ci: add tool constraints to pr-severity prompt
What the developer wrote
Authored by Olaoluwa Osuntokun
ci: add tool constraints to pr-severity prompt
Claude keeps trying to use `gh api` to add severity labels, which gets
denied by the allowed tools restriction. Instead of retrying with the
permitted `gh pr edit --add-label` command, it silently gives up and
only posts the comment. The result is that severity comments appear on
PRs but the actual labels are never applied.
Add an explicit tool constraints section at the top of the prompt so
Claude knows upfront that only `gh pr view`, `gh pr edit`, and
`gh pr comment` are available.
What changed, and why it matters
This commit updates an internal GitHub Actions workflow prompt that tells an AI assistant (Claude) which GitHub CLI commands it is allowed to use when classifying pull request severity. It is purely a CI/infrastructure instruction change and does not touch any production code, cryptography, networking, or user-facing functionality. There is no security vulnerability or security fix here.
No security action required. This is a normal CI workflow maintenance commit.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change adds a ‘Tool Constraints’ block to .github/workflows/pr-severity.yml, explicitly restricting the AI severity classifier to gh pr view, gh pr edit, and gh pr comment, and prohibiting gh api and other gh subcommands. This is a prompt-engineering fix for a workflow automation that was failing to apply severity labels to PRs. It affects no runtime LND code, no secrets handling, no permissions, and no network or consensus logic.
Changed components
.github/workflows/pr-severity.ymlInspect captured patch +12 / −0
diff --git a/.github/workflows/pr-severity.yml b/.github/workflows/pr-severity.yml
index dcf6677..10c672d 100644
--- a/.github/workflows/pr-severity.yml
+++ b/.github/workflows/pr-severity.yml
@@ -49,6 +49,18 @@ jobs:
prompt: |
You are a PR severity classifier for the lnd (Lightning Network Daemon) repository.
+ ## Tool Constraints
+
+ You ONLY have access to these commands:
+ - `gh pr view` - to read PR metadata
+ - `gh pr edit` - to add/remove labels
+ - `gh pr comment` - to post comments
+
+ You do NOT have access to `gh api`, `gh label`, or any other
+ `gh` subcommand. Do not attempt to use them. For ALL label
+ operations, use `gh pr edit` with `--add-label` or
+ `--remove-label`.
+
## Your Task
Analyze PR #${{ github.event.pull_request.number }} and:
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.