fix: use --bare and --tools in health probe CLI check

[andreatgretel]

📋 Summary

Fix the "Verify Claude CLI" step in the agentic CI health probe, which has failed on all 3 runs since merge. The raw API curl passes but the Claude CLI invocation fails because it tries to initialize keychain, LSP, plugins, and CLAUDE.md discovery on a bare CI runner.

🐛 Fixed

• Add --bare to skip all CLI initialization and force ANTHROPIC_API_KEY auth (no keychain/OAuth reads)
• Add --tools "" to disable tool definitions in the API request (health check doesn't need them)

🔍 Attention Areas

⚠️ Reviewers: Please pay special attention to the following:

• agentic-ci-health-probe.yml - The two new flags in the claude invocation. Validated via workflow_dispatch run which passes all steps.

---

🤖 Generated with AI

[greptile-apps]

Greptile Summary

This PR fixes the "Verify Claude CLI" step in the agentic CI health probe by adding --bare (to skip CLI initialization and force API-key auth) and --tools "" (to disable tool definitions) to the claude invocation, addressing repeated failures caused by the CLI attempting keychain/OAuth/LSP setup on a bare CI runner.

Key changes:

• --bare added to skip all CLI initialization overhead and force ANTHROPIC_API_KEY authentication
• --tools "" added to strip tool definitions from the API request, making the health check lighter
• Comment updated to reflect that tool-usage verification is no longer part of this check

Issue found:

• --bare forces ANTHROPIC_API_KEY auth, but the "Verify Claude CLI" step runs unconditionally regardless of auth.mode. In oauth mode, ANTHROPIC_API_KEY is empty, so --bare will cause the health check to fail for any runner using OAuth auth. The Ping inference API step already guards with if: steps.auth.outputs.mode == 'custom'; the same guard (or a conditional --bare) should be applied here.

Confidence Score: 3/5

• Safe to merge for custom API-key auth mode deployments, but introduces a regression for any runner using OAuth auth mode.
• The fix correctly resolves the reported failure for custom auth mode (where ANTHROPIC_API_KEY is set). However, the --bare flag unconditionally forces API-key auth while the "Verify Claude CLI" step has no auth-mode guard, breaking OAuth-mode runners. The --tools "" change appears benign. Score of 3 reflects a targeted fix with one concrete correctness issue for the OAuth path.
• .github/workflows/agentic-ci-health-probe.yml — specifically the missing if: steps.auth.outputs.mode == 'custom' guard on the "Verify Claude CLI" step.

Important Files Changed

Filename	Overview
.github/workflows/agentic-ci-health-probe.yml	Adds --bare and --tools "" to the Claude CLI health check invocation to fix initialization failures on bare CI runners; --bare unconditionally forces API-key auth which breaks OAuth auth mode since the step has no auth-mode guard.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Workflow Trigger\nschedule / workflow_dispatch] --> B[Check required config\nAGENTIC_CI_MODEL set?]
    B -->|missing| FAIL1[exit 1]
    B -->|ok| C{Detect auth mode}
    C -->|AGENTIC_CI_API_BASE_URL\n+ AGENTIC_CI_API_KEY set| D[mode=custom]
    C -->|otherwise| E[mode=oauth]
    D --> F[Ping inference API\ncurl POST /v1/messages]
    E --> G[skip Ping step]
    F -->|HTTP 2xx| H[Check latency threshold]
    F -->|HTTP error| FAIL2[exit 1]
    H --> I[Verify Claude CLI\nruns unconditionally]
    G --> I
    I --> J{ANTHROPIC_API_KEY\nset?}
    J -->|custom mode: yes| K[claude --bare --tools '' ...\nAPI-key auth ✅]
    J -->|oauth mode: empty| L[claude --bare --tools '' ...\nAPI-key auth forced\nbut no key ❌]
    K --> M{Response contains\nHEALTH_CHECK_OK?}
    L --> FAIL3[CLI fails]
    M -->|yes| PASS[Health check passed]
    M -->|no| WARN[::warning:: unexpected output]

