ci(claude-review): grant Task and pass --comment so reviews stop stubbing

[d-morrison]

Closes #49

Correction to the first commit on this branch (16e1887): adding Task
to allowedTools was based on a wrong mechanism claim. I verified locally
that claude --allowedTools excluding Task still lets a Task call
through with zero permission denials -- it isn't gated the way Bash
subcommands are. That fix was a no-op.

What's actually going on: this file was a hand-rolled, pre-migration
copy of the review job -- literally the "qwt" template's original version,
one of the three repos (serodynamics / qwt / rme) that
gha's own claude-code-review.yml
says it was ported from. wai never migrated to consume its own canonical
port, so it carried the original config gaps gha has since fixed across
15+ documented incidents (gha#173, #185, #198, #201, #218, #219, #235,
#244, #312, #318, #381, #392, and cross-referenced incidents in
Lacaedemon/sparta and d-morrison/rme):

• The plugin's own /code-review command declares Bash(gh pr list:*),
  Bash(gh issue view:*), Bash(gh issue list:*), Bash(gh search:*) as
  tools its 4 parallel sub-agents need -- wai's allowlist only granted
  gh pr view/diff/comment. Missing tools means denied calls across the
  sub-agent fan-out.
• Having the agent itself call gh pr comment (gated behind --comment,
  my second commit's fix) is fragile compared to gha's approach: gha
  denies that tool outright and has the workflow post the review
  from the agent's final text message instead, with an automatic
  same-run retry when a stub (no verdict) is detected.

This PR now replaces the whole hand-rolled job with a thin caller, matching
wai's own established pattern for consuming gha
(check-links.yml,
check-bibliography-dois.yml,
check-non-standard-chars.yaml):
same job id (so the status-check context doesn't change), same triggers,
same pr_number interface claude.yml already dispatches through, the
repo's two submodules checked out (checkout-submodules: true), and the
qwt-specific Quarto/R prompt addendum carried over verbatim.

As before: this PR edits claude-code-review.yml itself, so its own
review is skipped by the self-mod guard (401s on workflow validation
until merged) -- gets a real review, from gha's own hardened workflow,
on the next PR once this lands. actionlint and a YAML parse both pass
clean.

Worth a separate follow-up, not bundled into this PR: claude.yml
also calls anthropics/claude-code-action@v1 directly rather than
delegating to Morrison-Lab/gha's reusable claude.yml, and several
other workflows in this repo (check-spelling.yaml, preview.yml,
preview-deploy.yml, publish.yml, summary.yml) look like similar
stale, hand-rolled duplicates of gha capabilities. Filed as #51 rather
than scope-creeping this one.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[d-morrison]

Self-review, since this PR's own review is skipped by design (self-mod guard -- confirmed the new gha-delegated version fires it identically, all 21 downstream steps in claude-review / claude-review correctly skipped) and Copilot is still quota-exhausted on every request, including the one from this push.

Verdict: clean, no findings. PR is ready.

What I checked:

• actionlint and a YAML parse both pass on the rewritten file.
• The job id (claude-review), triggers (pull_request types, workflow_dispatch with a pr_number number input), and the pr-number interface claude.yml dispatches through are all unchanged from the original -- claude.yml's gh workflow run claude-code-review.yml -f pr_number=... calls keep working with no changes needed there.
• checkout-submodules: true preserves the original submodules: recursive behavior -- confirmed both of this repo's submodules (macros, .ai-config) are public, so no SUBMODULES_TOKEN is needed.
• secrets.ANTHROPIC_API_KEY / secrets.SUBMODULES_TOKEN are passed through even though this repo only has CLAUDE_CODE_OAUTH_TOKEN configured -- gha declares both required: false, and an unset secret reference evaluates to an empty string rather than erroring.
• Confirmed via gh api .../rulesets that main has no required_status_checks rule naming claude-review by exact context, so the check-name shape (now claude-review / claude-review and claude-review / require-review instead of a single claude-review) can't break branch protection.
• The prompt-addendum content is the original qwt-specific Quarto/R guidance carried over verbatim, with the now-obsolete posting instructions (draft-comment format, "post findings in the top-level comment") dropped since gha's own prompt already handles posting, inline-vs-summary fallback, and the ### Verdict requirement.
• All 11 checks green at the current head, mergeStateStatus: CLEAN, no CHANGES_REQUESTED.

What I can't verify from inside this PR (same limitation as before, stated plainly rather than assumed): the actual review path -- gha's multi-agent fan-out, the retry-on-stub logic, the posted verdict -- only exercises once this merges, since the self-mod guard skips it here by design.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-08-08 18:23 UTC