feat(claude): review anthropics workflows and update workflow guidance (#483) by d-morrison · Pull Request #489 · Morrison-Lab/gha

d-morrison · 2026-08-18T01:44:23Z

Draft PR for #483: Review Anthropics and major AI org workflows for missing capabilities, security hardening, and documentation parity.

Closes #483.

#483)

…ry (#483)

d-morrison · 2026-08-18T01:45:03Z

@claude review

github-actions · 2026-08-18T01:45:19Z

👀 Picked up by workflow run #32089329146. Setup runs first; Claude itself responds after that.

…kflow scope (#483)

dem-extra1 · 2026-08-18T01:50:09Z

ARD Review Dispositions (Round 1)

Evidentiary Bar & Specific Upstream Version Citations:
- Addressed. Updated changelog.d/review-anthropics-workflows.changed.md in commit dbaee4a to explicitly cite pinned upstream versions (�nthropics/claude-code-action v1.0.162, google-github-actions/run-gemini-cli v0.1.22) and checked parameter models (permissions, inputs, trusted-author gates, execution parity).
Audit Scope Across Major AI Provider Workflows:
- Addressed. Explicitly documented the multi-agent audit across all major provider workflows in this repo (claude.yml, claude-code-review.yml, gemini.yml, gemini-code-review.yml, �ntigravity-code-review.yml, jules-review.yml, �i-code-review.yml).

Re-requesting review from @claude.

…in changelog (#483)

d-morrison · 2026-08-18T01:50:19Z

@claude review

github-actions · 2026-08-18T01:50:23Z

👀 Picked up by workflow run #32089633487. Setup runs first; Claude itself responds after that.

github-actions · 2026-08-18T01:51:31Z

This was a plain @claude review request — the review dispatch already fired (run #32089634209, reviewing PR #489 at d46f387), so no separate action from me is needed here. I checked for any @claude mentions posted after the triggering comment (issue comments, PR review comments, and PR reviews) and found none — the only comment after 01:50:19 is the automated "Claude Review Dispatched" notice from the post-step itself. Nothing to absorb.

_{— posted by @claude post-step from workflow run}

💰 Cost: $0.6498297

github-actions · 2026-08-18T01:51:50Z

👀 Picked up by workflow run #32089644233. Setup runs first; Claude itself responds after that.

…tigravity details (#483)

d-morrison · 2026-08-18T01:58:49Z

@claude review

github-actions · 2026-08-18T01:59:03Z

👀 Picked up by workflow run #32090155183. Setup runs first; Claude itself responds after that.

… specs (#483)

dem-extra1 · 2026-08-18T01:59:14Z

ARD Review Dispositions (Round 2)

Version Citation Correction:
- Addressed. Corrected the version citation in changelog.d/review-anthropics-workflows.changed.md to �1.0.191 (�nthropics/claude-code-action@239e3a730883eeb5c53db12b0fc9573b3024b126 # v1.0.191), matching the exact pins in .github/workflows/claude.yml and .github/actions/run-claude-review-attempt/action.yml.
Action Specs for Jules & Antigravity:
- Addressed. Cited sanjay3290/jules-pr-reviewer v1.0.2 (sanjay3290/jules-pr-reviewer@66c23ef) for Jules and google-antigravity Python SDK runner actions for Antigravity.
Imprecise Antigravity Integration Characterization:
- Addressed. Refined wording to distinguish action releases (claude-code-action,
  un-gemini-cli, jules-pr-reviewer) from Python SDK runner actions (google-antigravity).

Re-requesting review from @claude.

github-actions · 2026-08-18T02:02:04Z

Could not push the changes

Push rejected: the branch moved on the remote while this run was working.

The push was rejected as a non-fast-forward: the branch gained commits on
the remote after this run checked it out. Pushing anyway would discard
them, so the push fails rather than forcing.

This usually means another session, another workflow run, or a person
pushed to the same branch concurrently. Re-running the agent against the
up-to-date branch is the normal recovery; any patch included in this
comment is only needed if the work should be preserved rather than redone.

