docs: name SendMessage worker continuation, fix cross-session gating drift #7203
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: claude-review | |
| # Automated PR code review via the ci-workflows reusable workflow. The caller | |
| # owns the triggers + GITHUB_TOKEN permission grant (a called workflow can only | |
| # downgrade them, never elevate); the reusable workflow owns the action pin and | |
| # the secret-handling safety model. | |
| # | |
| # Fork PRs receive no secrets and a read-only token, so they are simply not | |
| # reviewed by design (no token-exfiltration surface). Requires `claude-code-plugins` to be | |
| # in the CLAUDE_CODE_OAUTH_TOKEN org secret's selected-repositories scope. | |
| # Public repo: runs on the reusable's hosted default runner. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, ready_for_review, reopened] | |
| permissions: | |
| contents: read | |
| jobs: | |
| review: | |
| permissions: | |
| contents: read # checkout + read the diff | |
| pull-requests: write # post review + track_progress tracking comment | |
| id-token: write # OIDC — mints the Claude GitHub App token | |
| # Repo-wide review queue: serializes reviews so parallel PRs queue for the | |
| # shared Claude seat instead of contending for it. Job-scoped and repo-wide | |
| # by design, and deliberately distinct from the reusable's own inner group | |
| # (keyed per PR and head SHA) — a caller group sharing that name would | |
| # deadlock the call against itself. `queue: max` admits no | |
| # `cancel-in-progress`, which the two cannot be combined with anyway | |
| # (https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#jobsjob_idconcurrency). | |
| concurrency: | |
| group: claude-review-${{ github.repository }} | |
| queue: max | |
| uses: melodic-software/ci-workflows/.github/workflows/claude-review.yml@62bef7bab01e8532fedfa739879034a210e9e67d # v0.14.0 | |
| with: | |
| runner: ubuntu-24.04 | |
| # Pass only the one named secret (least privilege) rather than `secrets: | |
| # inherit`, which would forward every parent secret to the called workflow. | |
| secrets: | |
| CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} | |
| # Repo-owned fail-closed supplement for #3147: the reusable workflow stays | |
| # green when the session succeeds but the Skill tool cannot load | |
| # /review:code-review and the agent substitutes a manual diff review. | |
| # This job reads the posted review body (never the job log — #2517) and | |
| # reddens that silent degrade so the check row cannot stay unconditionally | |
| # green through a broken skill chain. | |
| review-skill-evidence: | |
| needs: review | |
| if: >- | |
| always() && | |
| github.event_name == 'pull_request' && | |
| needs.review.result != 'cancelled' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run claude-review skill-evidence guard tests | |
| run: bash scripts/verify-claude-review-skill.sh.test.sh | |
| - name: Verify claude-review invoked the skill | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| GITHUB_EVENT_NAME: ${{ github.event_name }} | |
| GITHUB_ACTOR: ${{ github.actor }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| EVENT_HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| LANE_RESULT: ${{ needs.review.result }} | |
| REVIEWER_LOGINS: claude[bot] | |
| SKIP_ACTORS: dependabot[bot],claude[bot],melodic-ai[bot],melodic-standards-sync[bot],cursor[bot] | |
| run: bash scripts/verify-claude-review-skill.sh |