claude-code-review's workflow_dispatch re-review posts a successful require-review check tied to the wrong commit SHA

[github-actions]

PR opened by @claude to address #285.

Triggered by workflow run.

Addresses #285.

[d-morrison]

Working on this --- paws off until I'm done.

(The @claude agent run that opened this draft committed the actual fix locally but failed to push: refusing to allow a GitHub App to create or update workflow .github/workflows/claude-review.yml without workflows permission. Re-implementing and pushing from this session instead.)

---

Generated by Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[d-morrison]

@claude review

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[github-actions]

👀 Picked up by workflow run #30109028583. Setup runs first; Claude itself responds after that.

[github-actions]

💰 Cost: $0.6025288

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

.github/workflows/claude.yml:928

• This step also runs under always(), but relies on PR_BRANCH coming from steps.pr_checkout.outputs.branch. If the checkout step failed earlier, PR_BRANCH will be empty and this dispatch attempt will still run. Guard against an empty PR_BRANCH before calling gh workflow run so the step degrades cleanly when checkout failed.

                  '[.[] | select((((.created_at // .submitted_at) // "") > $ts) and ((.body // "") | test("@claude review")) and ((.user.type // "") != "Bot"))] | length' ) || late=0
          if [ "${late:-0}" -gt 0 ]; then
            echo "Found $late late @claude review request(s) newer than $TRIGGER_TS; dispatching review."
            # --ref: see the comment on the earlier dispatch step above (#285).
            gh workflow run "$REVIEW_WF" --ref "$PR_BRANCH" -f pr_number="$PR_NUMBER" \
              || echo "::warning::Could not dispatch $REVIEW_WF for the late review request."

.github/workflows/claude.yml:959

• Because this step is always() it may run even when the PR checkout failed; in that case PR_BRANCH is empty but the workflow still attempts a dispatch with --ref "$PR_BRANCH". Add a guard to skip the dispatch when PR_BRANCH is empty so the review re-dispatch can’t run against an unintended ref.

          PR_NUMBER="${{ github.event.pull_request.number || github.event.issue.number }}"
          echo "before=$SHA_BEFORE  after=$SHA_AFTER"
          if [ -n "$SHA_AFTER" ] && [ "$SHA_AFTER" != "$SHA_BEFORE" ]; then
            echo "Claude pushed new commits; re-requesting reviewer and dispatching code review."
            if [ -n "$REVIEWER" ]; then
              gh api -X POST "repos/${{ github.repository }}/pulls/$PR_NUMBER/requested_reviewers" -f "reviewers[]=$REVIEWER" \
                || echo "::warning::Could not re-request $REVIEWER as reviewer."
            fi
            # --ref: see the comment on the earlier dispatch step above (#285).
            gh workflow run "$REVIEW_WF" --ref "$PR_BRANCH" -f pr_number="$PR_NUMBER" \
              || echo "::warning::Could not dispatch $REVIEW_WF."

[d-morrison]

Self-review (the automated claude-code-review reviewer can't run on this PR — it edits its own dispatch workflow, so the Skip self-review when the PR edits this workflow guard in claude-code-review.yml intentionally skips it until merge; require-review stays green because it treats that skip as passing).

Findings:

1. Fixed: the new changelog.d/fix-review-dispatch-wrong-sha.fixed.md fragment had a raw em-dash (U+2014), which this repo's ascii-punctuation-in-source convention bans in all tracked source, .md included. Replaced with -- in 89d7f8d.
2. Accepted as-is: the PR_BRANCH=$(gh api ... --jq '.head.ref') lookup is duplicated between claude-review.yml and its examples/claude-code-review.yml mirror. Treating this as expected wrapper/example-stub duplication (per this repo's own convention of keeping the two in sync) rather than extracting a new composite action for one gh api line.
3. Deferred: filed Review-dispatch --ref lookup can hard-fail for a fork-originated PR #289 — .head.ref has no owner prefix, so the new --ref would fail to resolve for a fork-originated PR (hard-failing claude-review.yml's dispatch-on-comment job specifically, since that call site has no || echo "::warning::..." fallback). Out of scope for this PR; claude-code-review's workflow_dispatch re-review posts a successful require-review check tied to the wrong commit SHA #286's fix is correct for the common same-repo case regardless.

Verified the --ref fix itself works empirically: this PR's own dispatched review run (30109069032) shows head_sha correctly matching the PR's actual head commit, not main's tip.

---

Generated by Claude Code