trailofbits / trailofbits/claude-code-config

`merge-dependabot` evaluates five PRs in one working tree, then merges on the results

Open
#59 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
2.1k
Forks
161
Avg merge
3d 59m
Merged PRs (30d)
1

Description

commands/merge-dependabot.md:196-197 rules out worktrees:

Do NOT use wt switch — shallow clones do not support worktrees reliably. Use git checkout directly when evaluating each PR.

Then :199-206 launches up to five subagents in parallel, all handed the same {repo_path}, each instructed at STEP 1 to run:

cd {repo_path}
git fetch origin pull/{number}/head:pr-{number}
git checkout pr-{number}

Five agents checking out five branches in one working tree clobber each other non-deterministically. Each agent's build and test run evaluates whatever tree the most recent checkout left behind, so the PASS/FAIL verdicts don't reliably correspond to the PRs they're attributed to.

That matters because Phase 4 acts on those verdicts: :494-502 approves and merges. A verdict produced against the wrong tree is worse than no verdict.

This also contradicts the guidance in claude-md-template.md, which notes that subagents inherit the parent's working directory and that parallel agents writing files need real isolation.

The stated premise is also wrong

Shallow clones support git worktree fine. git worktree add works in a --depth clone; the limitation people usually hit is that a branch not present in the shallow history needs fetching first, which this command already does on the line above.

Suggested fix

Any of:

  • Give each subagent isolation: "worktree" (the Agent tool parameter), which handles placement and cleanup
  • Give each subagent its own clone directory
  • Keep the single tree and evaluate sequentially

If a single shared tree is kept for any reason, the parallel launch has to go — the two are mutually exclusive.


Found while reviewing the repo against Anthropic's current docs and the installed CLI (2.1.238). One of five separate findings from the same pass.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read commands/merge-dependabot.md:196-206 and :494-502, then compare its parallel agent launch with the isolation guidance in claude-md-template.md. Reproduce or reason through concurrent checkouts, choose an isolation or sequential-evaluation approach, and verify that each verdict is produced from the corresponding PR before merge decisions are made.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, shell
Domain
devops, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.