Loading

Prompt To Fix All With AI

This is a comment left during a code review.
Path: .github/workflows/agentic-ci-health-probe.yml
Line: 92

Comment:
**`--bare` breaks OAuth auth mode**

The `--bare` flag forces `ANTHROPIC_API_KEY`-based authentication and disables keychain/OAuth reads (as stated in the PR description). However, the "Verify Claude CLI" step runs unconditionally in **both** auth modes (`custom` and `oauth`). In `oauth` mode, `AGENTIC_CI_API_KEY` is not set, so `ANTHROPIC_API_KEY` resolves to an empty string — meaning `--bare` will force API-key auth but with no key available, causing the health check to fail for all OAuth-mode runners.

The `--bare` flag should only be applied when in `custom` auth mode, or the step should be gated with `if: steps.auth.outputs.mode == 'custom'` (matching the `Ping inference API` step's guard):

```yaml
      - name: Verify Claude CLI
        if: steps.auth.outputs.mode == 'custom'
        env:
```

Or, if OAuth mode should remain supported without `--bare`, conditionally apply the flag:

```bash
BARE_FLAG=""
[ -n "$ANTHROPIC_API_KEY" ] && BARE_FLAG="--bare"

RESULT=$(claude \
  $BARE_FLAG \
  --model "$MODEL" \
  ...
```

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: use --bare and --tools in health pr..." | Re-trigger Greptile}

[greptile-apps]

--bare breaks OAuth auth mode

The --bare flag forces ANTHROPIC_API_KEY-based authentication and disables keychain/OAuth reads (as stated in the PR description). However, the "Verify Claude CLI" step runs unconditionally in both auth modes (custom and oauth). In oauth mode, AGENTIC_CI_API_KEY is not set, so ANTHROPIC_API_KEY resolves to an empty string — meaning --bare will force API-key auth but with no key available, causing the health check to fail for all OAuth-mode runners.

The --bare flag should only be applied when in custom auth mode, or the step should be gated with if: steps.auth.outputs.mode == 'custom' (matching the Ping inference API step's guard):

      - name: Verify Claude CLI
        if: steps.auth.outputs.mode == 'custom'
        env:

Or, if OAuth mode should remain supported without --bare, conditionally apply the flag:

BARE_FLAG=""
[ -n "$ANTHROPIC_API_KEY" ] && BARE_FLAG="--bare"

RESULT=$(claude \
  $BARE_FLAG \
  --model "$MODEL" \
  ...

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/agentic-ci-health-probe.yml
Line: 92

Comment:
**`--bare` breaks OAuth auth mode**

The `--bare` flag forces `ANTHROPIC_API_KEY`-based authentication and disables keychain/OAuth reads (as stated in the PR description). However, the "Verify Claude CLI" step runs unconditionally in **both** auth modes (`custom` and `oauth`). In `oauth` mode, `AGENTIC_CI_API_KEY` is not set, so `ANTHROPIC_API_KEY` resolves to an empty string — meaning `--bare` will force API-key auth but with no key available, causing the health check to fail for all OAuth-mode runners.

The `--bare` flag should only be applied when in `custom` auth mode, or the step should be gated with `if: steps.auth.outputs.mode == 'custom'` (matching the `Ping inference API` step's guard):

```yaml
      - name: Verify Claude CLI
        if: steps.auth.outputs.mode == 'custom'
        env:
```

Or, if OAuth mode should remain supported without `--bare`, conditionally apply the flag:

```bash
BARE_FLAG=""
[ -n "$ANTHROPIC_API_KEY" ] && BARE_FLAG="--bare"

RESULT=$(claude \
  $BARE_FLAG \
  --model "$MODEL" \
  ...
```

How can I resolve this? If you propose a fix, please make it concise.