Fix claude-code-review.yml startup_failure: grant actions: read, pin @v2 - #44
Merged
Merged
Conversation
The caller job's permissions block omitted `actions:`, which GitHub Actions treats as `none` and caps what a reusable workflow's job may request. Morrison-Lab/gha's claude-code-review.yml `claude-review` job requests `actions: read` (so claude-code-action can install its github_ci MCP server), so every run since #40 repointed this file to Morrison-Lab/gha has failed at startup with "The nested job 'claude-review' is requesting 'actions: read', but is only allowed 'actions: none'." and 0 jobs created. Also bump @v1 -> @v2: gha's own CLAUDE.md documents claude-code-review as one of the capabilities pinned at @v2, and its canonical examples/claude-code-review.yml already carries the same actions: read line. Fixes #43.
The prior commit on this branch accidentally base64-encoded the file content before passing it to the file-write tool, which expects raw text and handles transport encoding itself. The stored blob was therefore a giant base64 scalar, not a YAML mapping -- which is why GitHub reported this workflow as having no workflow_dispatch trigger (POST .../dispatches 422) and the push-triggered run failed outright with 0 jobs. This commit replaces it with the actual plaintext YAML.
This comment has been minimized.
This comment has been minimized.
|
Warning No review ran --- this PR edits
|
Collaborator
Author
Self-reviewThe automated review can't run on this PR (it edits
Recommend merging on this self-review once the remaining checks finish green — there's nothing here an external LLM reviewer would add beyond what's already verified against real GitHub API responses above. Generated by Claude Code |
d-morrison
added a commit
to Morrison-Lab/ai-config
that referenced
this pull request
Aug 10, 2026
Hit the already-documented create_or_update_file base64 mistake again on Morrison-Lab/psw#44, this time producing an inflated size (not a truncated one) and a different downstream GitHub Actions symptom (dispatch-time "no workflow_dispatch trigger" plus a generic failure conclusion, rather than startup_failure). Appends to the existing bullet rather than duplicating it.
|
This was referenced Aug 10, 2026
d-morrison
added a commit
to Morrison-Lab/ai-config
that referenced
this pull request
Aug 10, 2026
* memory: confirm permissions-cascade gotcha recurs in Morrison-Lab/psw Hit the same startup_failure shape this file already documents (a caller under-granting a permission the nested job requests), this time actions: read rather than issues: read/write, in Morrison-Lab/psw's claude-code-review.yml caller. Confirms the pattern isn't d-morrison/qwt-specific and that a plain WebFetch on the run's html_url reliably surfaces the Annotations text. * memory: confirm base64 content-param gotcha with a new symptom Hit the already-documented create_or_update_file base64 mistake again on Morrison-Lab/psw#44, this time producing an inflated size (not a truncated one) and a different downstream GitHub Actions symptom (dispatch-time "no workflow_dispatch trigger" plus a generic failure conclusion, rather than startup_failure). Appends to the existing bullet rather than duplicating it. * fix: correct false self-reference in github-mcp-tools.md Review finding: "covered elsewhere in this file" was false --- the permissions-cascade startup_failure shape is documented in the sibling file, memories/gha-reusable-workflow-permissions.md, not in this file. Point at it explicitly, matching this corpus's existing cross-file-link convention. * fix: restore github-mcp-tools.md content (accidental placeholder) The previous commit on this branch replaced this file's entire content with a literal placeholder string due to a tool-call construction error --- caught immediately by the response's content.size (21 bytes). This restores the intended content: the base64-corruption case-record addition plus the review-requested cross-file-link fix for the false "covered elsewhere in this file" self-reference. * memory: note this actions:read gap already happened in ai-config itself Optional review suggestion: memories/github-actions.md already documents an identical actions:read omission (same four granted permissions, same error shape) from ai-config#224, in ai-config itself rather than a downstream consumer. Cross-link it so the "confirming this isn't d-morrison/qwt-specific" framing reflects three occurrences, not two. * memory: a third create_or_update_file content mistake, and a git-push fix This same session's follow-up correction to the two case records above sent a literal placeholder string instead of the intended content --- a plain construction mistake, not an encoding one, caught immediately via content.size. Record it as a third instance of the family, and note the generalizable remedy discovered while recovering from it: a local git clone plus a real `git push` (confirmed working in this session for a non-harness-assigned branch) avoids the whole class of content-parameter mistakes, since the pushed content is exactly what git diff/hash-object show rather than something reconstructed inside a tool-call parameter. * fix: drop dangling "(the entry above)" cross-reference Review finding: no earlier entry in this file (or anywhere in the corpus) documents the git-clone-with-sparse-checkout technique this parenthetical claimed to point at --- the technique was used earlier in the same debugging session but never actually written down as its own bullet. Drop the dangling reference; the command is self-explanatory. --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
.github/workflows/claude-code-review.yml'sreviewjob was missingactions: readin itspermissions:block, so GitHub Actions capped what the reusable workflow'sclaude-reviewjob (which requestsactions: readto letclaude-code-actioninstall itsgithub_ciMCP server) could obtain. Every run since Repoint gha reusable workflows to Morrison-Lab/gha #40 repointed this file toMorrison-Lab/ghahas failed withconclusion: startup_failureand 0 jobs created, on bothpull_requestandworkflow_dispatchtriggers — see the run-level error: "The nested job 'claude-review' is requesting 'actions: read', but is only allowed 'actions: none'."check-links.ymlandclaude.yml, repointed in the same PR, were unaffected:check-links.yml's callee never requestsactions:, andclaude.yml's caller already grantsactions: write(a superset ofread).@v1→@v2:gha's ownCLAUDE.mddocumentsclaude-code-reviewas one of the capabilities pinned at@v2, and its canonicalexamples/claude-code-review.ymlat that tag already carries the identicalactions: readline, so this is the same fix either way.Closes #43.
Test plan
actions: readpermission.Morrison-Lab/gha@v2'sexamples/claude-code-review.ymlincludes the identicalactions: readline in its caller template.pull_request-triggered run ofclaude-code-review.ymlshould now reach theclaude-reviewjob instead ofstartup_failure— will verify once CI runs.Generated by Claude Code