Repository navigation
fix(github): Point clone guidance at github_cloneRepository - #2165
Merged
Merged
Conversation
github_cloneRepository checks for a matching Workspace before it clones. A raw git clone or gh repo clone in bash skipped that check, so an agent could make an ad-hoc checkout without the Workspace setup script. The GitHub plugin beforeToolExecute hook now denies bash commands that clone a GitHub repository and points the agent to github_cloneRepository. Egress policy cannot do this because clone and fetch use the same git-upload-pack requests. The github-code skill and SETUP.md no longer recommend gh repo clone. The self-update skill uses the clone tool with allowAdHoc, so it keeps the app checkout instead of switching Workspaces. Co-Authored-By: David Cramer <david@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit afd5892. Configure here.
Parsing bash commands to find clones is brittle. Cursor Bugbot found a heredoc false positive, and more shell cases would follow. Remove clone-policy.ts and the beforeToolExecute denial. Keep the skill and doc changes. They point agents to github_cloneRepository, which checks for a matching Workspace, and stop recommending gh repo clone. Co-Authored-By: David Cramer <david@sentry.io>
github-actions
Bot
added
risk: medium
sentry-junior
Bot
changed the title
dcramer
approved these changes
Oct 16, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
github_cloneRepositorychecks for a matching Workspace before it clones. A rawgit cloneorgh repo cloneskips that check, so the agent can work in a checkout without the Workspace setup. Thegithub-codeskill recommendedgh repo cloneas the default clone command.This PR points all clone guidance at
github_cloneRepository.Changes
github-codeskill: the action table andapi-surface.mdsay to usegithub_cloneRepository, notgit cloneorgh repo clone. Thegh repo clonetroubleshooting row and the note about clone flags are removed.workflow.md: clone withgithub_cloneRepositorywhen no checkout or Workspace exists.SETUP.md: CLI usage points to the tool.self-updateskill: callsgithub_cloneRepositorywithallowAdHoc: true, then runsfetch --deepen=200. A Workspace switch would replace the sandbox and remove the app checkout.Checks
pnpm skills:checkpnpm --filter @sentry/junior-github typecheckvia David Cramer.
--
View Junior Session [Sentry]