fix: quote --allowedTools in issue-triage workflow

[keeb]

Summary

• Fix /triage command failure caused by shell-quote parsing of unquoted Bash(...) patterns in claude_args
• Wraps the --allowedTools value in single quotes so spaces and parentheses are preserved as a single token

Root Cause

claude-code-action uses shell-quote to parse claude_args. The Bash(...) patterns added in #852 contain spaces (e.g. Bash(gh api --method POST:*/reactions)), which caused:

1. Parentheses treated as shell operators and stripped
2. Space-splitting broke patterns into separate tokens
3. --method parsed as a standalone CLI flag, corrupting the entire argument structure
4. Claude Code crashed with exit code 1

Confirmed by workflow logs from the failed #902 triage — allowed tools were ["Read", "Glob", "Grep", "Bash", "gh", "issue", "api"] instead of the intended patterns.

Fixes #904

Test plan

• Re-run /triage on vault.get() regex does not support spaces in vault names or secret keys #902 after merge and verify it completes successfully
• Verify the workflow logs show the correct Bash(...) patterns in allowedTools

🤖 Generated with Claude Code

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

None.

Clean, well-scoped fix. The single-quote wrapping correctly preserves the Bash(...) patterns as a single token when shell-quote parses claude_args. The root cause analysis is thorough and the fix directly addresses the parsing issue that caused the triage failure.

[github-actions]

CI Security Review

Critical / High

None.

Medium

1. anthropics/claude-code-action@v1 not pinned to SHA (.github/workflows/issue-triage.yml:56): Third-party actions should be pinned to a full commit SHA to prevent supply chain attacks via tag mutation. While Anthropic is a trusted publisher, best practice is SHA pinning for all non-GitHub-owned actions. Pre-existing issue, not introduced by this PR.

Low

None.

Verdict

PASS — This change is a security improvement. The previous unquoted --allowedTools value was being parsed incorrectly by shell-quote, resulting in the LLM receiving an unrestricted Bash tool instead of the intended scoped Bash(gh issue view:*) / Bash(gh issue comment:*) / Bash(gh api --method POST:*) / Bash(gh api --method PATCH:*) patterns. The single-quote fix ensures the tool restrictions are properly enforced.

Pre-existing security posture review (not blocking):

• ✅ Prompt injection: Issue content is fetched by the LLM via tool calls, not interpolated into the prompt. Security preamble is present.
• ✅ Expression injection: Only numeric values (issue.number, comment.id) and repo name are interpolated in run: blocks.
• ✅ Trigger safety: issue_comment trigger is gated to OWNER/MEMBER/COLLABORATOR via author_association check.
• ✅ Permissions: Minimal (contents: read, issues: write), appropriate for a single-job workflow.
• ✅ Tool scoping: Allowed tools are tightly scoped to issue view/comment and specific API method+path patterns.
• ⚠️ SHA pinning: anthropics/claude-code-action@v1 should be pinned to a commit SHA (medium, pre-existing).