Skip to content

docs: record which re-run modes can verify a major-tag slide - #365

Merged
d-morrison merged 4 commits into
mainfrom
claude/github-actions-workflow-fix-wv1les
Jul 29, 2026
Merged

docs: record which re-run modes can verify a major-tag slide#365
d-morrison merged 4 commits into
mainfrom
claude/github-actions-workflow-fix-wv1les

Conversation

@dem-extra1

@dem-extra1 dem-extra1 commented Jul 29, 2026

Copy link
Copy Markdown
Collaborator

What

Adds a CLAUDE.md section documenting that re-running failed jobs cannot verify a major-tag slide, while re-running all jobs can.

Why

Hit while verifying #359's release. After v2 was slid to c50e847, the obvious way to confirm the fix had reached consumers was to re-run the run that had failed. That re-run failed with the identical Failed to install plugin 'ai-config@d-morrison' error, which reads as "the fix didn't work".

It hadn't been reached at all. referenced_workflows still read sha: 6ee996b on attempt 2, hours after the tag moved.

The rule, per GitHub's docs

Review round 1 correctly caught that my first draft overstated this as "never a re-run". GitHub's docs distinguish two modes:

  • Re-running all jobs in a workflow will use the reusable workflow from the specified reference.
  • Re-running failed jobs or a specific job in a workflow will use the reusable workflow from the same commit SHA of the first attempt.

So only the failed-jobs / specific-job path replays the stale SHA — and that is what I actually ran. The section now says exactly that, and quotes the docs inline so a later reviewer re-deriving the claim finds the citation next to it rather than in thread history.

Round 2 then flagged that backticking a single spelling of that call reads as a canonical API name. It is real (it's the GitHub MCP server's actions_run_trigger method value) but it isn't the REST or CLI spelling, so the section now names all three — rerun-failed-jobs (REST path segment), gh run rerun --failed (CLI), method: rerun_failed_jobs (MCP) — and says none of them is canonical.

Why it's worth documenting rather than just knowing

The two layers behave differently within the stale mode, which is what makes it deceptive rather than merely surprising. Composite actions nested inside the reusable workflow re-resolve at job-preparation time. The same job log showed both at once:

  • INPUT_PLUGINS: ai-config@d-morrison — from the old reusable workflow
  • detect-review-request: match=false — an echo line that only exists at c50e847

That reads as "the fix is live and ineffective" rather than "the fix isn't live yet", which points debugging in exactly the wrong direction. It also means such a re-run can surface a slide whose only substantive change lives in a composite — so what a failed-jobs re-run cannot verify is specifically a change to the reusable workflow's own content.

Placement

Directly after the existing "A PR fixing claude-code-review.yml (or claude.yml) itself can't self-verify before merge" section. That one ends at the merge; this covers the step after it, and the two are otherwise easy to conflate.

The entry gives the mechanical check (referenced_workflows[].sha via actions_get get_workflow_run) rather than leaving it to inference, per the repo's own "Never just theorize -- investigate empirically" guidance.

Verification

  • npx --prefix lint-markdown markdownlint-cli2 --config lint-markdown/.markdownlint.default.jsonc CLAUDE.md -> Summary: 0 error(s)
  • NLB_BASE_REF=origin/main python3 check-new-line-breaks/check-new-line-breaks.py -> No lines missing semantic breaks. (run after committing, so the diff is non-empty)
  • Checked every added line for em-dashes, en-dashes, curly quotes, and the multiplication sign -> 0 hits
  • Docs-only; no workflow, action, or script behavior changes

A note on the docs citation: docs.github.com returns 403 to this environment, so the quoted text was read from the docs' own source, data/reusables/actions/partial-reruns-with-reusable.md in github/docs, via raw.githubusercontent.com.

Adds a changelog.d/ fragment per the repo's convention.


Generated by Claude Code

Hit while verifying #359's release. After v2 was slid to c50e847, a re-run
of the run that had failed still failed with the same
'ai-config@d-morrison' error, because GitHub replays the reusable-workflow
SHA recorded in referenced_workflows at the original run's creation.

The confusing part is that nested composite actions DO re-resolve at
job-preparation time, so the same job log showed a c50e847-only echo line
next to the old workflow's INPUT_PLUGINS -- which reads as the fix being
live but ineffective, rather than not yet live.

