ci: raise claude-implement max-turns to 150 and widen allowedTools

[allxsmith]

Description

Tunes the autonomous implement loop (.github/workflows/claude-implement.yml) so a single combined multi-component run can actually finish. Two changes to the Run Claude (implement issue) step's claude_args:

1. --max-turns 50 → 150 (tripled). The run on [Feature] Make Button, Link, and LinkButton as prop polymorphic (React.ElementType) for router Link integration #188 ended with error_max_turns at 51 turns / 6m10s with no branch or PR produced.
2. Widen --allowedTools with a curated set of low-risk commands. The same run logged permission_denials_count: 10 (~20% of turns wasted on denied calls). Added:
   • read-only git inspection: git status, git diff, git log, git show
   • read-only deps: pnpm ls, pnpm why
   • mkdir (new component/test/docs folders)
   • scoped GitHub CLI: gh issue comment, gh pr edit, gh pr diff, gh pr checks

Affected package(s):

• bulma-ui (@allxsmith/bestax-bulma)
• create-bestax (create-bestax)
• docs (@allxsmith/bestax-docs)
• Other: CI / GitHub Actions (.github/workflows/claude-implement.yml)

Related Issue(s)

Closes #217
Refs #188

Type of Change

• Build tooling

Security notes

This keeps the allowlist model — no bypass / --dangerously-skip-permissions / "auto mode" flag is added. The loop runs on untrusted issue input while holding contents:write + pull-requests:write + issues:write + an app token, so the additions are deliberately limited to read-only and narrowly-scoped write commands. Explicitly kept out: git push/reset/checkout/rebase/merge, curl/wget, pnpm dlx/npx/dep-adding, gh api/secret/workflow/pr merge, rm -rf. --disallowedTools "WebSearch,WebFetch" and the .github/** / release-config guardrails are unchanged.

Checklist

• My code follows the project style guidelines
• I have performed a self-review of my code
• All new and existing tests passed (no test surface — config-only change; YAML validated with yaml.safe_load)
• If this PR changes commands, conventions, or package structure, the affected CLAUDE.md files are updated (N/A — no command/convention change)

Additional Context

This is a .github/** change, which the AI loop's own gate refuses to author — so it is intentionally done as a direct human-reviewed PR rather than through the claude-fix loop. It unblocks the combined Button/Link/LinkButton work in #188 (kept as one issue by design).

🤖 Generated with Claude Code

https://claude.ai/code/session_01NVR5yWevceZEFbTJmpviiM

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Expanded the automated coding workflow’s allowed commands to support more common Git and package-manager checks.
  • Increased the workflow’s conversation limit, allowing longer-running assistance sessions before timing out.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6a77d562-8d67-4d04-9466-7e19b6b355b4

📥 Commits

Reviewing files that changed from the base of the PR and between ef35b09 and fc55d2d.

📒 Files selected for processing (1)

• .github/workflows/claude-implement.yml

---

Walkthrough

This change modifies the claude-implement GitHub Actions workflow, increasing the maximum conversation turns from 50 to 150 and expanding the allowedTools list to include additional pnpm and git command patterns.

Changes

Workflow Configuration Update

Layer / File(s)	Summary
Adjust Claude action arguments .github/workflows/claude-implement.yml	Increases --max-turns from 50 to 150 and expands --allowedTools to include `Bash(pnpm why:*)`, `Bash(git status:*)`, `Bash(git diff:*)`, `Bash(git log:*)`, and `Bash(git show:*)`.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Possibly related issues

• [CI] Widen claude-implement.yml allowedTools and triple --max-turns (50 → 150) #217: Requests the same max-turns increase and allowedTools expansion for the claude-implement workflow implemented here.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main CI workflow change and is concise.
Description check	✅ Passed	The description covers the required sections, affected package, issue refs, change type, checklist, and context.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/issue-217-ci-max-turns-allowlist

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Preview Deployment

Preview URL: https://8e850a85.bestax.pages.dev

[github-actions]

🎉 This PR is included in version 5.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 3.2.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[github-actions]

🎉 This PR is included in version 1.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