fix(workflows): refine label management and enhance API response validation

- Updated label removal logic in multiple workflow files
- Added timeout and validation for API responses in Claude API calls
- Improved concurrency handling in plot update workflow

Author: MarkusNeusinger

.github/workflows/bot-ai-review.yml

@@ -252,7 +252,8 @@ jobs:
           # Update sub-issue
           if [ -n "$SUB_ISSUE" ]; then
             gh issue edit "$SUB_ISSUE" \
-              --remove-label "reviewing,ai-rejected" \
+              --remove-label "reviewing" \
+              --remove-label "ai-rejected" \
               --add-label "not-feasible"
 
             # Post final status to sub-issue

.github/workflows/bot-auto-merge.yml

@@ -58,7 +58,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh issue edit ${{ steps.sub_issue.outputs.number }} \
-            --remove-label "reviewing,ai-rejected" \
+            --remove-label "reviewing" \
+            --remove-label "ai-rejected" \
             --add-label "ai-approved"
 
       - name: Enable auto-merge
@@ -142,7 +143,10 @@ jobs:
 
           # Update labels
           gh issue edit $SUB_ISSUE \
-            --remove-label "ai-approved,reviewing,generating,testing" \
+            --remove-label "ai-approved" \
+            --remove-label "reviewing" \
+            --remove-label "generating" \
+            --remove-label "testing" \
             --add-label "merged"
 
           # Post completion comment

.github/workflows/bot-auto-tag.yml

@@ -1,4 +1,5 @@
 name: "Bot: Auto-Tag"
+run-name: "Auto-Tag: ${{ github.event.pull_request.head.ref }}"
 
 on:
   pull_request:
@@ -136,8 +137,8 @@ jobs:
           sed -i "s|\${SPEC_CONTENT}|${SPEC_CONTENT}|g" /tmp/tag_prompt.txt
           sed -i "s|\${PLOT_CONTENT}|${PLOT_CONTENT}|g" /tmp/tag_prompt.txt
 
-          # Call Claude API
-          RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
+          # Call Claude API (with timeout)
+          RESPONSE=$(curl -s --max-time 60 --connect-timeout 10 https://api.anthropic.com/v1/messages \
             -H "Content-Type: application/json" \
             -H "x-api-key: $ANTHROPIC_API_KEY" \
             -H "anthropic-version: 2023-06-01" \
@@ -150,6 +151,14 @@ jobs:
               }]
             }")
 
+          # Validate API response
+          if ! echo "$RESPONSE" | jq -e '.content[0].text' > /dev/null 2>&1; then
+            echo "::warning::API response invalid or empty"
+            echo "Response: $(echo "$RESPONSE" | jq -r '.error // .' 2>/dev/null || echo "$RESPONSE")"
+            echo "tags_generated=false" >> $GITHUB_OUTPUT
+            exit 0
+          fi
+
           # Extract tags from response
           TAGS=$(echo "$RESPONSE" | jq -r '.content[0].text // empty')
 

.github/workflows/bot-validate-request.yml

@@ -21,7 +21,6 @@ jobs:
     permissions:
       contents: read
       issues: write
-      id-token: write
 
     steps:
       - name: Check conditions
@@ -80,6 +79,7 @@ jobs:
 
       - name: Run Claude Code to validate and assign spec ID
         if: steps.check.outputs.should_run == 'true'
+        timeout-minutes: 60
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/ci-lint.yml

@@ -1,4 +1,5 @@
-name: Lint and Format Check
+name: "CI: Lint and Format Check"
+run-name: "Lint: ${{ github.ref_name }}"
 
 on:
   push:

.github/workflows/ci-plottest.yml

@@ -1,4 +1,5 @@
-name: Plot Tests
+name: "CI: Plot Tests"
+run-name: "Plot Tests: ${{ github.head_ref }}"
 
 on:
   pull_request:
@@ -115,3 +116,4 @@ jobs:
         with:
           name: test-results-${{ matrix.python-version }}
           path: test-results/
+          retention-days: 30

.github/workflows/ci-unittest.yml

@@ -1,4 +1,5 @@
-name: Unit Tests
+name: "CI: Unit Tests"
+run-name: "Tests: ${{ github.ref_name }}"
 
 on:
   push:
@@ -40,6 +41,7 @@ jobs:
       with:
         name: coverage-report
         path: coverage.xml
+        retention-days: 30
       if: always()
 
     - name: Upload coverage to Codecov

.github/workflows/gen-library-impl.yml

@@ -30,6 +30,13 @@ on:
         description: "Library-specific dependencies"
         required: true
         type: string
+    outputs:
+      pr_number:
+        description: "PR number created (if any)"
+        value: ${{ jobs.generate.outputs.pr_number }}
+      pr_exists:
+        description: "Whether a PR was created"
+        value: ${{ jobs.generate.outputs.pr_exists }}
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN:
         required: true
@@ -39,11 +46,13 @@ on:
 jobs:
   generate:
     runs-on: ubuntu-latest
+    outputs:
+      pr_number: ${{ steps.pr.outputs.pr_number }}
+      pr_exists: ${{ steps.pr.outputs.pr_exists }}
     permissions:
       contents: write
       pull-requests: write
       issues: write
-      id-token: write
       actions: read
 
     steps:
@@ -57,7 +66,10 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh issue edit ${{ inputs.sub_issue_number }} \
-            --remove-label "testing,reviewing,ai-approved,ai-rejected" \
+            --remove-label "testing" \
+            --remove-label "reviewing" \
+            --remove-label "ai-approved" \
+            --remove-label "ai-rejected" \
             --add-label "generating" 2>/dev/null || true
 