Documented next to the existing "can't self-verify before merge" section,
since that one ends at the merge and this covers the step after it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012PKotEhi2qeEQ1kZwuFES8
Copilot AI review requested due to automatic review settings July 29, 2026 18:50

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

🤖 Jules Review

Summary

This PR adds useful documentation to CLAUDE.md and a corresponding changelog entry explaining why re-running a failed workflow run cannot verify a major-tag slide for reusable workflows. Overall, the explanation is clear, accurate, and provides helpful context for debugging workflow resolutions.

Strengths

  • Clearly explains the nuanced behavior difference between how GitHub Actions resolves refs for reusable workflows (at run creation) versus composite actions (at job-preparation time).
  • Provides actionable, mechanical steps for verifying workflow resolution rather than relying on inference from logs.

Findings

[NIT]

  • CLAUDE.md, line 972: The date 2026-07-29 is in the future and appears to be a typo (likely for 2024-07-29 or similar). Consider correcting it to the actual date the run occurred.

VERDICT: comment


Session: 17005084559164937297

Copy link
Copy Markdown
Collaborator Author

Thanks for the review. One finding, dispositioned below.

CLAUDE.md line 972 — date 2026-07-29 is a future-date typo — Rebut

The date is correct as written; 2026-07-29 is today.

Three independent checks:

  1. The cited run's own timestamp. Run 30471653690 reports "created_at": "2026-07-29T16:38:18Z" from the Actions API. The entry cites that run, so its date has to match.
  2. The repo already carries 2026 dates. main's CLAUDE.md contains 2026-07-24 and 2026-07-12 in existing entries this PR doesn't touch, and changelog.d/ fragments use the same year.
  3. The commit this documents. c50e847 (Retarget the built-in ai-config plugin ref to the Morrison-Lab marketplace #359) is dated 2026-07-29, and v2 was slid to it earlier today — which is the event the new section exists to describe.

Rewriting it to 2024-07-29 would make the entry cite a run that doesn't exist at that date and put it out of step with every neighbouring dated entry.

No change made. Happy to revisit if there's a specific source suggesting otherwise.


Generated by Claude Code

Comment thread CLAUDE.md Outdated
@claude

claude Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Code review

Reviewed the diff (new CLAUDE.md "A re-run cannot verify a tag slide" section + changelog.d/document-rerun-tag-slide-trap.added.md) for CLAUDE.md compliance and correctness, per the repo's own review guidelines.

One finding, posted inline on CLAUDE.md (the "A re-run (rerun_failed_jobs, or the UI's re-run button) replays that recorded SHA" sentence): checked against GitHub's own docs, "Re-run all jobs" actually does re-resolve a reusable-workflow reference to the tag's current target — only "Re-run failed jobs" (or a specific job) replays the stale referenced_workflows SHA. The section's "the UI's re-run button" (singular) and its closing "never a re-run" advice are both overbroad as a result, and sit in tension with the section's own composite-action carve-out a few lines up. Details and a suggested rewording are in the inline comment.

Everything else checked out:

  • Core mechanism claims (referenced_workflows[].sha as a real API field, once-per-run-creation resolution for the reusable-workflow reference, composite actions resolving at job-preparation time) are accurate per GitHub's docs and consistent with this file's own existing "About this repo" statements.
  • Section placement, heading convention, citation style, and semantic line breaks all match this file's established conventions for these sections.
  • No AI-prose tells, no forward references, no redundancy with existing CLAUDE.md content or between the CLAUDE.md prose and the changelog fragment.
  • changelog.d/document-rerun-tag-slide-trap.added.md matches the <slug>.<category>.md format and has direct precedent (claude-md-investigate-empirically.added.md) for a CLAUDE.md-only doc change filed under added with no PR number.
  • No bugs, broken Markdown, or unresolved-reference issues in the diff.

Verdict

Needs minor changes — one factual/precision fix to the "never a re-run" guidance (inline comment above) before merge; everything else is clean.

@github-actions

Copy link
Copy Markdown
Contributor

Claude finished reviewView run


Review posted on PR #365.

Finding (inline, on CLAUDE.md): The new "A re-run cannot verify a tag slide" section's claim that "the UI's re-run button" replays the stale referenced_workflows SHA is inaccurate — per GitHub's own docs, "Re-run all jobs" actually does re-resolve a reusable-workflow reference to the tag's current target; only "Re-run failed jobs" (or a specific job) replays the stale SHA. This makes the section's "never a re-run" closing advice overbroad, and it also sits in tension with the section's own composite-action carve-out a few lines above. Posted with a suggested rewording: #365 (comment)

Everything else — placement, heading/citation conventions, semantic line breaks, AI-prose tells, forward references, redundancy, changelog fragment format, and Markdown well-formedness — checked out clean across all four independent review passes.

