From 5eb4e3701d88cf31420a50fcd1dbf26ed6448408 Mon Sep 17 00:00:00 2001
From: Tony <TonyRL@users.noreply.github.com>
Date: Wed, 3 Jun 2026 12:35:07 +0800
Subject: [PATCH] chore: update allowed commands in PR review script

---
 .github/workflows/pr-review.yml | 26 +++++++++++++++++---------
 1 file changed, 17 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index eb1cf4085..512b7b734 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -87,18 +87,26 @@ jobs:
                       {
                         "bash": {
                           "*": "deny",
-                          "gh auth*": "allow",
-                          "gh pr*": "allow",
-                          "gh api*": "allow",
-                          "gh search*": "allow",
-                          "grep*": "allow",
-                          "git*": "allow",
-                          "ls*": "allow",
-                          "sed*": "allow",
+                          "base64*": "allow",
                           "cat*": "allow",
                           "echo*": "allow",
+                          "gh api*": "allow",
+                          "gh auth*": "allow",
+                          "gh pr comment*": "allow",
+                          "gh pr diff*": "allow",
+                          "gh pr view*": "allow",
+                          "gh repo view*": "allow",
+                          "gh search*": "allow",
+                          "git diff*": "allow",
+                          "git log*": "allow",
+                          "git show*": "allow",
+                          "git status*": "allow",
+                          "grep*": "allow",
                           "head*": "allow",
-                          "base64*": "allow"
+                          "ls*": "allow",
+                          "sed*": "allow",
+                          "tail*": "allow",
+                          "wc*": "allow"
                         },
                         "webfetch": "deny"
                       }