(fix): address review findings on Claude workflows

abnegate · abnegate · commit f74e2a26086b · 2026-04-23T15:12:00.000+12:00
diff --git a/.github/actions/classify-complexity/action.yml b/.github/actions/classify-complexity/action.yml
@@ -67,9 +67,30 @@ runs:
           --dangerously-skip-permissions \
           --output-format json \
           --json-schema "$SCHEMA" \
-          "$CLASSIFY_PROMPT" 2>/dev/null)
+          "$CLASSIFY_PROMPT")
+        STATUS=$?
 
-        CLASSIFICATION=$(printf '%s' "$RAW" | jq -r '.result | fromjson? | .classification // empty' 2>/dev/null)
+        if [[ $STATUS -ne 0 ]]; then
+          echo "claude CLI exited $STATUS — routing to opus."
+          echo "CLI output: $RAW"
+        fi
+
+        # With --json-schema the structured payload lands at .structured_output as a
+        # parsed object. Older builds (or runs without schema) put the response at
+        # .result as either a plain string or a stringified JSON. Try both so the
+        # action keeps working across CLI versions.
+        CLASSIFICATION=$(printf '%s' "$RAW" | jq -r '
+          (.structured_output.classification // "") as $s
+          | if $s != "" then $s
+            else ((.result // "") | fromjson? | .classification // "")
+            end
+        ' 2>/dev/null)
+
+        # Last-ditch fallback: plain .result that happens to be the literal word.
+        if [[ -z "$CLASSIFICATION" ]]; then
+          CLASSIFICATION=$(printf '%s' "$RAW" | jq -r '.result // empty' 2>/dev/null \
+            | tr -d '[:space:]' | tr '[:upper:]' '[:lower:]' | head -c 20)
+        fi
 
         echo "Haiku classification: '$CLASSIFICATION'"
 
diff --git a/.github/workflows/claude-comments.yml b/.github/workflows/claude-comments.yml
@@ -1,26 +1,46 @@
 name: Claude Code
 
+# Only triggers that carry comment bodies worth @claude-scanning.
+# pull_request_review is excluded: it fires on every review submit (even bare
+# approvals), so the @claude filter would show a "Skipped" check in the PR jobs
+# list every time. Inline review comments still fire through
+# pull_request_review_comment, so we don't lose the typical reviewer flow.
 on:
   issue_comment:
     types: [created]
   pull_request_review_comment:
     types: [created]
   issues:
     types: [opened, assigned]
-  pull_request_review:
-    types: [submitted]
 
+# For PR review events (where head.ref is available), share the branch queue
+# with claude-improvement and claude-healing so we never push concurrently to
+# the same head. For issue_comment / issues events, fall back to a per-issue
+# key — can't resolve the branch at concurrency-evaluation time without an API
+# call, but at least successive @claude comments on one PR/issue serialize.
 concurrency:
-  group: claude-comments-${{ github.event.issue.number || github.event.pull_request.number }}-${{ github.event.comment.id || github.event.review.id || github.run_id }}
+  group: claude-pr-${{ github.event.pull_request.head.ref || github.event.issue.number || github.run_id }}
   cancel-in-progress: false
 
