Migrate claude.yml to the Morrison-Lab/gha reusable agent workflow - #183
Merged
Conversation
…loses #182) Replace the bespoke anthropics/claude-code-action@v1 @claude agent workflow with a thin caller of Morrison-Lab/gha/.github/workflows/claude.yml@v2, so rpt inherits upstream hardening as @v2 slides (bot-actor self-trigger guard, late comment polling, reviewer re-request + review re-dispatch on push, cost comment, push-failure reporting). The second half of #178 (whose review- workflow half landed in #181). Two deliberate behavior changes (see #182): - contents: read -> write: the agent can now push branches and open PRs (the bespoke agent was comment-only). - Adds a trusted-author gate (OWNER/MEMBER/COLLABORATOR): the bespoke workflow gated only on the @claude mention with no author check, so the gate is what makes the contents: write upgrade safe. The two are coupled. The bespoke reviewer stash-while-working / re-add-after is replaced by the reusable's reviewer input (re-request d-morrison when Claude pushes commits). Inputs: install-quarto (rpt uses Quarto for vignettes/website); setup-r and use-renv left at defaults (true/false) since rpt CI restores deps from DESCRIPTION via setup-r-dependencies, not renv. rpt's R-package pre-commit checklist rides along via prompt-addendum.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
…le-call timeout exception Review of #183 (claude-review, Needs more work) raised two documentation findings; both addressed: 1. The header comment and PR body flagged only contents: read->write, but the diff also escalates issues: read->write and actions: read->write. The header now enumerates all four permission changes with each one's reason. 2. A uses: reusable-workflow-call job cannot set timeout-minutes, so this job inherits the reusable's timeout-minutes: 60, exceeding copilot-instructions.md's 50-minute cap. #181 already merged the same structural gap, so main's own instructions were already contradicted. Add a reusable-call exception to that rule and disclose the 50->60 change in the header. No functional change to the workflow (claude.yml edits are comment-only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Contributor
|
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
Contributor
|
Claude finished review — View run This is a confirming review — no code has changed since the round 2 review (verdict: Needs more work). I verified:
No new issues found in this pass — the diff content was already fully verified against the reusable workflow's real VerdictReady for merge — the round-2 verdict's outstanding item (failing |
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #182. The second half of #178 (review-workflow half landed in #181).
Replaces rpt's bespoke
anthropics/claude-code-action@v1@claudeagent workflow with a thin caller ofMorrison-Lab/gha/.github/workflows/claude.yml@v2. rpt's@claudeagent now inherits upstream hardening as@v2slides: the bot-actor self-trigger guard, late-comment polling, reviewer re-request + review re-dispatch on push, the cost comment, and push-failure reporting. Matches serodynamics / ai-config.Important
Deliberate behavior changes — please confirm at review:
1. Permission escalation (read → write), because the reusable agent needs write to do its job:
contentsissuesactionsgh workflow run)id-tokenpull-requestsThe headline change is that
@claudegoes from advisory-only (couldn't push) to a write-capable implementer. Veto if you'd rather keep it advisory on the template.2. Adds a trusted-author gate (
OWNER/MEMBER/COLLABORATOR). The current workflow gates only on the@claudemention with no author check, so any commenter can invoke it. The gate is what makes the write escalations safe — the two are coupled.3. Effective timeout 50 → 60 min. A
uses:reusable-workflow-call job can't settimeout-minutesat the caller, so it inherits the reusable'stimeout-minutes: 60. This exceedscopilot-instructions.md's 50-min cap — a gap #181 already introduced forclaude-code-review.yml. This PR adds a reusable-workflow-call exception to that rule so the repo's own instructions stay consistent with the two migrated workflows.Reviewer toggling (the issue's Gap 2, for
claude.yml)Bespoke: removes
d-morrisonwhile Claude works, re-adds after. Reusable: re-requests thereviewer(defaultd-morrison) when Claude pushes commits, and dispatches a fresh review. Not identical, but the closest thin-caller equivalent. (rme kept its bespokeclaude.yml; this migrates it per your "do it".)Feature diff (bespoke → reusable)
@claudemention gate, no author check@claude+ trusted-author gatecontents: read(comment-only)contents/issues/actions: write(implementer)d-morrisonreviewerreviewer: d-morrisonre-request on pushsetup-r(default true) +install-quarto: truetimeout-minutes: 50on the jobprompt-addendumInput choices
install-quarto: true— rpt uses Quarto (VignetteBuilder: quarto,Config/Needs/website: quarto).setup-r(default true) /use-renv(default false) — rpt CI restores deps fromDESCRIPTIONviasetup-r-dependencies, not therenv.lock.reviewer: d-morrison(default),use-ai-config(default true).Review
Round 1 (
claude-review) returned Needs more work with two documentation findings (undisclosedissues/actionsescalation; the 50→60 timeout). Both addressed in092a664— the permission set and timeout are now fully enumerated above and in the file header, and the timeout-rule exception was added tocopilot-instructions.md.🤖 Generated with Claude Code