actions/claude-code-action
1
0
Fork 0
mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-22 03:18:54 +08:00
Code Issues Packages Projects Releases Wiki Activity

Invoke the formatter directly from the format hook (#1594)

Browse Source 
* Invoke the formatter directly from the format hook

The PostToolUse format hook now runs prettier directly with a pinned
version and --no-config instead of going through the package.json
"format" script, so the hook resolves the same way regardless of the
scripts and formatter config in the checked-out tree. Output matches
the previous "bun run format" (both .prettierrc files are empty).

Also documents which paths the action restores from the PR base branch
and recommends keeping base-branch hooks self-contained.

No-Verification-Needed: config, comment, and doc-only change

* Qualify the self-contained hook guidance for Bun-only runners

Note in docs/security.md and the restore-config JSDoc that bunx runs the
tool under node when node is on PATH, but on a Bun-only runner Bun runs
the script itself and reads bunfig.toml (preload etc.) from the
checkout, so that file and .npmrc are runtime config from the PR head.

No-Verification-Needed: comment- and doc-only change

* Exclude .claude-pr from prettier

No-Verification-Needed: prettierignore-only change
This commit is contained in:
Ashwin Bhat
2026-08-05 15:38:47 -07:00
committed by GitHub
parent 9db594c7a0
commit 4c04887769
4 changed files with 25 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/github/operations/restore-config.ts
+13
View File
@@ -86,6 +86,19 @@ function ensureClaudePrExcludedFromGit(): void {
* commits with `git add -A`, the revert will be included in that commit. This
* is a narrow UX tradeoff for closing the RCE surface.
*
* Only the paths listed in SENSITIVE_PATHS come from the base branch; the rest
* of the working tree stays at the PR head. A base-branch hook or setting that
* calls out through files a PR can change — package-manager scripts
* (`bun run`, `npm run`, `yarn`, `pnpm run`), Makefile or task-runner targets,
* repo-relative script paths, or tools that load executable project config —
* therefore runs whatever the PR head provides. Keep restored hooks
* self-contained: invoke the tool binary directly, pin its version, and pass
* config on the command line rather than reading it from the checkout. This
* extends to the runtime itself: `bunx <tool>` runs the tool under `node` when
* `node` is on PATH, but on a Bun-only runner Bun executes the script and reads
* `bunfig.toml` (e.g. `preload`) from the checkout, so `bunfig.toml` and
* `.npmrc` there are PR-controlled runtime config too.
*
* @param baseBranch - PR base branch name. Must be pre-validated (branch.ts
* calls validateBranchName on it before returning).
*/