 jobs:
   claude:
+    # Gate on author association: Claude runs with --dangerously-skip-permissions
+    # and contents: write, so user-controlled prompt content from untrusted
+    # commenters would be a prompt-injection vector. Only trusted associations
+    # (repo owner, org member, collaborator) can invoke @claude.
     if: |
-      (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
-      (github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
-      (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      (
+        github.event.comment.author_association == 'OWNER' ||
+        github.event.comment.author_association == 'MEMBER' ||
+        github.event.comment.author_association == 'COLLABORATOR' ||
+        github.event.issue.author_association == 'OWNER' ||
+        github.event.issue.author_association == 'MEMBER' ||
+        github.event.issue.author_association == 'COLLABORATOR'
+      ) && (
+        (github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
+        (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
+      )
     runs-on: ubuntu-latest
     permissions:
       contents: write
@@ -29,9 +49,32 @@ jobs:
       id-token: write
       actions: read
     steps:
+      - name: Resolve PR head ref
+        id: ref
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          ISSUE_PR_URL: ${{ github.event.issue.pull_request.url }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+        run: |
+          # pull_request_review* events expose head.ref directly.
+          # issue_comment events on a PR expose issue.pull_request.url; resolve
+          # the branch via gh. Plain issues have neither → stay on default branch.
+          if [[ -n "$PR_HEAD_REF" ]]; then
+            ref="$PR_HEAD_REF"
+          elif [[ -n "$ISSUE_PR_URL" ]]; then
+            ref=$(gh pr view "$ISSUE_NUMBER" --repo "$REPO" --json headRefName --jq .headRefName)
+          else
+            ref=""
+          fi
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+          echo "Resolved checkout ref: '${ref:-<default branch>}'"
+
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: ${{ steps.ref.outputs.ref }}
           fetch-depth: 20
 
       - name: Classify task complexity with Haiku
@@ -48,11 +91,11 @@ jobs:
             TITLE: ${{ github.event.issue.title }}
 
             REQUEST:
-            ${{ github.event.comment.body || github.event.review.body || github.event.issue.body }}
+            ${{ github.event.comment.body || github.event.issue.body }}
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@b4d67413279fc18c6e5de930ae307c4f108714eb # v1.0.104
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           plugin_marketplaces: |
diff --git a/.github/workflows/claude-healing.yml b/.github/workflows/claude-healing.yml
@@ -1,20 +1,22 @@
-name: Claude CI Watcher
+name: Claude CI Healing
 
 on:
   workflow_run:
-    workflows: [CI]
+    workflows: [Tests]
     types: [completed]
 
-# Shared with claude-review: both mutate the PR branch (commit + push), so they
-# must not run simultaneously. Keying on head branch serializes reviewer and
-# watcher runs targeting the same PR into a single queue.
+# Shared with claude-improvement and claude-comments: all three mutate the PR
+# branch (commit + push), so they must not run simultaneously. Keying on head
+# branch serializes runs targeting the same PR into a single queue.
 concurrency:
   group: claude-pr-${{ github.event.workflow_run.head_branch }}
   cancel-in-progress: false
 
 jobs:
   fix-failures:
-    # Only fire on PR failures (not push-to-main) and skip fork PRs.
+    # Only fire on PR failures (not push-to-main) and skip fork PRs. Blocking
+    # fork PRs also mitigates prompt injection via CI logs — only collaborators
+    # with push access can introduce branch content that would feed the prompt.
     if: >
       github.event.workflow_run.conclusion == 'failure' &&
       github.event.workflow_run.event == 'pull_request' &&
@@ -47,10 +49,10 @@ jobs:
 
       - name: Checkout PR branch
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
-          fetch-depth: 10
+          fetch-depth: 0
 
       - name: Get failure logs
         if: steps.pr.outputs.skip != 'true'
@@ -88,7 +90,7 @@ jobs:
 
       - name: Claude fixes CI failures
         if: steps.pr.outputs.skip != 'true'
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@b4d67413279fc18c6e5de930ae307c4f108714eb # v1.0.104
         env:
           PR_NUMBER: ${{ steps.pr.outputs.number }}
           FAILED_RUN_ID: ${{ github.event.workflow_run.id }}
@@ -112,15 +114,16 @@ jobs:
             The failure logs are at /tmp/ci-failure-logs.txt. Read them first.
 
