Commit 317fe483010 for woocommerce

commit 317fe483010e9a9aac826de977aaf6e8a3c6e69c
Author: Darren Ethier <darren@roughsmootheng.in>
Date:   Fri Sep 4 13:12:53 2026 -0400

    Restrict Claude Code tool set in User-Facing Documentation Check workflow (#68382)

    The workflow only needs the two allowlisted gh commands and the structured
    output. Explicitly disallow file, search, and web tools so the analysis step
    cannot use anything beyond what the prompt requires.

diff --git a/.github/workflows/docs-needed-detection.yml b/.github/workflows/docs-needed-detection.yml
index b1f825e8ba2..d5843d47608 100644
--- a/.github/workflows/docs-needed-detection.yml
+++ b/.github/workflows/docs-needed-detection.yml
@@ -36,6 +36,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           claude_args: >
             --allowedTools "Bash(gh pr diff *),Bash(gh pr view *)"
+            --disallowedTools "Read,Glob,Grep,WebFetch,WebSearch,Edit,Write"
             --json-schema '{"type":"object","properties":{"needs_docs":{"type":"boolean"},"confidence":{"type":"string","enum":["high","medium","low"]},"reason":{"type":"string"}},"required":["needs_docs","confidence","reason"]}'
           prompt: |
             Docs update detection for WooCommerce