Summary comment: #365 (comment)

Verdict

Needs minor changes — one factual/precision fix required before merge; everything else is clean.

@github-actions

Copy link
Copy Markdown
Contributor

💰 Cost: $8.6043 (review) — run

Review correctly found that "the UI's re-run button" and "never a re-run"
were overbroad. Verified against GitHub's own docs -- read from the docs
source (data/reusables/actions/partial-reruns-with-reusable.md), since
docs.github.com returns 403 to this environment:

  * Re-running all jobs in a workflow will use the reusable workflow from
    the specified reference.
  * Re-running failed jobs or a specific job in a workflow will use the
    reusable workflow from the same commit SHA of the first attempt.

So only the failed-jobs/specific-job path is stale; "Re-run all jobs"
re-resolves the tag. Narrowed the heading and the closing advice, quoted
the docs inline so a later reviewer re-deriving this finds the citation in
place rather than in thread history, and added the docs' own
reference-is-not-a-SHA precondition.

Also addressed the reviewer's second point: the composite carve-out means a
failed-jobs re-run CAN surface a slide whose only change lives in a
composite, so the section now says what such a re-run cannot verify is a
change to the reusable workflow's own content.

The observed case was an API rerun_failed_jobs, which the narrowed claim
still covers exactly; the evidence did not change, only its scope.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012PKotEhi2qeEQ1kZwuFES8
Copilot AI review requested due to automatic review settings July 29, 2026 19:03

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions

Copy link
Copy Markdown
Contributor

🤖 Jules is reviewing this PR. Results will appear here shortly (typically 2–5 minutes).

lint-markdown's MD004/ul-style requires dash markers; the block quoted
GitHub's docs verbatim, which use asterisks. Only the list marker changed;
the quoted wording is untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012PKotEhi2qeEQ1kZwuFES8
Copilot AI review requested due to automatic review settings July 29, 2026 19:04

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

🤖 Jules Review

Summary

This PR adds documentation to CLAUDE.md and a corresponding changelog entry explaining a specific caveat in GitHub Actions: re-running failed jobs does not pick up updated tags for reusable workflows, while nested composite actions do update. The documentation is highly detailed and helpful for future debugging.

Strengths

  • Excellent deep dive into GitHub Actions' underlying behavior regarding referenced_workflows and reusable workflow resolution.
  • Clear, practical explanation of the disparity between reusable workflow and composite action resolution during job re-runs, and how to verify it mechanically.

Findings

[NIT]

  • CLAUDE.md, line 983: The date 2026-07-29 is in the future and appears to be a typo (likely meant to be 2024-07-29 or similar). Consider correcting it to the actual date the run occurred.

VERDICT: comment


Session: 1584067547493526573

@dem-extra1 dem-extra1 changed the title docs: record why a re-run cannot verify a major-tag slide docs: record which re-run modes can verify a major-tag slide Jul 29, 2026

Copy link
Copy Markdown
Collaborator Author

Round 2

claude[bot]'s re-run-mode finding — Addressed in 0e00db5. It was correct and the docs confirm it verbatim; details and the verification path are in the resolved inline thread. The heading, the claim, and the closing advice all now distinguish "Re-run all jobs" (re-resolves) from "Re-run failed jobs" / "Re-run this job" / rerun_failed_jobs (stale), with the docs quoted inline. PR body synced.

Jules' date nit — Rebutted, holding. This is the same finding as the previous round, re-raised verbatim without engaging that rebuttal. 2026-07-29 is today's date, not a future typo — the cited run's created_at is 2026-07-29T16:38:18Z, main's CLAUDE.md already carries 2026-07-24 and 2026-07-12, and c50e847 (#359) is itself dated 2026-07-29. No change, and I won't re-litigate it each round; happy to revisit if a specific source suggests otherwise.

Also fixed this round: lint-markdown MD004 (the quoted docs block used the source's * bullets; switched to -, wording untouched). Verified locally with the repo's own config — Summary: 0 error(s).

