/anthropics/claude-code-action/issues/1142))
* [`bee87b3`](anthropics/claude-code-action@bee87b3) chore: bump Claude Code to 2.1.89 and Agent SDK to 0.2.89
* [`32156b1`](anthropics/claude-code-action@32156b1) Add subprocess isolation setup and git credential helper ([#1132](https://redirect.github.com/anthropics/claude-code-action/issues/1132))
* [`7225f04`](anthropics/claude-code-action@7225f04) chore: bump Claude Code to 2.1.88 and Agent SDK to 0.2.88
* See full diff in [compare view](anthropics/claude-code-action@88c168b...1eddb33)
  
Updates `docker/login-action` from 4.0.0 to 4.1.0
Release notes

*Sourced from [docker/login-action's releases](https://github.com/docker/login-action/releases).*

> v4.1.0
> ------
>
> * Fix scoped Docker Hub cleanup path when registry is omitted by [`@​crazy-max`](https://github.com/crazy-max) in [docker/login-action#945](https://redirect.github.com/docker/login-action/pull/945)
> * Bump `@​aws-sdk/client-ecr` and `@​aws-sdk/client-ecr-public` to 3.1020.0 in [docker/login-action#930](https://redirect.github.com/docker/login-action/pull/930)
> * Bump `@​docker/actions-toolkit` from 0.77.0 to 0.86.0 in [docker/login-action#932](https://redirect.github.com/docker/login-action/pull/932) [docker/login-action#936](https://redirect.github.com/docker/login-action/pull/936)
> * Bump brace-expansion from 1.1.12 to 1.1.13 in [docker/login-action#952](https://redirect.github.com/docker/login-action/pull/952)
> * Bump fast-xml-parser from 5.3.4 to 5.3.6 in [docker/login-action#942](https://redirect.github.com/docker/login-action/pull/942)
> * Bump flatted from 3.3.3 to 3.4.2 in [docker/login-action#944](https://redirect.github.com/docker/login-action/pull/944)
> * Bump glob from 10.3.12 to 10.5.0 in [docker/login-action#940](https://redirect.github.com/docker/login-action/pull/940)
> * Bump handlebars from 4.7.8 to 4.7.9 in [docker/login-action#949](https://redirect.github.com/docker/login-action/pull/949)
> * Bump http-proxy-agent and https-proxy-agent to 8.0.0 in [docker/login-action#937](https://redirect.github.com/docker/login-action/pull/937)
> * Bump lodash from 4.17.23 to 4.18.1 in [docker/login-action#958](https://redirect.github.com/docker/login-action/pull/958)
> * Bump minimatch from 3.1.2 to 3.1.5 in [docker/login-action#941](https://redirect.github.com/docker/login-action/pull/941)
> * Bump picomatch from 4.0.3 to 4.0.4 in [docker/login-action#948](https://redirect.github.com/docker/login-action/pull/948)
> * Bump undici from 6.23.0 to 6.24.1 in [docker/login-action#938](https://redirect.github.com/docker/login-action/pull/938)
>
> **Full Changelog**: <docker/login-action@v4.0.0...v4.1.0>


Commits

* [`4907a6d`](docker/login-action@4907a6d) Merge pull request [#930](https://redirect.github.com/docker/login-action/issues/930) from docker/dependabot/npm\_and\_yarn/aws-sdk-dependenc...
* [`1e233e6`](docker/login-action@1e233e6) chore: update generated content
* [`6c24ead`](docker/login-action@6c24ead) build(deps): bump the aws-sdk-dependencies group with 2 updates
* [`ee034d7`](docker/login-action@ee034d7) Merge pull request [#958](https://redirect.github.com/docker/login-action/issues/958) from docker/dependabot/npm\_and\_yarn/lodash-4.18.1
* [`1527209`](docker/login-action@1527209) Merge pull request [#937](https://redirect.github.com/docker/login-action/issues/937) from docker/dependabot/npm\_and\_yarn/proxy-agent-depen...
* [`d39362a`](docker/login-action@d39362a) build(deps): bump lodash from 4.17.23 to 4.18.1
* [`a6f092b`](docker/login-action@a6f092b) chore: update generated content
* [`60953f0`](docker/login-action@60953f0) build(deps): bump the proxy-agent-dependencies group with 2 updates
* [`62c6885`](docker/login-action@62c6885) Merge pull request [#936](https://redirect.github.com/docker/login-action/issues/936) from docker/dependabot/npm\_and\_yarn/docker/actions-to...
* [`102c0e6`](docker/login-action@102c0e6) chore: update generated content
* Additional commits viewable in [compare view](docker/login-action@b45d80f...4907a6d)
  
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore  major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore  minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore  ` will remove the ignore condition of the specified dependency and ignore conditions
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ddworken ddworken ddworken approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@OctavianGuzu @ddworken