ci: replace inlined claude.yml with standard thin-caller stub - #125
Merged
Conversation
The inlined version embedded all three jobs (claude, claude-ci-fix, claude-issue) directly and threaded DON_PETRY_BOT_GH_PAT through checkout tokens and github_token, causing the bot's PAT to author PRs and comments instead of github-actions[bot]. Replace with the standard thin caller that delegates to the org-level reusable workflow (claude-code-reusable.yml@v1) via secrets: inherit, which is the correct pattern per: petry-projects/.github/standards/workflows/claude.yml
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughConverted ChangesWorkflow Delegation Refactoring
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude.yml:
- Around line 1-37: This file (.github/workflows/claude.yml) is an immutable
thin caller stub and must not be edited in-repo; revert any local edits so the
file is byte-for-byte identical to the canonical stub (the one that references
petry-projects/.github/.github/workflows/claude-code-reusable.yml) and ensure
the trigger events, job permissions, the uses: line, secrets: inherit and the
paths-ignore behavior remain exactly as in the standard; if you need a change,
open a PR against the central reusable workflow repository (the org-level
claude-code-reusable.yml) rather than modifying .github/workflows/claude.yml,
and keep the required secret name CLAUDE_CODE_OAUTH_TOKEN intact.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 9441ca1c-8c71-4051-988d-e2a01456da8a
📒 Files selected for processing (1)
.github/workflows/claude.yml
Comment on lines
+1
to
+37
| # ───────────────────────────────────────────────────────────────────────────── | ||
| # SOURCE OF TRUTH: petry-projects/.github/standards/workflows/claude.yml | ||
| # Standard: petry-projects/.github/standards/ci-standards.md#4-claude-code-claudeyml | ||
| # Reusable: petry-projects/.github/.github/workflows/claude-code-reusable.yml | ||
| # | ||
| # AGENTS — READ BEFORE EDITING: | ||
| # • This file is a THIN CALLER STUB. All Claude Code logic, the prompt, | ||
| # allowedTools, and trigger gating live in the reusable workflow above. | ||
| # • You MAY change: nothing in this file in normal use. Adopt verbatim. | ||
| # • You MUST NOT change: trigger events, job permissions, the `uses:` line, | ||
| # or `secrets: inherit`. These are required for the reusable to work. | ||
| # • If you need different behaviour, open a PR against the reusable in the | ||
| # central repo. The change will propagate everywhere on next run. | ||
| # | ||
| # WHY THIS FILE IS IMMUTABLE (agents: read before opening any PR here): | ||
| # Anthropic's OIDC token endpoint validates that this file on a PR branch | ||
| # is byte-for-byte identical to the file on the default branch. Any diff — | ||
| # even a whitespace or comment change — causes the token exchange to fail: | ||
| # "401 Unauthorized — Workflow validation failed" | ||
| # Claude Code will not run on that PR. Do not open compliance PRs against | ||
| # this file. Do not SHA-pin the `uses:` line — internal reusable workflow | ||
| # refs are exempt from the Action Pinning Policy (ci-standards.md | ||
| # §Action Pinning Policy). The @v1 tag is the correct, stable reference. | ||
| # | ||
| # NARROW GUARD: The paths-ignore setting (lines 38-39) under pull_request | ||
| # prevents the workflow from triggering only when the PR's entire changeset | ||
| # is limited to claude.yml alone. PRs that modify claude.yml *plus other | ||
| # files* will still trigger the workflow and hit the 401 error at token | ||
| # exchange. Other triggers (issue_comment, pull_request_review_comment, | ||
| # issues, check_run) are unaffected by paths-ignore and run as configured. | ||
| # ───────────────────────────────────────────────────────────────────────────── | ||
| # | ||
| # Claude Code — thin caller that delegates to the org-level reusable workflow. | ||
| # To adopt: copy this file to .github/workflows/claude.yml in your repo. | ||
| # Required org/repo secret: CLAUDE_CODE_OAUTH_TOKEN | ||
| # Optional org/repo secret: GH_PAT_WORKFLOWS (PAT with `workflow` scope — | ||
| # required if Claude needs to push changes to .github/workflows/*.yml) |
There was a problem hiding this comment.
Do not land repo-local edits to this exempt workflow file.
This PR directly modifies .github/workflows/claude.yml, but that path is explicitly exempt from modification. Even when the replacement is the standard thin stub, changing this file in-repo violates the repo rule for this workflow and conflicts with the immutability contract documented in the header. Please route this through the organization-standard propagation path instead of a normal file edit here.
As per coding guidelines, .github/workflows/{claude.yml,agent-shield.yml}: Do not modify .github/workflows/claude.yml or .github/workflows/agent-shield.yml as these are exempted from agent modification per organization standards.
Also applies to: 46-46, 59-61
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 1 - 37, This file
(.github/workflows/claude.yml) is an immutable thin caller stub and must not be
edited in-repo; revert any local edits so the file is byte-for-byte identical to
the canonical stub (the one that references
petry-projects/.github/.github/workflows/claude-code-reusable.yml) and ensure
the trigger events, job permissions, the uses: line, secrets: inherit and the
paths-ignore behavior remain exactly as in the standard; if you need a change,
open a PR against the central reusable workflow repository (the org-level
claude-code-reusable.yml) rather than modifying .github/workflows/claude.yml,
and keep the required secret name CLAUDE_CODE_OAUTH_TOKEN intact.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR replaces the repository’s previously inlined claude.yml workflow with the org-standard “thin caller” stub so execution, prompts, gating, and token handling are delegated to the central reusable workflow (restoring expected github-actions[bot] attribution).
Changes:
- Replaced the inlined Claude Code workflow jobs with a single reusable-workflow call (
uses: ...claude-code-reusable.yml@v1). - Switched to
secrets: inheritand removed repo-local PAT threading from this workflow. - Added the standard header documenting the immutability/OIDC constraint for this file.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+25
to
+30
| # NARROW GUARD: The paths-ignore setting (lines 38-39) under pull_request | ||
| # prevents the workflow from triggering only when the PR's entire changeset | ||
| # is limited to claude.yml alone. PRs that modify claude.yml *plus other | ||
| # files* will still trigger the workflow and hit the 401 error at token | ||
| # exchange. Other triggers (issue_comment, pull_request_review_comment, | ||
| # issues, check_run) are unaffected by paths-ignore and run as configured. |
This was referenced May 16, 2026
This was referenced May 20, 2026
This was referenced Jun 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The current `claude.yml` was an inlined expansion of the org-level reusable workflow rather than the standard thin caller stub. It threaded `DON_PETRY_BOT_GH_PAT` through:
This caused Claude's PRs and comments to be attributed to `donpetry-bot` instead of `github-actions[bot]`. See #124 for an example of the incorrect attribution.
Fix
Replace the inlined content verbatim with the standard thin caller from:
petry-projects/.github/standards/workflows/claude.yml
The thin stub delegates everything — jobs, prompts, token handling, allowedTools — to `petry-projects/.github/.github/workflows/claude-code-reusable.yml@v1` via `secrets: inherit`. No PAT is passed; the reusable uses `github.token` (i.e. `github-actions[bot]`) for GitHub API calls.
Note on CI
Per the standard's header: the `pull_request` trigger on `claude.yml` changes will hit a 401 at OIDC token exchange (by design — Anthropic validates the file is identical to the default branch). Other CI checks are unaffected.
Summary by CodeRabbit