ci(review): allowlist claude bot actor at the action level - #58
Merged
Conversation
Follow-up to #57. The job-level `if:` gate now admits PRs authored by claude[bot], but claude-code-action itself has a SEPARATE bot-actor check that refused with: Action failed with error: Workflow initiated by non-human actor: claude (type: Bot). Add bot to allowed_bots list or use '*' to allow all bots. Fix: pass `allowed_bots: claude` (slug match — no `[bot]` suffix at this layer). Deliberately not `*` so any other bot that somehow triggers this workflow still gets refused at the action level. Without this, the review job on #55 (our first real test of an AI-authored PR getting auto-reviewed) reaches the action, gets rejected, and exits 1 — looking like a workflow failure when the intent is just "review this PR." Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
heskew
added a commit
that referenced
this pull request
Jun 9, 2026
Bumps the `claude-issue-to-pr` reusable pin (both `uses:` ref and `ai-review-prompts-ref:`) from f6daed30 to the #58 merge commit 441d2a31, keeping this repo on the same issue-to-PR version as HarperFast/harper and HarperFast/harper-pro. Net change for this repo (clean forward bump, 441d2a31 descends from f6daed30): - :bug/:test issue-to-PR runs now use claude-opus-4-8 (authoring-heavy); :typo/:docs/:deps stay on claude-sonnet-4-6 - prompt steers toward sub-agent-delegated exploration over spelunking - read-only gh pr list / gh search are pre-approved - max-turns ceiling 72 -> 100 - (also picks up the :test format:check tweak and the authorize-ai-workflow.sh rename that moved in with the pin) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #57. Adds
allowed_bots: claudeto theClaude reviewaction inputs.Why
My job-level
if:gate in #57 correctly admitsclaude[bot]-authored PRs to the workflow. Butclaude-code-actionhas its own bot-actor gate, separate from the workflow's, and rejects any run triggered by a Bot unless the bot is on this allowlist:That's what made the review run on #55 fail with exit 1 after all the setup work (checkout, skills clone, layer compose, prompt assembly). The action reached the gate and bailed before even calling the API.
Scope of the allowlist
allowed_bots: claude— slug match, no[bot]suffix at this input layer. Specifically Anthropic's Claude GitHub App. Not*: if any other bot ever triggers this workflow (imagine a future "issue-to-PR v2" from a different app), we'd want to gate it deliberately rather than auto-admit.Test plan
🤖 Generated with Claude Code