fix(health-check): pin claude-code version via cache, surface CLI errors

[don-petry]

Root cause

The health check always installs the latest @anthropic-ai/claude-code with no caching or version pin. Version 2.1.141 was published at 2026-05-13 22:42 UTC — ~14 hours after the last successful health check run. That version introduced a behaviour change that causes claude --print to exit 1 in CI.

Meanwhile pr-review.yml is unaffected: it uses actions/cache with the CLAUDE_CODE_VERSION variable and a cache populated under 2.1.138, so it never saw 2.1.141.

How the error was hidden: claude writes errors to stdout, not stderr. The invocation used > "$REPORT_FILE", so the error message landed silently in the report file and the step failed with no visible output in the Actions log.

Confirming evidence from the failed run (25849827578):

• npm install completed; claude binary available
• "Invoking Claude for log analysis..." printed
• Process exited 1 exactly ~1 second later — too fast for an API call, consistent with a startup/auth failure

Changes

daily-pr-review-health.yml

• Add CLAUDE_CODE_VERSION: ${{ vars.CLAUDE_CODE_VERSION || 'latest' }} env var
• Add actions/cache@v5 step with key claude-code-<version>-<os> — mirrors pr-review.yml so both workflows share the same cached binary
• Replace bare npm install -g @anthropic-ai/claude-code with a cache-aware install that respects the version variable

scripts/pr_review_health.sh

• Add --no-session-persistence flag for CI safety
• Wrap the claude call in if ! so a non-zero exit echoes the CLI output to the Actions error log before aborting — prevents future failures from being silently swallowed

Test plan

• Merge and trigger a workflow_dispatch run of the health check — confirm it uses the cached version and completes successfully
• Verify the cache key claude-code-latest-Linux is shared with pr-review.yml (same binary, same behaviour)
• If a future claude release breaks CI again, the error will now be visible in the Actions log under ::error::Claude invocation failed. CLI output follows:

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Improved CI workflow caching and stable tool versioning to make runs more reproducible and faster.
  • Avoided unnecessary global installs by reusing cached tooling when present.
  • Strengthened error handling and reporting in the PR review health check so failures produce visible annotations, cleaned logs, and proper exit behavior.

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 15 minutes and 51 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: dea110c4-0bf0-4f0a-b83b-eeac3f03e8ff

📥 Commits

Reviewing files that changed from the base of the PR and between bd6d2c9 and 91ead79.

📒 Files selected for processing (3)

• .github/workflows/daily-pr-review-health.yml
• scripts/pr_review_health.sh
• sonar-project.properties

📝 Walkthrough

Walkthrough

The PR pins the Claude Code CLI version in the workflow, adds an npm cache for the global install directory and conditional global install, and updates the review script to detect and report Claude CLI failures without silently continuing.

Changes

Claude Code CLI Reliability

Layer / File(s)	Summary
Workflow version pinning and npm cache .github/workflows/daily-pr-review-health.yml	Added CLAUDE_CODE_VERSION environment variable (fallback 'latest'), added actions/cache@v5 for ~/.npm-global keyed by version and OS, set npm prefix/PATH, and conditionally install claude only when missing.
Script error handling for Claude invocation scripts/pr_review_health.sh	Moved claude invocation into if ! …; then … fi so failures are detected; on failure the script emits an ::error:: annotation, prints the partial report to stderr, removes temp logs, and exits with status 1.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'fix(health-check): pin claude-code version via cache, surface CLI errors' directly and clearly summarizes the main changes: pinning the Claude Code version using caching and surfacing CLI errors that were previously hidden.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/health-check-claude-version-skew

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Fixes the daily PR-review health check, which started failing when a new @anthropic-ai/claude-code release (2.1.141) introduced a claude --print regression. Without caching/pinning and with errors silently captured into the report file via stdout redirect, the failure surfaced as a 1-second exit with no diagnostics. The fix mirrors the existing pr-review.yml caching scheme and surfaces CLI errors to the Actions log.

