Fix: Silent skip when `pull-requests: read` permission is missing

[sylvansys]

Branch: 76-feature/please-investigate-while-all-agent-revie
Plan file: /home/ben/.claude/plans/polished-tickling-dawn.md

---

Fix: Silent skip when pull-requests: read permission is missing

Root Cause

All agent reviews on constellos/constellos PR #75 were skipped because the deployed workflow is missing the pull-requests: read permission.

Chain of failure:

1. constellos/constellos/.github/workflows/constellos-review.yml declares permissions contents: read, issues: read, actions: read — but NOT pull-requests: read
2. Every reviewer action runs gh pr view <N> --json files ... 2>/dev/null || touch changed.txt — the gh command gets a 403, stderr is suppressed, and touch creates an empty file
3. The validation step sees an empty changed.txt and sets skip=true with "No changed files found or unable to access PR data"
4. All checks show as "⏭️ skipped" with "undefined" names

Why the sync-workflow didn't fix it: The deployed workflow is an older version that predates the sync-workflow job. Since the sync job isn't in the old file, it can't bootstrap itself (chicken-and-egg).

Plan

1. Improve error handling in all 3 reviewer actions

Files to modify:

• .github/actions/requirements-reviewer/action.yml (line 95)
• .github/actions/code-quality-reviewer/action.yml (line 46)
• .github/actions/context-reviewer/action.yml (line 51)

Change: Replace the silent 2>/dev/null || touch pattern with error detection:

mkdir -p .claude/review-context

# Get changed files — capture errors instead of suppressing them
if ! gh pr view ${{ inputs.pr_number }} --json files --jq '.files[].path' > .claude/review-context/changed.txt 2>/tmp/gh-error.log; then
  echo "::warning::Failed to fetch PR files. Check that the workflow has 'pull-requests: read' permission."
  cat /tmp/gh-error.log >&2
  touch .claude/review-context/changed.txt
fi

This way:

• The gh command error is captured in a log file and printed to the action output
• A GitHub Actions ::warning:: annotation points the user to the likely fix
• The action still falls through to skip (doesn't hard-fail), so existing behavior is preserved

2. Update validation step to differentiate causes

For the validation messages, check if the error log indicates a permission issue and surface a more specific skip reason:

if [ ! -s ".claude/review-context/changed.txt" ]; then
  SKIP="true"
  if [ -f /tmp/gh-error.log ] && grep -qi "403\|forbidden\|permission\|Resource not accessible" /tmp/gh-error.log; then
    SKIP_REASON="Missing 'pull-requests: read' permission — add it to workflow permissions block"
  else
    SKIP_REASON="No changed files found or unable to access PR data"
  fi
fi

3. Update the constellos/constellos workflow (manual)

After deploying the action-side fix, manually update constellos/constellos/.github/workflows/constellos-review.yml to the latest template (which includes pull-requests: read and the sync-workflow job). This can be done by copying from .github/templates/constellos-review.yml.

Files to Modify

File	Change
.github/actions/requirements-reviewer/action.yml	Replace silent 2>/dev/null with error capture + warning
.github/actions/code-quality-reviewer/action.yml	Same pattern
.github/actions/context-reviewer/action.yml	Same pattern

Verification

1. Run the existing workflow on a test PR in this repo to confirm actions still work with correct permissions
2. Verify that when pull-requests: read is missing, the action logs a ::warning:: annotation with the fix instead of silently skipping
3. After updating the constellos/constellos workflow, re-run PR feat: Add CI caller workflow + auto-sync review template #75's checks to confirm reviews execute

[sylvansys]

📝 Plan updated (v1)

Timestamp: 2026-01-31T07:34:07.277Z
Plan file: /home/ben/.claude/plans/polished-tickling-dawn.md
Branch: 76-feature/please-investigate-while-all-agent-revie

---

Plan synced automatically via PostToolUse hook

[sylvansys]

Session Closed - No PR Created\n\nSession ID: \nReason: Session was cleared\nClosed at: 2026-01-31T08:02:21.288Z\n\nThis issue was automatically closed because the session ended without creating a pull request.\n\nReopen this issue to continue work.\n\n---\nClosed automatically via SessionEnd hook