       - name: Set up Python
@@ -108,6 +120,7 @@ jobs:
           fi
 
       - name: Run Claude Code to generate implementation
+        timeout-minutes: 60
         uses: anthropics/claude-code-action@v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

.github/workflows/gen-preview.yml

@@ -1,4 +1,5 @@
-name: Generate Plot Previews
+name: "Gen: Preview Images"
+run-name: "Preview: ${{ github.event.workflow_run.head_branch }}"
 
 on:
   workflow_run:
@@ -321,3 +322,41 @@ jobs:
           path: |
             plot_metadata.json
             previous_versions.json
+
+  # ============================================================================
+  # Job 2: Notify when tests fail (no preview generated)
+  # ============================================================================
+  notify-failure:
+    name: Notify Test Failure
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.conclusion == 'failure' }}
+    permissions:
+      pull-requests: write
+      issues: write
+      actions: read
+
+    steps:
+      - name: Get PR number from workflow run
+        id: get_pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUMBER=$(gh api repos/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }} --jq '.pull_requests[0].number' 2>/dev/null || echo "")
+          echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT
+
+      - name: Post failure notice
+        if: steps.get_pr.outputs.pr_number != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PR_NUM="${{ steps.get_pr.outputs.pr_number }}"
+
+          gh pr comment "$PR_NUM" --body "## ❌ Tests Failed
+
+          Plot tests failed - no preview images were generated.
+
+          **Please check the test workflow for details:**
+          [View test results](https://github.com/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }})
+
+          ---
+          🤖 *[gen-preview workflow](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})*"

.github/workflows/gen-update-plot.yml

@@ -5,6 +5,11 @@ on:
   pull_request:
     types: [labeled]
 
+# Prevent race conditions when multiple repairs trigger for same PR
+concurrency:
+  group: repair-${{ github.event.pull_request.head.ref }}
+  cancel-in-progress: false
+
 jobs:
   update-plot:
     name: Regenerate Plot from AI Feedback
@@ -88,7 +93,8 @@ jobs:
           # Update sub-issue
           if [ -n "$SUB_ISSUE" ]; then
             gh issue edit $SUB_ISSUE \
-              --remove-label "ai-rejected,reviewing" \
+              --remove-label "ai-rejected" \
+              --remove-label "reviewing" \
               --add-label "not-feasible"
           fi
 
@@ -199,7 +205,8 @@ jobs:
           # Update sub-issue
           if [ -n "$SUB_ISSUE" ]; then
             gh issue edit $SUB_ISSUE \
-              --remove-label "ai-rejected,reviewing" \
+              --remove-label "ai-rejected" \
+              --remove-label "reviewing" \
               --add-label "generating"
           fi
 
@@ -287,8 +294,8 @@ jobs:
               f.write(content)
           PYEOF
 
-          # Call Claude API
-          RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
+          # Call Claude API (with timeout)
+          RESPONSE=$(curl -s --max-time 120 --connect-timeout 10 https://api.anthropic.com/v1/messages \
             -H "Content-Type: application/json" \
             -H "x-api-key: $ANTHROPIC_API_KEY" \
             -H "anthropic-version: 2023-06-01" \
@@ -301,6 +308,13 @@ jobs:
               }]
             }")
 
+          # Validate API response
+          if ! echo "$RESPONSE" | jq -e '.content[0].text' > /dev/null 2>&1; then
+            echo "::error::API response invalid or empty"
+            echo "Response: $(echo "$RESPONSE" | jq -r '.error // .' 2>/dev/null || echo "$RESPONSE")"
+            exit 1
+          fi
+
           # Extract improved code
           IMPROVED_CODE=$(echo "$RESPONSE" | jq -r '.content[0].text // empty')
 
@@ -334,11 +348,7 @@ jobs:
             echo "No changes to commit"
           else
             git add plots/
-            git commit -m "fix($LIBRARY): address AI review feedback for $SPEC_ID (attempt $ATTEMPT/3)
-
-          :robot: Generated with [Claude Code](https://claude.com/claude-code)
-
-          Co-Authored-By: Claude <noreply@anthropic.com>"
+            git commit -m "fix($LIBRARY): address AI review feedback for $SPEC_ID (attempt $ATTEMPT/3)"
 
             git push
             echo "Changes pushed"
@@ -389,3 +399,8 @@ jobs:
           COMMENTEOF
 
           gh issue comment "$SUB_ISSUE" --body-file /tmp/update_comment.md
+
+      - name: Cleanup temporary files
+        if: always()
+        run: |
+          rm -f /tmp/improve_prompt.txt /tmp/latest_feedback.md /tmp/all_attempts.md /tmp/update_comment.md