Changes:

• Pin and cache the claude-code CLI in the health-check workflow using the shared CLAUDE_CODE_VERSION variable and an actions/cache key compatible with pr-review.yml.
• Add --no-session-persistence to the claude --print invocation for CI safety.
• Wrap the claude call in if ! so non-zero exits echo the captured stdout/stderr (which Claude writes errors to) to the Actions error log before aborting.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/daily-pr-review-health.yml	Adds CLAUDE_CODE_VERSION env, actions/cache@v5 step, and per-user npm prefix install that reuses cached binary.
scripts/pr_review_health.sh	Adds --no-session-persistence and surfaces Claude CLI failures by echoing the redirected output to the Actions error log.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[gemini-code-assist]

Code Review

This pull request updates the scripts/pr_review_health.sh script to improve error handling during the Claude CLI invocation. It adds the --no-session-persistence flag and wraps the command in a conditional block to capture and report errors if the invocation fails. I have no feedback to provide.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/daily-pr-review-health.yml:
- Line 45: Replace the unpinned actions/cache@v5 usage with a pinned commit SHA
for consistency/security: locate the workflow step using "uses:
actions/cache@v5" and change it to the same pattern used elsewhere in the file
(e.g., "uses: actions/cache@<COMMIT_SHA>") by copying the commit SHA style from
the other pinned actions in this workflow so the action is referenced by its
specific commit instead of a floating tag.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6c048692-ced3-4a0e-aaab-23ee320ad78f

📥 Commits

Reviewing files that changed from the base of the PR and between 70c9f18 and e67c81e.

📒 Files selected for processing (2)

• .github/workflows/daily-pr-review-health.yml
• scripts/pr_review_health.sh

[coderabbitai]

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin actions/cache to a SHA for consistency and security.

All other actions in this workflow are pinned to commit SHAs (lines 37, 40, 79), but actions/cache@v5 is not. This creates a security and reproducibility gap.

📌 Proposed fix to pin actions/cache

-      - name: Cache claude-code CLI
-        uses: actions/cache@v5
+      - name: Cache claude-code CLI
+        uses: actions/cache@f689fdddf282194ec20a78de59e81a0a66a5c96e  # v5.3.0

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/daily-pr-review-health.yml at line 45, Replace the
unpinned actions/cache@v5 usage with a pinned commit SHA for
consistency/security: locate the workflow step using "uses: actions/cache@v5"
and change it to the same pattern used elsewhere in the file (e.g., "uses:
actions/cache@<COMMIT_SHA>") by copying the commit SHA style from the other
pinned actions in this workflow so the action is referenced by its specific
commit instead of a floating tag.

[don-petry]

Dev-Lead Fix CI — no-changes

PR: #175 | SHA: 3b64c3361b94c729c41fdae0eb8554723639208a
Engine ran but made no changes.

[don-petry]

Dev-Lead Fix CI — no-changes

PR: #175 | SHA: ffde5aeb746165b2cf0e6d14b10d7f361322765b
Engine ran but made no changes.

[don-petry]

Dev-Lead Fix CI — no-changes

PR: #175 | SHA: 6072701a6467dca881938ac54c51c3922a2630b7
Engine ran but made no changes.

[don-petry]

Dev-Lead Fix CI — failed

PR: #175 | SHA: 109471d04a4d3e7b7cf0b458f2deec56b3095f19
Engine timed out — PR may be too large for automated fixing

[coderabbitai]

♻️ Duplicate comments (1)

.github/workflows/daily-pr-review-health.yml (1)

45-45: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin actions/cache to a commit SHA.

Line 45 still uses a floating tag (actions/cache@v5), which weakens reproducibility and supply-chain integrity versus SHA-pinned actions already used elsewhere in this workflow.