             ## Coordination with the code reviewer
-            The `claude-review` workflow also pushes to this PR branch. We share a
-            concurrency group (branch-keyed), so only one of us runs at a time — but
-            the reviewer may have pushed fix commits between the failing CI run and
-            this job starting. Before STEP 6, `git fetch origin` and
-            `git pull --rebase origin $HEAD_BRANCH`. If rebase conflicts, resolve them
-            (prefer the reviewer's changes unless they directly contradict your CI fix),
-            then continue. After rebasing, re-check whether the CI failure is still
-            reproducible — the reviewer may have already fixed it, in which case post
-            a comment saying so and STOP without pushing.
+            The `claude-improvement` and `claude-comments` workflows also push to
+            this PR branch. We share a concurrency group (branch-keyed), so only one
+            of us runs at a time — but the other may have pushed fix commits between
+            the failing CI run and this job starting. Before STEP 6,
+            `git fetch origin` and `git pull --rebase origin $HEAD_BRANCH`. If rebase
+            conflicts, resolve them (prefer the other workflow's changes unless they
+            directly contradict your CI fix), then continue. After rebasing, re-check
+            whether the CI failure is still reproducible — the other workflow may have
+            already fixed it, in which case post a comment saying so and STOP without
+            pushing.
 
             Your job:
             1. Read the failure logs to identify the root cause (compile error, test failure, lint violation, etc.)
diff --git a/.github/workflows/claude-improvement.yml b/.github/workflows/claude-improvement.yml
@@ -4,17 +4,26 @@ on:
   pull_request:
     types: [opened, synchronize, ready_for_review, reopened]
 
-# Shared with claude-watcher: both mutate the PR branch (commit + push), so they
-# must not run simultaneously. Keying on head branch serializes reviewer and
-# watcher runs targeting the same PR into a single queue.
+# Shared with claude-healing and claude-comments: all three mutate the PR branch
+# (commit + push), so they must not run simultaneously. Keying on head branch
+# serializes runs targeting the same PR into a single queue.
 concurrency:
   group: claude-pr-${{ github.event.pull_request.head.ref }}
   cancel-in-progress: false
 
 jobs:
   claude-review:
     runs-on: ubuntu-latest
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # Defense in depth against prompt injection via PR title/body: require the
+    # PR author to be a trusted association in addition to the head being
+    # internal to this repo (which already blocks forks).
+    if: >
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      (
+        github.event.pull_request.author_association == 'OWNER' ||
+        github.event.pull_request.author_association == 'MEMBER' ||
+        github.event.pull_request.author_association == 'COLLABORATOR'
+      )
     permissions:
       contents: write
       pull-requests: write
@@ -23,7 +32,7 @@ jobs:
 
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           fetch-depth: 0
@@ -71,7 +80,7 @@ jobs:
 
       - name: Run Claude Code Review
         id: claude-review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@b4d67413279fc18c6e5de930ae307c4f108714eb # v1.0.104
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           REPO: ${{ github.repository }}
@@ -95,12 +104,13 @@ jobs:
             You are reviewing and fixing PR #$PR_NUMBER in $REPO.
 
             ## Coordination with the CI watcher
-            The `claude-watcher` workflow also pushes to this PR branch when CI fails.
-            We share a concurrency group (branch-keyed), so only one of us runs at a time —
-            but the OTHER may have pushed between the last event and this job starting.
-            Before committing in STEP 5, `git fetch origin` and `git pull --rebase origin <branch>`.
-            If rebase conflicts, resolve them (prefer the other side's changes unless they
-            contradict a finding you're fixing), then continue.
+            The `claude-healing` and `claude-comments` workflows also push to this PR
+            branch. We share a concurrency group (branch-keyed), so only one of us runs
+            at a time — but the OTHER may have pushed between the last event and this
+            job starting. Before committing in STEP 5, `git fetch origin` and
+            `git pull --rebase origin <branch>`. If rebase conflicts, resolve them
+            (prefer the other side's changes unless they contradict a finding you're
+            fixing), then continue.
 
             ## STEP 1 — Analyze
             Run `/code-review:code-review` for all CRITICAL/HIGH/MEDIUM findings. Skip low/nits.
