Tolerate extra whitespace in @claude review dispatch matcher

[dem-extra1]

Closes #315

WIP — opened up front to claim the issue; implementing now.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[claude]

Code review

Reviewed the diff (.github/workflows/claude.yml + changelog.d/claude-review-dispatch-whitespace-match.fixed.md) for correctness, security, and CLAUDE.md compliance.

Logic/security: The new Detect @claude review request step is sound — untrusted comment/review bodies are passed via env: (not interpolated into the shell script text, avoiding script injection), the bash [[:space:]]+ and jq \s+ regexes are equivalent and don't regress the single-space case, $GITHUB_OUTPUT wiring is correct, and both rewritten if: conditions preserve the original boolean structure. The if: steps.dedup.outputs.skip != 'true' gating is consistent with every other step in this job, so there's no gap of the kind CLAUDE.md's "widening a job's trusted-author gate" section warns about.

One finding posted inline: the new changelog fragment overstates its own diff — it says "the three gated steps ... now reference that step's output," but only two of the three edited call sites were converted to reference steps.review_request.outputs.match; the third (the late-arrival rescan's jq filter) kept its own independent regex, and never used contains() in the first place. See the inline comment for the specific lines and a suggested rewrite.

A secondary DRY concern (the same whitespace-tolerant match logic appearing a third time as an independent jq regex) was considered and set aside: that third site filters a freshly-fetched list of late-arriving comments/reviews, which is different data via a different mechanism (list-filter vs. a single job-level boolean) than the new step computes from the triggering event alone — not true duplication, and pre-existing before this PR.

Non-defect context for the human reviewer: this PR edits claude.yml itself, so per CLAUDE.md's "A PR fixing claude-code-review.yml (or claude.yml) itself can't self-verify before merge" section, any live dispatch test against this PR (e.g. commenting @claude review with a double space) will still run the pre-fix, released @v2 logic until this merges.

Verdict

Needs minor changes — the code change itself is correct and safe to merge; please fix the changelog fragment's inaccurate "three ... now reference" claim (inline comment) before merging.

[github-actions]

Claude finished review — View run

---

Review posted to PR #317.

Summary: The core fix in .github/workflows/claude.yml is correct and safe — untrusted comment/review bodies are passed via env: (no script-injection risk), the bash/jq whitespace regexes are equivalent and non-regressive, and the if: gating stays consistent with the rest of the job. One finding was posted inline: the new changelog fragment (changelog.d/claude-review-dispatch-whitespace-match.fixed.md) inaccurately claims "the three gated steps ... now reference that step's output," when only two of the three edited sites actually do — the third (the late-arrival rescan's jq filter) kept its own independent regex and never used contains() to begin with. This was independently flagged by two separate review agents and confirmed by direct inspection of the diff. A secondary DRY-duplication concern was investigated and ruled a false positive (the third site operates on different, freshly-fetched data via a different mechanism, so it isn't genuine duplication).

• Comment: Tolerate extra whitespace in @claude review dispatch matcher #317 (comment)
• Inline finding: Tolerate extra whitespace in @claude review dispatch matcher #317 (comment)

Verdict

Needs minor changes — safe to merge on the code itself; fix the changelog fragment's inaccurate claim first.

[github-actions]

💰 Cost: $5.2603 (review) — run

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[github-actions]

Claude finished review — View run

---

Code review — PR #317 (re-review)

Diff since last review: only one new commit, b3e9312 ("changelog: correct which sites reference the new step's output"). .github/workflows/claude.yml is byte-identical to what was reviewed in the prior round (the whitespace-tolerant Detect @claude review request step, env:-based body passing, and the two rewritten if: gates are unchanged and were already confirmed correct/safe).

Prior finding — resolved: the inline finding on changelog.d/claude-review-dispatch-whitespace-match.fixed.md:10 flagged the fragment's inaccurate "the three gated steps ... now reference that step's output" claim. The new commit rewrites that sentence to say "the two gated steps that previously repeated the fragile contains(..., '@claude review') check now reference that step's output," and separately describes the late-arrival rescan site as one that "never used contains()" and "keeps its own regex, updated with the same \s+ treatment." This matches the diff exactly (two if: sites now read steps.review_request.outputs.match == 'true'; the third site's jq filter independently gained \\s+ in its test() pattern) — the fix is accurate and complete.

No new issues found. No other prose, logic, or CLAUDE.md concerns surfaced in this pass; the rest of the prior review's analysis (script-injection safety via env:, bash/jq regex equivalence, gating consistency, self-verify caveat for a PR editing claude.yml itself) still stands unchanged.

Verdict

Ready for merge — the previously requested minor change (changelog fragment accuracy) has been made correctly, and no new issues were introduced.

[github-actions]

💰 Cost: $0.4731 (review) — run