Suggested fix

-        uses: actions/cache@v5
+        uses: actions/cache@f689fdddf282194ec20a78de59e81a0a66a5c96e  # v5.3.0

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/daily-pr-review-health.yml at line 45, Replace the
floating tag "uses: actions/cache@v5" with a commit SHA pin to improve
reproducibility and supply-chain integrity; locate the action reference "uses:
actions/cache@v5" in the workflow and change it to the corresponding commit SHA
(e.g., actions/cache@<full-commit-sha>), matching the pinning style used
elsewhere in the workflow and ensuring the chosen SHA is from the official
actions/cache repository.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In @.github/workflows/daily-pr-review-health.yml:
- Line 45: Replace the floating tag "uses: actions/cache@v5" with a commit SHA
pin to improve reproducibility and supply-chain integrity; locate the action
reference "uses: actions/cache@v5" in the workflow and change it to the
corresponding commit SHA (e.g., actions/cache@<full-commit-sha>), matching the
pinning style used elsewhere in the workflow and ensuring the chosen SHA is from
the official actions/cache repository.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 8edc87a1-6abb-4819-8474-38475d2be0cc

📥 Commits

Reviewing files that changed from the base of the PR and between e67c81e and bd6d2c9.

📒 Files selected for processing (2)

• .github/workflows/daily-pr-review-health.yml
• scripts/pr_review_health.sh

[don-petry]

@dev-lead please confirm routing is working — human intent test for shadow period verification.

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

Auto-rebase failed — merge conflict — this branch has conflicts with main that must be resolved.

Claude will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention.

To resolve manually instead:

git fetch origin
git merge origin/main
# resolve conflicts, then:
git add .
git commit
git push

[don-petry]

@dev-lead - Review and fix

[don-petry]

Dev-Lead — human (no-changes)

Engine ran but made no changes.

[don-petry]

@dev-lead - please fix this PR

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[donpetry-bot]

Review — fix requested (cycle 1/3)

The automated review identified the following issues. Please address each one:

Findings to fix

Automated review — NEEDS HUMAN REVIEW

Risk: MEDIUM
Reviewed commit: 91ead79bca626d1d0233d08d73a206650a7b9857
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.7)

Summary

PR adds a new daily health-check workflow and shell script to pin/cache the Claude Code CLI version and surface CLI errors. All CI checks pass (shellcheck, CodeQL, SonarCloud, bats, AgentShield) and the logic is sound, but CodeRabbit left an unresolved CHANGES_REQUESTED for one specific finding: actions/cache@v5 on line 45 of daily-pr-review-health.yml is not SHA-pinned, inconsistent with every other action in the same file. The fix is mechanical — replace the floating tag with a commit SHA — but until the review is resolved the merge gate remains blocked.

Findings

• major: actions/cache@v5 uses a floating semver tag. Every other action in daily-pr-review-health.yml (checkout, setup-node, github-script) is pinned to a commit SHA. Replace with the pinned form, e.g. actions/cache@5a3ec84efa3c25ee4efa91b7e0a6d90a17d50cc8 # v5. Note: pr-review.yml has the same gap at line 165 — consider fixing both for consistency.
• minor: sonar-project.properties adds .github/workflows/** to sonar.exclusions, removing SonarCloud analysis from all workflow YAML files. CodeQL for Actions is still running and passing, so coverage is partially compensated, but the NOSONAR comment added in the same diff becomes redundant once the file is excluded.
• info: scripts/pr_review_health.sh references GH_PAT_FALLBACK (line ~38) but the workflow never exports it. The fallback path is safe (empty string check prevents misuse) and the script logs a clear error if the primary token fails, so this is cosmetic.
• info: Secrets are properly handled: CLAUDE_CODE_OAUTH_TOKEN and DON_PETRY_BOT_GH_PAT are read from GitHub Secrets, not hardcoded. Shell script uses set -euo pipefail. Claude CLI is invoked with --no-session-persistence for CI safety. Error output is surfaced via if ! redirect to stderr before aborting — the exact regression that motivated this PR.

---

Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.7). Reply if you need a human review.

Additional tasks

1. Resolve all unresolved review thread comments from other reviewers
2. Ensure all CI checks pass after your changes
3. Rebase on the target branch if behind
4. Do NOT modify files unrelated to the findings above

The review cascade will automatically re-review after new commits are pushed.