fix: restore full-auto PR pipeline end to end#1049
Conversation
Three breaks found by live-run diagnosis after #1047 merged: 1. The agent invoked ./scripts/create-docs-pr.sh as a multi-line command (backslash continuations), which prefix permission rules never match -> denied 4x, gave up. Prompt now mandates single-line invocation and explains why. 2. The main ruleset requires PRs (no bypass actors), so the prompt's 'commit directly to main' path could never work. Minor changes now go through a PR + immediate self-merge (0 approvals required). Tripwire uses --state all so a self-merged PR is not a false alarm. 3. claude-review.yml (day shift) still ran @main with --allowedTools in claude_args - the same June parsing change silently denied 'gh pr merge', so auto-merge was dead too. Pinned to v1.0.168, permissions moved to shared .claude/settings.json (union of both workflows' allowlists + basic read-only utils). Also: re-ignore content/github/**/.claude/ mirror dirs (unignored by #1047's root-only rule, they dirtied the CI workspace every run and tripped the verify step), and drop the temporary show_full_output flag. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
Restores the end-to-end “full-auto” docs PR pipeline by hardening the GitHub Actions workflows against tool-permission parsing issues, ensuring PR creation/merge paths work under push-protected main, and eliminating recurring CI tripwires from untracked mirror artifacts.
Changes:
- Pin
anthropics/claude-code-actiontov1.0.168and move tool allowlisting out of workflow args into shared.claude/settings.json. - Update the fetcher agent prompt to enforce single-line PR script invocation and switch minor updates to PR + immediate self-merge.
- Fix verification/tripwire logic and workspace cleanliness (
gh pr list --state all, ignore mirrored.claude/dirs), and remove the temporaryshow_full_outputflag.
Reviewed changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.gitignore |
Ignore content/github/**/.claude/ mirror dirs to prevent “dirty workspace” CI failures. |
.github/workflows/fetch-claude-docs.yml |
Remove temporary full-output flag; update agent instructions for PR/self-merge; adjust tripwire PR detection (--state all). |
.github/workflows/claude-review.yml |
Pin Claude action version and remove inline --allowedTools allowlist from claude_args. |
.claude/settings.json |
Expand centralized allowlist for GitHub CLI operations and common shell utilities used by the agent. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| **For minor changes (PR + immediate self-merge)**: | ||
| ```bash | ||
| git add . | ||
| git commit -m "docs: {what} (minor)" | ||
| git push | ||
| ./scripts/create-docs-pr.sh "{what} (minor)" "{one-line why}" "{version}" | ||
| gh pr merge {pr-url} --rebase | ||
| ``` |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c38e3a42f7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| git commit -m "docs: {what} (minor)" | ||
| git push | ||
| ./scripts/create-docs-pr.sh "{what} (minor)" "{one-line why}" "{version}" | ||
| gh pr merge {pr-url} --rebase |
There was a problem hiding this comment.
For the minor-change path, this asks the Claude Code Action session to run gh pr merge, but the vendored action docs state that action sessions cannot merge branches/rebase and that this is enforced in Claude's system prompt even when the underlying Bash tools are allowed (content/github/claude-code-action/docs/capabilities-and-limitations.md:23, docs/faq.md:66-71). In that scenario Claude will decline or skip the merge, while the later tripwire only checks that some PR exists for the branch, so minor fetches can leave open PRs and still report a green run instead of self-merging.
Useful? React with 👍 / 👎.
Follow-up to #1047, driven by live verification runs (29438312884, 29439327563 with full output).
What was still broken after #1047
create-docs-pr.shcall deniedgh pr merge --rebase, 0 approvals needed)claude-review.ymlstill on@mainwith--allowedTools Bash(gh pr:*)in claude_args — same whitespace-split bug as the June incident.claude/settings.json/.claude/*ignore unignoredcontent/github/**/.claude/mirror dirs → tripwire red every rungh pr list --headdefaults to open PRs; a self-merged PR (branch auto-deleted) reads as 'no PR'--state allAlso removes the temporary
show_full_outputdiagnostic flag (#1048).Verification plan
Manual
workflow_dispatchafter merge: expect green run + a real PR for the pending v2.1.205-210 catch-up.🤖 Generated with Claude Code