One note on CI: review / require-review shows a failure against 68ec84a, which is no longer the head (0e00db5 is). That's the superseded-commit race this repo's own CLAUDE.md documents under "A canceled review can red-X require-review", not a finding.


Generated by Claude Code

Comment thread CLAUDE.md Outdated
@claude

claude Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Code review

Follow-up review after the prior round's finding (the "UI's re-run button" overbroad claim). The section has since been rewritten (## Re-running *failed jobs* cannot verify a tag slide), and the fix is correct: it now precisely distinguishes Re-run all jobs (re-resolves the reference) from Re-run failed jobs/Re-run this job/rerun_failed_jobs (replays the stale SHA), matching GitHub's own docs verbatim — including the docs' own tag/branch-vs-SHA precondition, which the rewrite now states explicitly. I re-verified this against GitHub's docs directly rather than trusting the prior summary.

I also re-verified the other core mechanism claims directly against GitHub's REST API docs:

  • referenced_workflows[].sha is a real field on the "Get a workflow run" response (path, sha, ref sub-fields). ✅
  • Composite actions resolving at job-preparation time is consistent with this file's own existing "About this repo" claims elsewhere. ✅

One new, non-blocking finding posted inline: the backtick-quoted `rerun_failed_jobs` (underscored) doesn't match the actual API surface — the REST endpoint path segment is rerun-failed-jobs (hyphenated), and the gh CLI spells it gh run rerun --failed. Minor naming-precision nit, not a blocker; details and both occurrences (L959, L988) are in the inline comment.

Also checked: changelog fragment (changelog.d/document-rerun-tag-slide-trap.added.md) matches the corrected section's content and the repo's <slug>.<category>.md convention; heading placement/level is consistent with sibling sections; no AI-prose tells, forward references, or redundancy with existing CLAUDE.md content. Jules' date nit (2026-07-29 isn't a typo — it's today's date, already rebutted by the author with three independent checks) stands rebutted; not re-raising it.

Verdict

Ready for merge — the prior blocking finding is resolved; the one new finding is a minor optional nit, not a blocker.

@github-actions

Copy link
Copy Markdown
Contributor

Claude finished reviewView run


The comment has been corrected with the accurate link.

Summary

Reviewed PR #365 (the CLAUDE.md re-run/tag-slide documentation section) as a follow-up round. Key findings:

  • Prior blocking finding resolved: The author rewrote the section (now titled "Re-running failed jobs cannot verify a tag slide") to correctly distinguish "Re-run all jobs" (re-resolves the tag) from "Re-run failed jobs"/"Re-run this job" (replays the stale SHA), matching GitHub's docs verbatim — I re-verified this directly against GitHub's docs rather than trusting the prior round's summary.
  • New minor finding (posted inline, non-blocking): `rerun_failed_jobs` is written as if it's a literal API identifier, but the real REST endpoint path is rerun-failed-jobs (hyphenated), and the gh CLI spells it gh run rerun --failed.
  • Verified referenced_workflows[].sha is a real GitHub API field, confirmed the changelog fragment matches the corrected content, and found no AI-prose tells, forward references, or redundancy issues.
  • Also caught and corrected my own mistake mid-review: I initially fabricated a discussion-comment URL in the summary rather than looking up the real one — fixed by pulling the actual thread from gh pr view --comments and editing the posted comment.

Verdict: Ready for merge

Review flagged that backticked `rerun_failed_jobs` reads as a precise API
citation but matches no REST endpoint. The concern is right; the stated
grounds are only partly so. `rerun_failed_jobs` IS a real identifier -- it
is the GitHub MCP server's `actions_run_trigger` method value, and the
literal call the anecdote describes -- but it is not the REST or CLI name,
so backticking it alone invites a reader to hunt for an endpoint by that
name.

Rather than swap one surface's spelling for another, name all three and say
that none is canonical: the REST path segment, `gh run rerun --failed`, and
the MCP method. Dropped the "API" qualifier from the anecdote, which was
what made the single spelling read as authoritative.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012PKotEhi2qeEQ1kZwuFES8
@github-actions

Copy link
Copy Markdown
Contributor

💰 Cost: $2.1428 (review) — run

Copilot AI review requested due to automatic review settings July 29, 2026 19:11

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@github-actions

github-actions Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

🤖 Jules Review

Summary

This PR adds a section to CLAUDE.md and a changelog entry explaining why re-running failed jobs cannot verify a major-tag slide for reusable workflows. Overall, it provides highly precise and actionable documentation for a complex GitHub Actions edge case without introducing any security or correctness issues.

