revert(ci): drop the automatic PR review trigger, keep the author gate - #191
Merged
Conversation
The pull_request trigger added earlier today fired on every PR and never posted a single review. Three obstacles in sequence: the action's anti-tampering guard, then insufficient token permissions, then 15 tool permission denials that remain unexplained. Every run concluded "success" while producing nothing, at $0.20-$1.12 each. The comment-triggered path was never broken, and is what /create-pr uses. A working control invoked by the command beats a broken one wired to an event. Reverted: the pull_request trigger, the concurrency group (it existed to de-dupe draft/ready toggles on that trigger, and on comment-driven runs it would cancel a legitimate in-progress review), the automation prompt, and the token permission bump that turned out not to be the fix. KEPT deliberately: the author_association gate. Several of these workflows had no gate at all and would run for any commenter on a public repository. That hole was real and predates today's work.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reverts the automatic PR review trigger added earlier today. It fired on every pull request and never once posted a review, while each run concluded
successand cost $0.20–$1.12.The comment-triggered path was never broken.
/create-prposts@claude please review this PRon every PR it opens, and that path demonstrably works. A working control invoked by the command beats a broken one wired to an event.What went wrong
Three obstacles, hit in sequence:
claude-code-actionrefuses to run when the workflow file on a PR branch differs from the default branch, so the rollout PRs could not test themselves.pull-requests: read; posting a comment is a write. Fixed, and it was not the cause.num_turns: 33,total_cost_usd: 1.12,permission_denials_count: 15. These are Claude Code's own tool-permission layer rather than GitHub rejections, and the root cause is unresolved.Changes
.github/workflows/claude.ymlpull_requesttrigger.concurrencygroup. It existed to de-duplicate draft/ready toggles on that trigger; on comment-driven runs it would cancel a legitimate in-progress review, so it is actively wrong without the trigger.prompt, restoring the commented-out original.pull-requests/issuestoread(robosystems only — the repo where they were bumped).Kept deliberately
The
author_associationgate stays. Several of these workflows had no gate at all and would run for any commenter on a public repository — a real hole that predates today's work and is unrelated to the trigger. All four comment arms remain restricted toOWNER/MEMBER/COLLABORATOR.Breaking Changes
None. CI configuration only.
Testing
Each workflow parsed with
yaml.safe_loadand asserted on: nopull_requesttrigger, noconcurrencyblock, nopull_requestarm in the job gate, no automation prompt, permissions atread, and the four author gates intact.