| Age | Commit message (Collapse) | Author |
|---|
|
The log shows two gated tools, not one: compound Bash pipelines AND Write — the
review tried to drop check_headings.py (at /tmp, then the workdir, both denied).
Add Write to the allowlist.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
Every blocked call in the review log was a compound Bash pipeline; Read/Grep/
Glob/Task already ran un-prompted, so only bare Bash needs allowlisting.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
The auto-review job runs /code-review headless, which uses Bash (git diff, gh),
file search, and Task (it fans out sub-agent reviewers). None were allowlisted,
so every such call stalled on a per-tool approval prompt and the review couldn't
gather the diff or spawn reviewers. Add --allowedTools.
Safe here (unlike claude.yml): this job is gated to same-repo PRs and its token
is contents:read, so it cannot push. Bash is broad — scope to git/gh/grep if
preferred.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
Pass --effort max to the claude CLI in the auto-review workflow so PR
reviews run at maximum reasoning effort. Switch claude_args to a
multi-line block scalar for readability, keeping --max-turns 50 and
--model claude-opus-4-8 unchanged.
Co-Authored-By: Claude Fable 5 <[email protected]>
|
|
The review action currently runs on the default Sonnet 4.6. On PR #3643
(musb EP0 race) it posted "No issues found" while an Opus pass on the
same diff surfaced substantive questions (ISR-boundary RXRDY lifetime,
regression scope of the DATA-state split). Pin the reviewer to
claude-opus-4-8 for higher-signal reviews; subagents keep their cheaper
default models.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
|
The Claude Code Review action runs /code-review:code-review with a hard
--max-turns cap. On large PRs (e.g. #3636 "add stm32c5 support", 29 files
/ +1689), the agent exhausts 20 turns exploring the diff before it can
produce and post its review, so the SDK returns an error and the
claude-review check fails red with:
Reached maximum number of turns (20)
Raise the cap to 50 so port-sized PRs complete and post their review.
Cost scales with tokens, not the cap: a finished review pays the same
whether the ceiling is 25 or 50 — the cap only bites when the agent
would otherwise be force-stopped mid-run.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
|
Add --comment so the auto-review is actually posted on the PR.
|
|
The review workflow posted nothing when a review found no issues:
with use_sticky_comment unset, the only output path was inline
comments, so a clean review surfaced no comment at all on the PR.
Enable use_sticky_comment so a single summary comment is posted/
updated every run, making "no issues found" results visible.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
Add allowed_bots: 'claude' so that when claude[bot] pushes commits the
workflow skips gracefully instead of erroring.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
- claude.yml: drop the issues "assigned" trigger; its author_association
gate keys on the issue author, not the assigner, so a maintainer
assigning an outside contributor's issue would be wrongly skipped.
- claude-code-review.yml: issues: read -> write so use_sticky_comment can
create/update its PR comment via the issues API.
- hil SKILL.md: make local/remote command blocks copy-pasteable (drop
[-b BOARD_NAME] notation for concrete examples) and fix timeout
(600000 ms is 10 min; use 1200000 ms for the stated 20 min).
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
- claude.yml: gate @claude on author_association (OWNER/MEMBER/COLLABORATOR)
so the write-scoped token and OAuth secret are never issued for an
untrusted commenter on this public repo (defense-in-depth).
- claude-code-review.yml: skip fork PRs in the job condition
(head.repo.full_name == github.repository) since forks get no secrets
and would only fail noisily; fix the misleading token comment; pass
additional_permissions: actions: read so actions: read is effective.
- hil SKILL.md: reword hostname guidance, use full test/hil/* paths, and
show an explicit CONFIG= assignment so the local command is runnable.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
|
|
- claude-code-review.yml: re-enable (drop `if: false`); switch from
pull_request_target to pull_request so fork PRs never receive the
OAuth token (avoids prompt-injection token leak). Auto-review on
open/synchronize/reopen/ready_for_review, skip drafts, sticky comment.
- claude.yml: grant contents/pull-requests/issues write so @claude can
reply and push fixes; @claude is the on-demand path for fork PRs.
|
|
error handling
update AGENTS.md with metrics compare
|
|
|
|
Switch pull_request to pull_request_target so secrets and OIDC tokens
are available when reviewing PRs from forks. Also add pull-requests: write
permission so the action can post review comments.
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
|
Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
|
|
|
|
|
|
|
|
|
