feat(auto-rebase): add claude-rebase agentic fallback for merge conflicts

.github/workflows/auto-rebase-reusable.yml

@@ -22,8 +22,9 @@
 # Failure modes handled gracefully:
 #   - without `workflows` permission (403): posts an idempotent comment asking
 #     the author to rebase manually (sentinel: <!-- auto-rebase-blocked -->)
-#   - merge conflict (422): posts an idempotent comment asking the author to
-#     resolve conflicts (sentinel: <!-- auto-rebase-conflict -->)
+#   - merge conflict (422): posts an idempotent comment noting that Claude will
+#     attempt an agentic rebase (sentinel: <!-- auto-rebase-conflict -->), which
+#     triggers the claude-rebase job in claude-code-reusable.yml
 #
 # No secrets required — uses github.token only. No auto-merge logic.
 name: Auto-rebase non-Dependabot PRs (Reusable)
@@ -112,8 +113,10 @@ jobs:
                   echo "  Posting conflict resolution request"
                   CONFLICT_BODY="<!-- auto-rebase-conflict -->"
                   CONFLICT_BODY+=$'\n'"**Auto-rebase failed — merge conflict** — this branch has conflicts"
-                  CONFLICT_BODY+=" with \`$BASE_BRANCH\` that must be resolved manually."
-                  CONFLICT_BODY+=$'\n\n'"Please resolve the conflicts and push:"
+                  CONFLICT_BODY+=" with \`$BASE_BRANCH\` that must be resolved."
+                  CONFLICT_BODY+=$'\n\n'"Claude will attempt to resolve this automatically. If it cannot, a"
+                  CONFLICT_BODY+=" follow-up comment will explain what needs manual attention."
+                  CONFLICT_BODY+=$'\n\n'"To resolve manually instead:"
                   CONFLICT_BODY+=$'\n'"\`\`\`"$'\n'"git fetch origin"
                   CONFLICT_BODY+=$'\n'"git merge origin/$BASE_BRANCH"
                   CONFLICT_BODY+=$'\n'"# resolve conflicts, then:"

.github/workflows/claude-code-reusable.yml

@@ -346,3 +346,105 @@ jobs:
                - If the comment requires human judgment, leave a reply explaining what you need.
             4. Check CI status. If CI fails, read the logs, fix the issues, and push again. Repeat until CI passes.
             5. When CI is green, all actionable review comments are resolved, and the PR is ready, read the CODEOWNERS file and leave a comment tagging the relevant code owners to review and merge.
+
+  # Automation mode: agentic rebase — resolve conflicts when auto-rebase fails with a merge conflict (422)
+  claude-rebase:
+    if: >-
+      github.event_name == 'issue_comment' &&
+      github.event.issue.pull_request &&
+      github.event.comment.user.login == 'github-actions[bot]' &&
+      contains(github.event.comment.body, '<!-- auto-rebase-conflict -->')
+    concurrency:
+      group: claude-rebase-${{ github.event.issue.number }}
+      cancel-in-progress: true
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write
+      id-token: write
+      pull-requests: write
+      issues: write
+      actions: read
+      checks: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 1
+          token: ${{ secrets.GH_PAT_WORKFLOWS || github.token }}
+      - name: Run Claude Code
+        uses: anthropics/claude-code-action@476e359e6203e73dad705c8b322e333fabbd7416 # v1.0.119
+        with:
+          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          github_token: ${{ secrets.GH_PAT_WORKFLOWS || github.token }}
+          # yamllint disable rule:line-length
+          claude_args: |
+            --allowedTools "Bash(gh pr checkout:*),Bash(gh pr view:*),Bash(gh pr comment:*),Bash(gh api:*),Bash(git*:*),Edit,Write"
+          # yamllint enable rule:line-length
+          # yamllint disable rule:line-length
+          prompt: |
+            The auto-rebase workflow detected a merge conflict on PR #${{ github.event.issue.number }}.
+
+            Your job: check out the PR branch, rebase it onto the base branch, resolve all conflicts using best-effort judgement, push, and post a summary comment. If conflicts cannot be resolved safely, abort cleanly and post a clear failure comment with manual instructions.
+
+            ## Steps
+
+            ### 1. Configure git identity
+            ```
+            git config user.name "claude[bot]"
+            git config user.email "claude[bot]@users.noreply.github.com"
+            ```
+
+            ### 2. Get PR details
+            ```
+            gh pr view ${{ github.event.issue.number }} --json number,headRefName,baseRefName,title
+            ```
+
+            ### 3. Check out the PR branch
+            ```
+            gh pr checkout ${{ github.event.issue.number }}
+            ```
+
+            ### 4. Rebase onto the base branch
+            ```
+            git fetch origin
+            git rebase origin/<baseRefName>
+            ```
+            (Use the actual `baseRefName` from step 2.)
+
+            ### 5. For each conflict, apply the appropriate resolution strategy
+
+            **Workflow YAML files (`.github/workflows/*.yml`) — action pin conflicts:**
+            - Read both versions (ours = PR branch, theirs = base branch).
+            - If the conflict is a pinned SHA/tag for a `uses:` line, compare versions and accept the newer pin.
+            - When the base branch has a newer or equal version, prefer the base branch (`git checkout --theirs -- <file>`).
+            - When the PR branch has a provably newer pin, keep it (`git checkout --ours -- <file>`).
+            - After resolving each file: `git add <file>`, then `git rebase --continue`.
+
+            **All other files:**
+            - Attempt a sensible merge of both sides if the intent is clear.
+            - If the conflict is complex or ambiguous, run `git rebase --abort` immediately and go to step 7b. Do not guess at application logic.
+
+            ### 6. Push the rebased branch
+            ```
+            git push --force-with-lease
+            ```
+
+            ### 7a. On success — post a summary comment on PR #${{ github.event.issue.number }}
+            Include:
+            - Which files had conflicts and how each was resolved.
+            - The new HEAD commit after rebase.
+
+            ### 7b. On failure (rebase aborted) — post a failure comment on PR #${{ github.event.issue.number }}
+            Include:
+            - Which file(s) could not be resolved automatically and why.
+            - Manual resolution steps:
+              ```
+              git fetch origin
+              git rebase origin/<baseRefName>
+              # resolve conflicts in <file(s)>
+              git add <resolved-file(s)>
+              git rebase --continue
+              git push --force-with-lease
+              ```
+          # yamllint enable rule:line-length