ci: stream Claude output in GHA workflow logs

[bryan-cox]

What this PR does / why we need it:

Adds --output-format stream-json to the Claude Code invocation in the reusable GHA workflow. Without this flag, Claude produces no stdout output until it finishes — if the job times out or gets stuck, the logs are empty and there's no way to diagnose what happened.

With stream-json, each tool call and message is written to stdout in real time, so the GHA logs show exactly what Claude was doing.

Which issue(s) this PR fixes:

N/A

Special notes for your reviewer:

Single-line change in reusable-claude-on-pr.yaml.

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• Chores
  • Updated internal workflow configuration to improve automated processing efficiency.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

📝 Walkthrough

Walkthrough

The reusable GitHub Actions workflow for running Claude on pull requests is updated so the claude CLI invocation now includes an explicit --output-format stream-json argument. Previously, the command omitted any --output-format option; this change adds it alongside the existing --prompt, --model, --max-turns, and --allowedTools parameters.

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	The PR adds --output-format stream-json which streams Claude's output verbatim to logs. The "Run Claude" step exposes GH_TOKEN and CLAUDE_PROMPT as environment variables accessed by the claude co...	Add explicit secret masking via ::add-mask for GH_TOKEN and CLAUDE_PROMPT before passing to claude, or gate stream-json output behind a debug flag that defaults to off.

✅ Passed checks (10 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'ci: stream Claude output in GHA workflow logs' directly and accurately summarizes the main change: adding streaming output format to Claude invocations in GitHub Actions workflows.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Custom check for Ginkgo test name stability is not applicable; PR modifies only GitHub Actions workflow YAML, containing no test files or Ginkgo test names.
Test Structure And Quality	✅ Passed	Custom check targets Ginkgo test code quality, but PR only modifies GitHub Actions workflow file with no test code changes. Check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	This PR modifies a GitHub Actions workflow (.github/workflows/reusable-claude-on-pr.yaml), not Kubernetes deployment manifests, operator code, or controllers. The topology-aware scheduling check do...
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Custom check not applicable: PR modifies GitHub Actions workflow (.github/workflows/reusable-claude-on-pr.yaml), not Ginkgo e2e tests. Check is only for new test additions.
No-Weak-Crypto	✅ Passed	The PR only modifies a GitHub Actions workflow file with a single-line command flag addition. No weak cryptography, custom crypto implementations, or token comparisons are present in the change.
Container-Privileges	✅ Passed	PR modifies only a GitHub Actions workflow file (.github/workflows/reusable-claude-on-pr.yaml), not a container or K8s manifest. No container privilege settings (privileged, hostPID, hostNetwork, e...

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/reusable-claude-on-pr.yaml:
- Line 127: The claude command on line 127 uses --output-format stream-json
which streams raw tool outputs and model content to Actions logs without
automatic secret redaction, potentially exposing GH_TOKEN and CLAUDE_PROMPT
environment variables. Gate the --output-format stream-json feature behind a
conditional debug input flag (only enable when explicitly requested) and add
deterministic masking logic to redact known secrets before log emission. Ensure
sensitive outputs like tokens and prompt content are masked even in stream-json
output mode.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 9fa5ad00-117b-4dbc-a4e8-7c45991fa37b

📥 Commits

Reviewing files that changed from the base of the PR and between 0096c63 and def122e.

📒 Files selected for processing (1)

• .github/workflows/reusable-claude-on-pr.yaml

[openshift-ci]

@bryan-cox: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[bryan-cox]

/area ai
/area ci-tooling

[bryan-cox]

/verified later @bryan-cox

[openshift-ci-robot]

@bryan-cox: This PR has been marked to be verified later by @bryan-cox.

Details

In response to this:

/verified later @bryan-cox

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[enxebre]

/lgtm

[openshift-merge-bot]

Pipeline controller notification

No second-stage tests were triggered for this PR.

This can happen when:

• The changed files don't match any pipeline_run_if_changed patterns
• All files match pipeline_skip_if_only_changed patterns
• No pipeline-controlled jobs are defined for the main branch

Use /test ? to see all available tests.