ci: run @claude on Claude subscription + harden /prompt worktree guidance

[BigSimmo]

Summary

Two related follow-ups to the @claude PR-responder work:

1. Authenticate the @claude workflow with a Claude subscription (.github/workflows/claude.yml)

• Switch from ANTHROPIC_API_KEY (pay-per-use API billing) to CLAUDE_CODE_OAUTH_TOKEN, so runs authenticate against a Claude subscription (Claude Code usage) instead of the metered API. Follow-up to ci: add @claude PR comment responder workflow #973 (merged); same trigger/gating/permissions, only the auth mechanism changed. The job still skips gracefully with a warning when the secret is absent.

2. Harden the /prompt skill's worktree guidance (.claude/skills/prompt/references/coding-workflow.md)

• Require a pre-provisioned worktree to be verified (current branch, clean git status, and merge base against the latest remote default branch) before it's trusted as fresh, instead of being used as-is. Addresses the CodeRabbit worktree-base finding from feat: add /prompt skill with worktree-per-task workflow #959 (which merged before it could be applied). The other two feat: add /prompt skill with worktree-per-task workflow #959 findings needed no change: the SKILL.md size finding was a false positive (the 30-line/220-word limit applies only to .agents/skills/ catalog skills, not this .claude/skills/ skill — check:skills passes), and the pr-policy 4-field assertion was already fixed in merged commit 44c19d8.

Action required before the @claude workflow works (owner-only, one time):

1. Locally, signed into your Claude subscription, run claude setup-token and copy the token.
2. GitHub → Settings → Secrets and variables → Actions → New repository secret, name CLAUDE_CODE_OAUTH_TOKEN, value = that token.
3. Merge this PR, then comment @claude <request> on any open PR to test.

I can't do steps 1–2 for you: the token is minted from your logged-in Claude account, and repo secrets can only be set by a repo admin.

Verification

• npm run verify:pr-local
• Ran locally: node scripts/check-github-action-pins.mjs (pass), npm run check:skills (pass — catalog still valid), Prettier --check on both changed files (pass), and a YAML parse of the workflow (valid).
• Verification not run: full npm run verify:pr-local — changes are one workflow file (auth input swap) and one Markdown doc, with no application source, RAG, or build surface; the relevant Actions-pin and skills gates were run directly instead.
• npm run verify:ui — not applicable (no UI/routing/styling/browser change).

Risk and rollout

• Risk: Low. One workflow file plus one documentation file; no application code. Worst case if the workflow is misconfigured, the job no-ops (skips when the secret is absent) rather than affecting existing CI.
• Rollback: Revert either commit independently — they are self-contained (auth swap vs. doc wording).
• Provider or production effects: At runtime, @claude mentions invoke Claude billed to the configured subscription token — the explicitly requested behavior. No effect until the secret is set.

Clinical Governance Preflight

Not applicable — CI configuration and skill documentation only; does not touch ingestion, answer generation, search/ranking, source rendering, document access, privacy, production env, or clinical output.

Notes

• The workflow acts only for users with write access (built-in permission check) and only on comments/reviews containing the @claude trigger phrase.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

@BigSimmo, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 34 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 00afaa8d-5613-4ba6-8f89-c93e3bde2fad

📥 Commits

Reviewing files that changed from the base of the PR and between 797d44c and 1344a13.

📒 Files selected for processing (2)

• .claude/skills/prompt/references/coding-workflow.md
• .github/workflows/claude.yml

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/github-comments-not-solving-2agr0c

---

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.