The commits below were made during this run but are not on the branch -- they exist only on the runner, which is discarded when the job ends.

git output

To https://github.com/Morrison-Lab/gha.git
 ! [rejected]        HEAD -> feat/review-anthropics-workflows-483 (fetch first)
error: failed to push some refs to 'https://github.com/Morrison-Lab/gha.git'
hint: Updates were rejected because the remote contains work that you do not
hint: have locally. This is usually caused by another repository pushing to
hint: the same ref. If you want to integrate the remote changes, use
hint: 'git pull' before pushing again.
hint: See the 'Note about fast-forwards' in 'git push --help' for details.

Patch -- recover with `git am`

From 705571404bf7ddaefa6307190a950a6918933eb1 Mon Sep 17 00:00:00 2001
From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com>
Date: Tue, 18 Aug 2026 02:01:55 +0000
Subject: [PATCH] fix(docs): remove stray blank line splitting a sentence in
 workflows.qmd

Round-1 ARD fix (05c732b) accidentally inserted a blank line after
"...sits above whichever review workflows a repo has installed:",
splitting the sentence into two malformed paragraphs.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 website/workflows.qmd | 1 -
 1 file changed, 1 deletion(-)

diff --git a/website/workflows.qmd b/website/workflows.qmd
index 717f3d3..ed16b41 100644
--- a/website/workflows.qmd
+++ b/website/workflows.qmd
@@ -253,7 +253,6 @@ the `google-antigravity` Python SDK) for trigger policies, permission
 isolation, and secret handling.
 
 `ai-code-review.yml` sits above whichever review workflows a repo has installed:
-
 it picks one of the configured agents at random and dispatches that agent's own
 review workflow, falling through to the next candidate when one can't be
 dispatched (no API key or token secret configured for it, or its review
-- 
2.54.0

github-actions · 2026-08-18T02:02:11Z

💰 Cost: $1.5329874

github-actions · 2026-08-18T02:02:24Z

👀 Picked up by workflow run #32090177602. Setup runs first; Claude itself responds after that.

github-actions · 2026-08-18T02:02:44Z

👀 Claude Review Dispatched — run reviewing PR #489 at b5f42c8.

…ows.qmd The prior round's push of this exact fix (705571404) was rejected as a non-fast-forward and never landed on the branch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

github-actions · 2026-08-18T02:04:20Z

No new @claude requests since the last dispatch. Nothing to absorb.

Fixed the stray blank line in website/workflows.qmd that was splitting the ai-code-review.yml sentence — the prior round's attempt to push this same fix was rejected as a non-fast-forward and never landed. Committed as 8f3931b; a post-step will push it and it should be picked up by the next review dispatch.

_{— posted by @claude post-step from workflow run}

💰 Cost: $0.9228380999999999

github-actions · 2026-08-18T02:05:37Z

PR Preview Action v1.8.1
🚀 Preview available at: https://Morrison-Lab.github.io/gha/pr-preview/pr-489/

_{Built to branch gh-pages at 2026-08-18 02:05 UTC.}

github-actions · 2026-08-18T02:06:37Z

Claude finished review — View run

I now have everything needed to write the final review.

Code Review — PR #489

Scope of this round: since the last review (commit d46f3874), two more commits landed responding to that round's findings — 05c732b3a and b5f42c88b — plus a follow-up 8f3931b8 that fixed a stray-blank-line formatting issue introduced and resolved within this same window. Reviewed at the PR's current head commit, 8f3931b862726c1be908b505eb8761b730926cfa.

Verification of prior findings

Round 2 finding 1 (wrong version citation, v1.0.162) — fixed. The changelog fragment now reads anthropics/claude-code-action v1.0.191, which matches the actual pin in both call sites: .github/workflows/claude.yml:695 and .github/actions/run-claude-review-attempt/action.yml:99, both @239e3a730883eeb5c53db12b0fc9573b3024b126 # v1.0.191.