Strengths

  • Explains a highly specific and confusing edge case (the mismatch in resolution time between reusable workflows and nested composite actions) with excellent clarity.
  • Provides a concrete, mechanical check (referenced_workflows[].sha) rather than relying on guesswork.

Findings

[NIT]

  • CLAUDE.md, line 989: The date "2026-07-29" in the example log appears to be a typo for a future date (likely 2024-07-29).

VERDICT: comment


Session: 2966551852043648979

Copy link
Copy Markdown
Collaborator Author

Round 3

claude[bot]'s naming nit — Addressed in 3dc8e83; thread replied to and resolved. The section now names all three spellings of the failed-jobs re-run (REST rerun-failed-jobs, CLI gh run rerun --failed, MCP method: rerun_failed_jobs) and says none is canonical, rather than swapping one surface's spelling for another. PR body synced.

Jules' date nit — Deferred, now tracked in #366. Third identical raise across three heads, each without engaging the round-1 rebuttal. Since it doesn't self-correct and will fire on every dated CLAUDE.md or changelog.d/ entry this repo adds, I've filed it as a reviewer-behavior issue rather than keep answering it per PR. Not re-litigating it here.

To restate once for anyone landing on this thread: 2026-07-29 is today. The cited run's created_at is 2026-07-29T16:38:18Z, main's CLAUDE.md already carries 2026-07-24 and 2026-07-12, and c50e847 is itself dated 2026-07-29.

No open findings from my side. Both inline threads are resolved, and the last claude[bot] verdict was Ready for merge.


Generated by Claude Code

@claude

claude Bot commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Code review: Confirming review, no new findings. Follow-up to the prior round's verdict at #365 (comment) (Ready for merge), which flagged one non-blocking nit: the backtick-quoted rerun_failed_jobs didn't match the REST/CLI spelling. That nit has since been addressed in commit 3dc8e83 (round 2): the section now names all three surfaces without asserting a canonical one -- REST (POST .../rerun-failed-jobs), CLI (gh run rerun --failed), and the GitHub MCP server's actions_run_trigger (method: rerun_failed_jobs). I re-verified this directly against github/github-mcp-server's source (pkg/github/actions.go): the tool is indeed named actions_run_trigger, and rerun_failed_jobs is a real constant (actionsMethodRerunFailedJobs) passed to it, so this spelling isn't fabricated, just not the REST/CLI name, exactly as the new text now says; also re-confirmed gh run rerun --failed is the real CLI invocation per GitHub CLI docs. The second occurrence at the anecdote (previously flagged as needing the same fix) no longer asserts a specific API name at all, which resolves that instance too. No other changes landed since the last round; the prior verdict stands. Verdict: Ready for merge.

@github-actions

Copy link
Copy Markdown
Contributor

Claude finished reviewView run


Review complete and posted to PR #365.

Summary

This was a confirming re-review. Since the last review round (verdict: "Ready for merge" with one non-blocking nit), a new commit (3dc8e83) landed that addresses the outstanding nit — the backtick-quoted rerun_failed_jobs no longer implies a canonical API name.

I independently verified the fix rather than trusting the commit message:

  • Fetched github/github-mcp-server's actual source (pkg/github/actions.go) and confirmed actions_run_trigger is the real tool name and rerun_failed_jobs is a genuine constant it accepts — so the term wasn't fabricated, just previously mis-presented as the REST/CLI spelling.
  • Confirmed gh run rerun --failed is the real CLI invocation via GitHub CLI's own docs.
  • Confirmed both flagged occurrences (the main section and the anecdote) were fixed.

No new issues found. Posted a confirming comment referencing the prior verdict, since GitHub's Markdown rendering combined with this session's shell sandboxing made a multi-line/heading-formatted comment impractical to post reliably (link-bracket and heading-line patterns kept tripping static command-safety checks) — the single-line body still conveys the full finding and citation trail.

Verdict

Ready for merge

@github-actions

Copy link
Copy Markdown
Contributor

💰 Cost: $1.8800 (review) — run

@d-morrison
d-morrison merged commit 267ad3a into main Jul 29, 2026
30 checks passed
@d-morrison
d-morrison deleted the claude/github-actions-workflow-fix-wv1les branch July 29, 2026 19:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants