Migrate claude-code-review.yml to the Morrison-Lab/gha reusable workflow by d-morrison · Pull Request #181 · Morrison-Lab/rpt

d-morrison · 2026-08-04T01:04:07Z

Closes #178.

Replaces rpt's bespoke anthropics/claude-code-action@v1 review workflow with a thin caller of Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v2. A DRW win: one less bespoke workflow to maintain, and rpt now inherits upstream hardening automatically as @v2 slides (stub-review retry, the is_error/verdict guard, prior-review-context dedup, older-comment collapse, the cost comment, and fixes like gha#400).

Follows rme's migration (d-morrison/rme's stub), the closest peer (R package with automatic review).

The two gaps the issue flagged

Gap 1 --- tag mode vs agent mode: migrate now in agent mode

Upstream anthropics/claude-code-action#1415 (the read_only input that would make tag mode safe) is still an open, unmerged feature request, and agent mode can't post inline comments (anthropics/claude-code-action#635 leaves the inline-comment tool uninitialized). So the practical choice was migrate-now-summary-only vs keep-bespoke-until-upstream-ships. Confirmed with the maintainer: migrate now, accepting summary-only reviews. The stub documents flipping track-progress: true once either upstream fix lands.

Because agent mode is summary-only, the prompt-addendum drops the old "post line-specific findings as inline comments" instruction (it would tell the reviewer to use a tool that isn't initialized); the R-package-specific guidance is otherwise preserved verbatim.

Gap 2 --- reviewer toggling: already resolved upstream, no caller-side jobs needed

The issue's premise ("the gha reusable review workflow has no equivalent") is now stale. The reusable workflow already stashes/clears all requested reviewers (human and AI, e.g. Copilot) before Claude reviews and re-requests them when it finishes --- a superset of the hardcoded d-morrison-only DELETE/POST this file used to carry. So reviewer toggling comes for free; the two custom jobs are simply gone.

Feature diff (bespoke -> reusable)

Bespoke behavior	Reusable equivalent
automatic `pull_request` review	preserved (same trigger types)
`workflow_dispatch` re-review (`pr_number`)	preserved; wired through as `pr-number` (now `type: string`, matching `gh workflow run -f`)
`allowed_bots: github-actions[bot],claude`	`allowed-bots: "github-actions[bot],claude"`
skip drafts / Dependabot / fork PRs	reusable's internal `if:` (draft + `sender.type != 'Bot'` + same-repo)
self-review-skip when PR edits this file	handled inside the reusable workflow
remove/re-add `d-morrison` reviewer	reusable stash/clear/restore of all reviewers
R-package review prompt	passed as `prompt-addendum` (inline-comment instruction dropped for agent mode)
fresh comment per run, prior-review dedup	inherited from reusable

lab-manual (SERG manual) and use-ai-config default on, so rpt gains the lab's shared review conventions on top of its own CLAUDE.md.

Scope

claude.yml (the @claude agent workflow) is a separate migration per the issue, with its own reviewer-toggling difference (bespoke removes-while-working + re-adds-after; the reusable claude.yml re-requests the reviewer on push). rme deliberately kept its bespoke claude.yml, so there's precedent either way --- happy to do it as a follow-up.

Note on this PR's own review

This PR edits claude-code-review.yml, so the bespoke workflow still on main self-skips its review (its own selfmod guard), and the new @v2 reusable one isn't on main yet --- so neither produces an automated verdict here. The migrated workflow takes effect on the next PR after merge.

🤖 Generated with Claude Code

@v2

…low (closes #178) Replace the bespoke anthropics/claude-code-action@v1 review workflow with a thin caller of Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v2, so rpt inherits upstream hardening automatically as @v2 slides (stub-review retry, verdict/is_error guard, prior-review-context dedup, older-comment collapse, cost comment, gha#400's duplicate-review fix). Gap 2 (reviewer toggling) is resolved for free: the reusable workflow already stashes/clears all requested reviewers (human and AI) while Claude reviews and re-requests them afterward -- a superset of the removed d-morrison-only toggle. Gap 1 (tag vs agent mode): migrate in agent mode (track-progress defaults false) since upstream read_only support (anthropics/claude-code-action#1415) is unshipped and agent mode can't post inline comments (anthropics/claude-code-action#635). Reviews are summary-only for now; flip track-progress: true once one of those upstream fixes lands. rpt's R-package review guidance is preserved via the prompt-addendum input.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

github-actions · 2026-08-04T01:07:42Z

PR Preview Action v1.8.1
🚀 View preview at https://Morrison-Lab.github.io/rpt/pr-preview/pr-181/
Built to branch `gh-pages` at 2026-08-04 01:07 UTC. Preview will be ready when the GitHub Pages deployment is complete.

d-morrison · 2026-08-04T01:07:50Z

Self-review (no external reviewer reachable for this PR)

Copilot was requested but refused for quota ("reached their quota limit") — a refusal, not a verdict.
review / claude-review ran green but self-skipped: this PR edits claude-code-review.yml, so the reusable workflow's selfmod guard skips the review (it runs on the next PR after merge). This is expected, not a defect.
d-morrison can't be auto-requested (the session is authenticated as that account).

So this migration rests on a self-review plus the fact that the reusable @v2 workflow ran end-to-end and green on this very PR (review / gather-context + claude-review + require-review all succeeded).

What I verified

Claims fact-checked against the reusable workflow source, not just asserted: reviewer stash/clear/restore of all reviewers (human + AI) is real (claude-code-review.yml steps Stash and clear reviewers / the commit-path restore); agent mode leaves the inline-comment tool uninitialized (run-claude-review-attempt/action.yml, upstream #635); read_only (#1415) is open/unmerged.
No behavior silently dropped: automatic pull_request review, workflow_dispatch re-review, allowed_bots, draft/Dependabot/fork skips, and self-review-skip all have reusable equivalents (see the PR body's feature-diff table). The one intentional loss — per-line inline comments — is the agent-mode tradeoff you approved, and is restorable later via track-progress: true.
Inputs/perms/secrets match the reusable's contract and the upstream example stub (pr-number is type: string; issues: write for the cost comment; only CLAUDE_CODE_OAUTH_TOKEN needed — rpt has no submodules).
YAML valid; ASCII-only (the bespoke ≤ became <=).
prompt-addendum drops the now-inapplicable inline-comment instruction and keeps rpt's R-package specifics (roxygen/R-check-docs.yml, .lintr.R, testthat, NEWS.md/news.yaml, CI hygiene).

Verdict: clean. No blocking findings. Leaving the merge to a human, since no external verdict is obtainable pre-merge.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@claude

…loses #182) Replace the bespoke anthropics/claude-code-action@v1 @claude agent workflow with a thin caller of Morrison-Lab/gha/.github/workflows/claude.yml@v2, so rpt inherits upstream hardening as @v2 slides (bot-actor self-trigger guard, late comment polling, reviewer re-request + review re-dispatch on push, cost comment, push-failure reporting). The second half of #178 (whose review- workflow half landed in #181). Two deliberate behavior changes (see #182): - contents: read -> write: the agent can now push branches and open PRs (the bespoke agent was comment-only). - Adds a trusted-author gate (OWNER/MEMBER/COLLABORATOR): the bespoke workflow gated only on the @claude mention with no author check, so the gate is what makes the contents: write upgrade safe. The two are coupled. The bespoke reviewer stash-while-working / re-add-after is replaced by the reusable's reviewer input (re-request d-morrison when Claude pushes commits). Inputs: install-quarto (rpt uses Quarto for vignettes/website); setup-r and use-renv left at defaults (true/false) since rpt CI restores deps from DESCRIPTION via setup-r-dependencies, not renv. rpt's R-package pre-commit checklist rides along via prompt-addendum.

…le-call timeout exception Review of #183 (claude-review, Needs more work) raised two documentation findings; both addressed: 1. The header comment and PR body flagged only contents: read->write, but the diff also escalates issues: read->write and actions: read->write. The header now enumerates all four permission changes with each one's reason. 2. A uses: reusable-workflow-call job cannot set timeout-minutes, so this job inherits the reusable's timeout-minutes: 60, exceeding copilot-instructions.md's 50-minute cap. #181 already merged the same structural gap, so main's own instructions were already contradicted. Add a reusable-call exception to that rule and disclose the 50->60 change in the header. No functional change to the workflow (claude.yml edits are comment-only). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings August 4, 2026 01:04