feat(workflows): paths-file input for the security lane + Phase 2 close-out

[kyle-sexton]

Reusable-side prerequisite for the Phase 3 caller components (docs/topics/claude-review-lanes/PLAN.md, item 3a): the security lane gains a paths-file input so each consumer keeps its security-sensitive-surface list in its own tree at the conventional .github/claude-security-paths, instead of inlining it in the synced caller.

• Precedence: non-empty inline paths wins (unchanged semantics, file never fetched); else paths-file is fetched from the PR's base repository at the base branch via the contents API inside the existing github-script step — no checkout added; both empty → every call relevant (byte-compatible with today).
• Fail-open discipline throughout: absent file, fetch error, non-string response, or vacuous content → relevant=true with a warning. A matcher fault can never silently skip a required security review.
• The changes job gains only contents: read (single-blob read; the job stays checkout-free). Base workflow's security-review job already required contents: read, so no existing caller breaks.
• PLAN.md: Phase 2 marked [DONE] with close-out evidence (PR feat(workflows): Claude lane feature set — config currency, cadence, retry, kill-switches, copy (PR-B, 2b-2i) #280 / cf666f67, kill-switch dogfood, v0.9.0); Phase 3 [DOING].

Verification: fresh-context verifier ran a 13-case base/head differential (byte-identical semantics on all pre-existing paths) plus a 15-case adversarial fail-open matrix — verdict SHIP; its two findings (trust-boundary wording, vacuous-file regression pin) are folded in. 286 script tests green; actionlint clean; zizmor identical to base.

Related

No linked issue — part of the claude-review-lanes effort (Phase 3a prerequisite).

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 3m 6s —— View job

---

Code Review Todo

• Gather context (read diff, changed files, PLAN.md)
• Review .github/workflows/claude-security-review.yml changes
• Review .github/scripts/claude-security-review-fail-closed.test.cjs changes
• Review docs/topics/claude-review-lanes/PLAN.md changes
• Post final review feedback

Review (code-review lane — security findings out of scope per REVIEW.md, owned by the security lane)

Solid, well-documented change. The precedence (paths > paths-file > none), the fail-open discipline (absent/unreadable file, vacuous pattern list, listing failure), and the header/consumer-contract docs are all internally consistent — I traced every branch of the new logic in claude-security-review.yml (both the github-script fetch step and the Determine security relevance shell step) and didn't find a correctness gap. Job-level contents: read addition on changes is correctly scoped and matches the "own the minimal grant at the job level" convention already used elsewhere in this file.

One non-blocking observation on test maintainability:

• claude-security-review-fail-closed.test.cjs#L279-L289 — the assert.match against a literal multi-line regex (hardcoded to 14-space indentation) duplicates coverage already provided by the executable runFilter-based test a few lines down (a failed paths-file fetch fails open to relevant, L380), which verifies the same fail-open behavior by actually running the script rather than pattern-matching its source. The regex assertion is brittle to reformatting (e.g. a future indentation or wording tweak in the echo lines would break the test without any behavior change). Not blocking — this style is already used elsewhere in the file for intent-level checks (e.g. "the fetch pins the base ref, never the head") — but the fail-open portion of that assertion could be dropped in favor of the functional test below it, since it verifies nothing the executable test doesn't already cover. Fix this →

Also confirmed: PLAN.md's Phase 2 close-out and Phase 3 [DOING] transition line up with the referenced PR #280 / cf666f67, and the new paths-file shape matches what Phase 3a of the plan already describes as the prerequisite.

[claude]

Claude finished @kyle-sexton's task in 1m 45s —— View job

---

Security review complete

• Gather context (diff, changed files, CLAUDE.md rules)
• Review claude-security-review.yml workflow changes
• Review test file changes
• Review PLAN.md changes
• Post findings

Findings

None. No security issues found in this PR's changes.

What I checked

.github/workflows/claude-security-review.yml — the new paths-file fetch logic in the changes job:

• Trust boundary is correctly enforced. The paths-file is fetched via github.rest.repos.getContent with ref: context.payload.pull_request.base.ref, and context.repo resolves to the base repository even for fork-originated PRs on pull_request events. A PR (including a fork PR) cannot alter the file's content to skip its own review — matches the stated contract at claude-security-review.yml#L175-L183 and is pinned by a dedicated test (the paths file is read from the base branch and its faults fail open).
• No script injection surface. All untrusted/config-controlled values (PATHS, PATHS_FILE, file paths) are threaded through env: and read from process.env / shell env vars — never interpolated directly as ${{ }} into a run: script body. The paths-file repo-relative path itself is caller/workflow-input-controlled, not PR-controlled, so it isn't an attacker-influenced value regardless.
• Fail-open discipline is consistent and matches the stated design: 404/unreadable file, non-string content (directory/submodule), and vacuous (comments/blank-only) content all resolve to relevant=true with a warning — verified against the new shell logic and its test coverage (precedence, vacuous-file, fetch-failure, both-empty cases).
• Permission grant is minimal and correctly scoped. The changes job gains only contents: read for a single-blob read via the Contents API; still no checkout. Consistent with the CLAUDE.md least-privilege rule for this lane.
• No trigger/permission-widening changes. security-review job permissions, the pull_request_target/workflow_run tripwire, kill-switches, and fork-skip logic are all unchanged by this diff.

Test file (claude-security-review-fail-closed.test.cjs) — only test-scaffolding changes (a step-boundary fix for the "no ${{ }} in run blocks" assertion helper, plus new precedence/fail-open test cases). Not part of the executed workflow surface; no security implications.

PLAN.md — documentation-only status update (Phase 2 → [DONE], Phase 3 → [DOING]). No code or config changes.

Per instructions, I deferred to zizmor's advisory lane for supply-chain/pin, trigger, and permission-class findings (the PR description notes zizmor output is unchanged from base).

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.