[Fleet Monitor] petry-projects/broodly — pr-review.yml

[don-petry]

🟠 DEGRADED: petry-projects/broodly / pr-review.yml

Metric	Value
Failure Rate	47.4% (9 / 19 runs)
Status	DEGRADED
p50 Duration	1s
p95 Duration	1s
Successful Runs	0
Cancelled Runs	0

Workflow: pr-review.yml

Last updated by Fleet Monitor run on 2026-06-04.
Threshold: failure rate > 10% over the monitored window.

[don-petry]

Dev-Lead Implementation Plan

Issue: #286 — [Fleet Monitor] petry-projects/broodly — pr-review.yml

Root Cause

All pr-review.yml runs conclude with startup_failure (GitHub cannot start the workflow at all). Two distinct problems were identified:

1. Missing secrets (primary cause): The workflow explicitly references CLAUDE_CODE_OAUTH_TOKEN, GOOGLE_API_KEY, and COPILOT_GITHUB_TOKEN as named secrets. None of these exist as repo-level secrets (available secrets: APP_ID, APP_PRIVATE_KEY, GCP_*, GH_PAT_WORKFLOWS). The reusable workflow at petry-projects/.github-private declares at least CLAUDE_CODE_OAUTH_TOKEN as required: true. Passing an empty value for a required secret causes GitHub to raise startup_failure before any runner is provisioned.

2. Missing job-level permissions (secondary cause): The workflow sets permissions: {} at the workflow level (zeroes all permissions) but specifies no permissions: at the job level. This means the GITHUB_TOKEN passed to the reusable workflow has zero effective permissions, preventing any API calls the reusable workflow needs to post reviews.

Evidence: Comparing to working workflows:

• dev-lead.yml → uses secrets: inherit + explicit job-level permissions → works
• pr-review-mention.yml → uses secrets: inherit + permissions: pull-requests: write → works
• pr-review.yml → uses explicit named secrets + no job permissions → startup_failure

Scope

Fix pr-review.yml to use secrets: inherit and add the minimum required job-level permissions for a PR review agent.

Implementation Checklist

• .github/workflows/pr-review.yml — replace explicit secrets: block with secrets: inherit
• .github/workflows/pr-review.yml — add job-level permissions: block (pull-requests: write, contents: read, issues: read)

Tests to Write

TDD Exception: This is a pure CI configuration fix. The behavioral test is "the workflow completes without startup_failure", which requires GitHub Actions infrastructure. No unit-testable code is changed. YAML syntax will be validated with actionlint or python3 -c "import yaml" as a proxy.

• Validate YAML syntax of the fixed workflow file
• Run bash .dev-lead/scripts/dev-lead-lint.sh to confirm no lint regressions

Test Command

bash .dev-lead/scripts/dev-lead-lint.sh

[don-petry]

Dev-Lead: Implementation Complete

Root Cause

startup_failure on every run was caused by two problems in .github/workflows/pr-review.yml:

1. Missing secrets (primary): The workflow explicitly passed CLAUDE_CODE_OAUTH_TOKEN, GOOGLE_API_KEY, and COPILOT_GITHUB_TOKEN — none of which exist as repo-level secrets. The reusable workflow declares CLAUDE_CODE_OAUTH_TOKEN as required; passing an empty value causes GitHub to raise startup_failure before any runner is provisioned.

2. No job-level permissions (secondary): With permissions: {} at the workflow level and no permissions: at the job level, the GITHUB_TOKEN had zero effective permissions — it couldn't make any GitHub API calls needed by the reusable workflow.

Plan Execution

• Replaced explicit secrets: block with secrets: inherit — properly inherits org-level secrets (CLAUDE_CODE_OAUTH_TOKEN, GOOGLE_API_KEY, COPILOT_GITHUB_TOKEN) that are unavailable as repo-level secrets
• Added job-level permissions: (contents: read, pull-requests: write, issues: read) — minimum required for a PR review agent

Test Results

  [lint] shellcheck on 2 file(s)...
  [lint] all checks passed

YAML syntax validated via python3 -c "import yaml; yaml.safe_load(...)" — structure confirmed correct.

TDD Exception noted in plan: This is a CI configuration fix. The behavioral test is "workflow no longer startup_fails", which requires GitHub Actions infrastructure. No unit-testable code was changed.

Files Changed

• .github/workflows/pr-review.yml: replaced explicit secrets: with secrets: inherit; added job-level permissions: {contents: read, pull-requests: write, issues: read}

Notes

Pattern aligns with existing working workflows in this repo: dev-lead.yml and pr-review-mention.yml both use secrets: inherit with explicit job-level permissions and have no startup_failure history.