fix(ci): allow the cursor bot to trigger Claude Code Review - #722
Conversation
Every PR push made by the Cursor cloud agent fails the claude-review job with "Workflow initiated by non-human actor: cursor (type: Bot)". Add cursor to the existing allowed_bots list, alongside github-actions.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe Claude Code Review workflow now permits pull requests from both ChangesClaude review workflow
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: 🔵 Low · up to The workflow now lets Cursor-authored pull requests invoke Claude review, but it does not explicitly restrict that access to trusted same-repository PRs. Because the job uses a Claude credential and OIDC token issuance, external-PR behavior should be verified or constrained; the change is otherwise mergeable with explicit owner awareness. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| # branches on our own PRs. The review prompt below is fixed by this | ||
| # workflow, so an allowed bot cannot influence what Claude is asked | ||
| # to do -- it only gets the same code review a human push would. | ||
| allowed_bots: 'github-actions,cursor' |
There was a problem hiding this comment.
🔍 Required bot-path test is deferred
This R3 change lacks an automated test proving cursor[bot] passes while unlisted bots remain denied. The testing policy requires staging verification before merge.
Was this helpful? React with 👍 or 👎 to provide feedback.
| # branches on our own PRs. The review prompt below is fixed by this | ||
| # workflow, so an allowed bot cannot influence what Claude is asked | ||
| # to do -- it only gets the same code review a human push would. | ||
| allowed_bots: 'github-actions,cursor' |
There was a problem hiding this comment.
🟥 Bot-triggered reviews expose privileged credentials
Any cursor bot push can trigger a checkout and model review with OAuth and OIDC credentials. Fork or compromised-agent changes can target the action’s execution environment.
Was this helpful? React with 👍 or 👎 to provide feedback.
There was a problem hiding this comment.
Pull request overview
This PR updates the GitHub Actions workflow for Claude Code Review so that PR pushes performed by the Cursor Cloud Agent (cursor[bot]) no longer cause the claude-review job to fail the “non-human actor” validation in anthropics/claude-code-action@v1.
Changes:
- Extend
allowed_botsfromgithub-actionstogithub-actions,cursorso Cursor-originated PR pushes are accepted. - Expand the inline workflow comments to document why the bot is allowed and the intended security posture (named bot allow-list, fixed prompt, unchanged permissions).
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
Stale-PR nudge (24h, first one). Opened 2026-08-31T09:03Z, last touched 09:10Z — 24 hours idle, non-draft, no human review yet. Re-checked this morning: 18/18 substantive checks pass, 2 skipped ( One new data point from today's pass that's directly relevant. This morning's monthly
So the ask is unchanged and still one click: this is a security-posture decision (an allow-list on a public repo), which is why I left it for you rather than treating it as routine. The case for the named-bot form is in the PR body; Standing caveat, repeated because it matters at merge time: my own CI passing here proves nothing about the fix. I push as Posted by the WFL repo warden (automated triage pass). |
What was broken
Every push to a PR made by the Cursor cloud agent fails the
claude-reviewjob.Most recent instance: run 33315392206 on
cursor/setup-cloud-agent-env-2b67(PR #720), which failed in 1.6s with:This is not a flake and not a missing secret. The same branch went green at 13:15 and 13:36 and red at 13:53 — the only difference is the triggering actor:
triggering_actorlogbielogbiecursor[bot]logbieSo the job fails precisely when the Cursor agent itself pushes, and passes when a human pushes the same branch. As we use Cursor cloud agents more, this becomes a permanent red X on our own PRs — noise that trains us to ignore a review check.
Root cause
anthropics/claude-code-action@v1refuses non-Useractors unless they are named inallowed_bots(src/github/validation/actor.ts→checkHumanActor/isAllowedBot). Our workflow setsallowed_bots: 'github-actions', which was added for exactly this failure mode when the monthly SECURITY.md rotation PR hit it.cursor[bot]was never added.The fix
One-line list extension:
allowed_bots: 'github-actions'→'github-actions,cursor'.The action lowercases each entry and strips a trailing
[bot]on both sides before comparing, so the barecursorform is correct and matches the existinggithub-actionsstyle. This is the same remedy, from the same list, that already fixed the same error forgithub-actions.Security note — please make this call deliberately, it is not routine plumbing
allowed_botsis a security control, so I want to be explicit rather than slip this through as CI cleanup:'*'. The action's own docs warn that'*'on a public repo can let external Apps invoke the action with prompts they control; that risk is not taken here.prompt:is fixed by the workflow (/code-review:code-review ${{ github.repository }}/pull/...), so an allowed bot cannot steer what Claude is asked to do. It gets the same code review a human push would.id-token: write.cursor[bot]now gets reviewed rather than refused. That is the intended behaviour, but it is your integration and your judgement call — if you would rather gate the job off bot actors entirely (if: github.actor != 'cursor[bot]'), say so and I will send that instead.Verification
allowed_botssemantics confirmed by readingaction.yml("Comma-separated list of allowed bot usernames") and the matching logic insrc/github/validation/actor.tsandpermissions.tsinanthropics/claude-code-action.triggering_actorvalues read from the Actions REST API (table above).yaml.safe_loadafter the edit;runs-on: blacksmith-4vcpu-ubuntu-2404unchanged and still present in.github/actionlint.yaml.cargoin this sandbox; nothing in this change requires it.Test evidence
claude-reviewrun whosetriggering_actoriscursor[bot]completes instead of exiting 1 at the actor gate. The check is only observable in CI on a Cursor-pushed PR — there is no local harness for it.main's workflow, with the exact error above. Not manufactured.'*'deliberately avoided.TestPrograms/or language-behaviour surface is touched, so backward compatibility is not in play.Opened by the WFL repo warden (automated triage pass). I do not merge — this is for a human to review and decide.
Summary by CodeRabbit