Round 2 finding 2 (uncited Jules / unverifiable Antigravity) — fixed. The fragment now cites sanjay3290/jules-pr-reviewer v1.0.2, matching .github/workflows/jules-review.yml:26. For Antigravity, the wording changed from the inaccurate "Antigravity action specs" to "the google-antigravity Python SDK runner actions" — this correctly stops implying a fixed upstream spec exists (there isn't one; antigravity-review/action.yml's pip install --quiet google-antigravity is still unpinned) rather than fabricating a version number for it. That's an honest resolution, not a dodge.

Round 2 finding 3 (website prose: undefended blanket claim + Antigravity mischaracterized as "CLI runner contracts") — fixed. website/workflows.qmd's new sentence now cites specific versions (anthropics/claude-code-action v1.0.191, run-gemini-cli v0.1.22) and correctly describes Antigravity as "the google-antigravity Python SDK" rather than lumping it in under "CLI runner contracts" it doesn't have.

Gemini's v0.1.22 citation was re-confirmed accurate against both gemini.yml:376 and gemini-code-review.yml:202.

New findings

None. I reviewed the full two-file diff (changelog.d/review-anthropics-workflows.changed.md, website/workflows.qmd) at the true current head and found no new factual errors, hallucinated references, or CLAUDE.md violations. The trusted-author-gate claim checks out for the newly-cited workflows too (jules-review.yml:15's if: github.event.pull_request.head.repo.full_name == github.repository, antigravity-code-review.yml:41's dispatch-guard if:).

Other notes (non-blocking)

The changelog category (changed) question raised in round 1 stands as a non-blocking style observation; not re-raising.
One changelog line (google-github-actions/run-gemini-cli... sanjay3290/jules-pr-reviewer) runs a bit long for a semantic line break, but this is cosmetic prose wrapping with no rendered-output difference — not flagging per the "don't flag cosmetic source-only formatting" instruction.

Both prior verdicts (round 1, round 2) were Needs more work; this round's fixes close out every finding from both rounds with no regressions.

Verdict

Ready for merge

Reviewed commit: b5f42c8

github-actions · 2026-08-18T02:06:38Z

💰 Cost: $1.9187 (review) — run

d-morrison added 2 commits August 17, 2026 18:44

feat(claude): review anthropics workflows and update workflow guidance (

c811896

#483)

docs(claude): audit Anthropic workflow patterns and add changelog ent…

fb62e83

…ry (#483)

d-morrison marked this pull request as ready for review August 18, 2026 01:45

This comment has been minimized.

Sign in to view

docs(audit): cite pinned upstream action versions and multi-agent wor…

dbaee4a

…kflow scope (#483)

docs(claude): document provider alignment and specify action version …

d46f387

…in changelog (#483)

This comment has been minimized.

Sign in to view

docs(claude): correct action version pin to v1.0.191 and add jules/an…

05c732b

…tigravity details (#483)

docs(audit): fix action version pin citations and clarify multi-agent…

b5f42c8

… specs (#483)

This comment has been minimized.

Sign in to view

docs(website): remove stray blank line splitting a sentence in workfl…

8f3931b

…ows.qmd The prior round's push of this exact fix (705571404) was rejected as a non-fast-forward and never landed on the branch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

dem-extra1 merged commit 56df500 into main Aug 18, 2026
27 of 29 checks passed

dem-extra1 deleted the feat/review-anthropics-workflows-483 branch August 18, 2026 03:35

Uh oh!

Conversation

d-morrison commented Aug 18, 2026

Uh oh!

d-morrison commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

dem-extra1 commented Aug 18, 2026

ARD Review Dispositions (Round 1)

Uh oh!

d-morrison commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

This comment has been minimized.

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

d-morrison commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

dem-extra1 commented Aug 18, 2026

ARD Review Dispositions (Round 2)

Uh oh!

This comment has been minimized.

github-actions Bot commented Aug 18, 2026

Could not push the changes

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

github-actions Bot commented Aug 18, 2026

Code Review — PR #489

Verification of prior findings

New findings

Other notes (non-blocking)

Verdict

Uh oh!

github-actions Bot commented Aug 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants