chore: Re-apply the repo-ci-baseline Template

[mpaulosky]

Why

Re-Apply the repo-ci-baseline Template so this repo carries the Template changes from mpaulosky/dotfiles#158, mpaulosky/dotfiles#159, mpaulosky/dotfiles#160, mpaulosky/dotfiles#161 and mpaulosky/dotfiles#162.

What changed

• 86a4212 Apply commit, apply.sh output alone: brings fix: Add review:claude only once a PR's checks are green dotfiles#158, fix: Make Claude Review cover exactly the files Copilot reviews dotfiles#159, fix: Say a review that hit its cap needs a person, not a rerun dotfiles#160, chore: Check every --max-turns in Claude Review against MAX_TURNS dotfiles#161 and chore: Find claude_args in the Review step for the --max-turns sync test dotfiles#162.
  • .github/scripts/tests/test_claude_review_split_diff.py (added)
  • .github/scripts/tests/test_post_claude_review.py
  • .github/workflows/claude-review.yml
  • .github/workflows/pr-automerge.yml

Verification

• The Apply commit is exactly apply.sh's output on a branch up to date with main.

• The pre-push gate (scripts/gate.sh) passed on 86a4212.

• 53c6269 Apply commit, apply.sh output alone: brings fix: Add review:claude only once a PR's checks are green dotfiles#158, fix: Make Claude Review cover exactly the files Copilot reviews dotfiles#159, fix: Say a review that hit its cap needs a person, not a rerun dotfiles#160, chore: Check every --max-turns in Claude Review against MAX_TURNS dotfiles#161, chore: Find claude_args in the Review step for the --max-turns sync test dotfiles#162, fix: Hold the merge on code Claude Review doesn't read dotfiles#163 and fix: Hold every changed SVG and only data-count named coverage reports dotfiles#164.

• eca4e94 Apply commit, apply.sh output alone: brings fix: Add review:claude only once a PR's checks are green dotfiles#158, fix: Make Claude Review cover exactly the files Copilot reviews dotfiles#159, fix: Say a review that hit its cap needs a person, not a rerun dotfiles#160, chore: Check every --max-turns in Claude Review against MAX_TURNS dotfiles#161, chore: Find claude_args in the Review step for the --max-turns sync test dotfiles#162, fix: Hold the merge on code Claude Review doesn't read dotfiles#163, fix: Hold every changed SVG and only data-count named coverage reports dotfiles#164, fix: Close the gaps the re-apply PRs' round 2 reviews found in Claude Review's holds dotfiles#165, fix: Know an LFS pointer by its oid or any version git-lfs accepts dotfiles#166, fix: Hold a symlink, and know an LFS pointer only by its shape dotfiles#167, fix: Read an LFS pointer's lines as git-lfs does dotfiles#168 and fix: Hold every excluded file a PR adds or changes dotfiles#169.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.63%. Comparing base (38c46a6) to head (eca4e94).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #248   +/-   ##
=======================================
  Coverage   85.63%   85.63%           
=======================================
  Files          75       75           
  Lines        1566     1566           
  Branches      186      186           
=======================================
  Hits         1341     1341           
  Misses        190      190           
  Partials       35       35           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Test Results Summary

485 tests  ±0   485 ✅ ±0   22s ⏱️ -6s
  9 suites ±0     0 💤 ±0 
  9 files   ±0     0 ❌ ±0 

Results for commit eca4e94. ± Comparison against base commit 38c46a6.

♻️ This comment has been updated with latest results.

[github-actions]

Claude Review

This PR changes how Claude Review gets the diff. It used to read one pr.diff. Now an inline Python step splits the diff into numbered pieces of at most 40 KB and 1,500 lines each, sorted by kind (workflows, then scripts, source, tests, docs, deleted files). The step also writes an INDEX and leaves out every file Copilot code review excludes. Other changes:

• The prompt now asks for at most 24 parallel Reads.
• --max-turns goes from 7 to 30, and a new --max-budget-usd 3 caps cost.
• The answer check reads the execution file. If a listed piece wasn't read whole, or a piece was past the read budget, it adds an off-diff finding that holds the merge, and prints that piece's files inside a stop-commands block.
• The warning step can now tell a sign-in failure or a hit cap from a usage limit.
• PR Auto-Merge also listens for "repo-ci-baseline Template".
• New tests cover the splitter, the hold and the warning step.

I read both pieces (001.diff: claude-review.yml and pr-automerge.yml; 002.diff: both test files), INDEX and CLAUDE.md. There is no AGENTS.md.

The splitting, line-number and hold logic looks sound, and I found no injection path from PR paths into the prompt or into workflow commands. Two things rest on behaviour I couldn't check here:

• The post script and PR Auto-Merge must treat the added {path: "diff", line: 0} finding as an off-diff hold.
• The action's execution file must keep Claude Code's top-level tool_use_result.file (startLine, numLines, totalLines), one tool result per user message. If either changes, every review will hold the merge (fails safe, but noisy).

Verdict: the mechanics are fine. Before this merges on its own, a maintainer should fix, or knowingly accept, two gaps: some executable files now merge with no review, and a .gitattributes -diff line can hide changes from it.

[github-actions]

Claude Review

This PR changes claude-review.yml in four ways. It splits the PR's diff into numbered pieces under 40 KB / 1,500 lines (INDEX holds the paths) so that one turn of reads covers the whole diff. It leaves out the files Copilot excludes, but holds the merge for excluded files that aren't inert data and for binaries that aren't media. The answer check now holds the merge when a listed piece wasn't read whole, as shown by the execution file's tool_use_result. It raises --max-turns to 30 and adds --max-budget-usd 3. Separately, the warn step now tells a capped review and a sign-in failure apart from a usage limit. pr-automerge also listens for the "repo-ci-baseline Template" workflow, and the PR adds tests for the splitter, the hold and the warn step.

I read every piece (001–003) and INDEX. There is no AGENTS.md, and CLAUDE.md only covers the C# code.

I could not check here that Claude Code's execution file puts each parallel tool_result in its own user message with a tool_use_result.file account. If it doesn't, every review holds the merge. That fails closed, so it isn't unsafe.

Verdict: the splitting, quoting and workflow-command handling hold up. Unusual paths, long lines, empty diffs, binaries, the PR's own .gitattributes, and Reads that are cut short or fail all end in a hold or a correct split. One gap remains: git's rename detection lets a PR take a reviewed file, including a workflow, out of review without anything holding the merge. Fix that before relying on this as an auto-merge gate.