feat: check actions PR settings in repo maintenance

[keito4]

Summary

• Add a repo-maintenance check for GitHub Actions workflow permissions required for automated PR creation.
• Add --check-actions-pr-settings for targeted verification.
• Add Jest coverage with a stubbed gh CLI for allowed and blocked repository settings.

Verification

• npm run format:check
• npm run lint
• npm test
• npm run shellcheck
• bash script/repo-maintenance.sh --check-actions-pr-settings

Summary by CodeRabbit

• New Features

  • Added a new command option to validate GitHub Actions workflow permissions for automated pull request creation.

• Documentation

  • Updated command reference documenting the new validation option and required permission settings.

• Tests

  • Added test coverage for GitHub Actions permission validation functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 45face5c-a5e1-4a22-b441-07a9f7b00f08

📥 Commits

Reviewing files that changed from the base of the PR and between f89c56a and d2d11fb.

📒 Files selected for processing (3)

• .claude/commands/repo-maintenance.md
• script/repo-maintenance.sh
• test/repo-maintenance-actions-settings.test.js

---

📝 Walkthrough

Walkthrough

Adds a --check-actions-pr-settings flag to script/repo-maintenance.sh that validates GitHub Actions workflow permissions (default_workflow_permissions=write, can_approve_pull_request_reviews=true) via the GitHub API. Updates .claude/commands/repo-maintenance.md to document the new flag, and adds a Jest test file with a stub gh binary covering both success and failure paths.

Changes

GitHub Actions PR Settings Check

Layer / File(s)	Summary
New flag variable, arg parsing, and help text script/repo-maintenance.sh	Declares CHECK_ACTIONS_PR_SETTINGS_ONLY, extends the case statement to set the flag and switch MODE to check-only, and updates the usage/help text.
check_actions_pr_creation_settings function and execution paths script/repo-maintenance.sh	Implements the check function using gh and jq to fetch and validate workflow permission settings; adds an early-exit branch for check-only mode and a non-blocking call in the setup phase.
Documentation and Jest test suite .claude/commands/repo-maintenance.md, test/repo-maintenance-actions-settings.test.js	Updates argument-hint and adds permission requirement bullets in the Claude command docs; adds Jest tests with a stub gh binary covering documentation assertions, the success path, and the failure path.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

released, feature

Poem

🐇 Hop, hop, a new flag appears!
--check-actions-pr-settings calms my fears.
With jq and gh I peek at the rules,
write permissions are the coolest of tools.
Green means go, red means "fix this first!"
No broken PRs — that's the very worst! 🌟

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately reflects the main change: adding a GitHub Actions PR settings validation check to the repo maintenance script.
Description check	✅ Passed	The PR description covers the key changes and verification steps, though it deviates from the template structure with 'Verification' instead of required sections.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/repo-maintenance-actions-pr-settings

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

test/repo-maintenance-actions-settings.test.js

Oops! Something went wrong! :(

ESLint: 10.5.0

ReferenceError: describe is not defined
at Object. (/test/eslint-config.test.js:35:1)
at Module._compile (node:internal/modules/cjs/loader:1830:14)
at Object..js (node:internal/modules/cjs/loader:1961:10)
at Module.load (node:internal/modules/cjs/loader:1553:32)
at Module._load (node:internal/modules/cjs/loader:1355:12)
at wrapModuleLoad (node:internal/modules/cjs/loader:255:19)
at loadCJSModuleWithModuleLoad (node:internal/modules/esm/translators:326:3)
at ModuleWrap. (node:internal/modules/esm/translators:231:7)
at ModuleJob.run (node:internal/modules/esm/module_job:437:25)
at async node:internal/modules/esm/loader:639:26

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[claude]

Claude finished @keito4's task in 0s —— View job

---

I'll analyze this and get back to you.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d2d11fb8cd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Do not require write-all default workflow permissions

When a repo keeps the default GITHUB_TOKEN setting at read-only but grants contents: write/pull-requests: write on the specific PR-creating jobs, this check fails even though PR creation is configured correctly; GitHub documents that the workflow/job permissions key modifies the token for that job (https://docs.github.com/en/actions/tutorials/authenticate-with-github_token#modifying-the-permissions-for-the-github_token), and this repo already does that in .github/workflows/update-libraries.yml:23-25, .github/workflows/scheduled-maintenance.yml:31-33, and .github/workflows/claude.yml:51-53. Requiring the repo-wide default to be write makes --check-actions-pr-settings reject the safer read-only-default configuration and tells maintainers to broaden every workflow unnecessarily.

Useful? React with 👍 / 👎.

[github-actions]

🎉 This PR is included in version 1.119.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