don-petry · May 11, 2026 · May 11, 2026 · May 11, 2026 · May 11, 2026 · May 11, 2026
@@ -27,10 +27,6 @@ jobs:
     env:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
       LOOKBACK_DAYS: ${{ inputs.lookback_days || '1' }}
-      # Pin via vars.CLAUDE_CODE_VERSION for reproducible caching; default
-      # 'latest' caches an install indefinitely — flush via the Actions cache
-      # UI or bump the variable to pick up new releases. Mirrors pr-review.yml.
-      CLAUDE_CODE_VERSION: ${{ vars.CLAUDE_CODE_VERSION || 'latest' }}
 
     steps:
       - name: Checkout agent repo
@@ -41,23 +37,8 @@ jobs:
         with:
           node-version: '20'
 
-      - name: Cache claude-code CLI
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-        with:
-          path: ~/.npm-global
-          key: claude-code-${{ env.CLAUDE_CODE_VERSION }}-${{ runner.os }}
-
       - name: Install Claude Code CLI
-        run: |
-          mkdir -p "$HOME/.npm-global"
-          npm config set prefix "$HOME/.npm-global"
-          echo "$HOME/.npm-global/bin" >> "$GITHUB_PATH"
-          export PATH="$HOME/.npm-global/bin:$PATH"
-          if command -v claude >/dev/null 2>&1; then
-            echo "claude-code cache hit: $(claude --version)"
-          else
-            npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" # NOSONAR — install scripts required for native binary setup; version intentionally uses CLAUDE_CODE_VERSION var (same pattern as pr-review.yml)
-          fi
+        run: npm install -g @anthropic-ai/claude-code@2.1.187
 
       - name: Run health check
         env:

@@ -19,8 +19,7 @@
 #
 # PR Review Mention — thin caller for the org-level reusable.
 # To adopt: copy this file to .github/workflows/pr-review-mention.yml in your repo.
-# Requires: GH_PAT_WORKFLOWS     org secret — API calls and dispatching the review agent
-#           DON_PETRY_BOT_GH_PAT org secret — posting acknowledgement comments as the bot
+# Requires: GH_PAT_WORKFLOWS, DON_PETRY_BOT_GH_PAT org secrets.
 name: PR Review — Mention Trigger
 
 on:
@@ -38,6 +37,4 @@ jobs:
     permissions:
       pull-requests: write
     uses: petry-projects/.github/.github/workflows/pr-review-mention-reusable.yml@pr-review-mention/next
-    secrets:
-      GH_PAT_WORKFLOWS: ${{ secrets.GH_PAT_WORKFLOWS }}
-      DON_PETRY_BOT_GH_PAT: ${{ secrets.DON_PETRY_BOT_GH_PAT }}
+    secrets: inherit
@@ -1,64 +1,39 @@
 name: PR Review Agent
 
 on:
-  workflow_call:
+  schedule:
+    # Every 15 min to ensure at least one run fires per hour
+    # (GitHub Actions scheduled runs can be delayed/skipped under load)
+    - cron: "7 * * * *"
+    - cron: "22 * * * *"
+    - cron: "37 * * * *"
+    - cron: "52 * * * *"
+  workflow_dispatch:
     inputs:
-      agent_ref:
-        # The .github-private ref to check out for the agent's own scripts
-        # (engine.sh, review-one-pr.sh, …). A trigger-stub caller passes its
-        # pinned channel (e.g. pr-review/stable) so the SCRIPTS run at the
-        # pinned version, not the caller's branch — closing the reusable
-        # self-ref gap (#506). Empty (the default) preserves the historical
-        # behaviour exactly: actions/checkout treats an empty ref as "default".
-        description: "Ref of petry-projects/.github-private to check out for agent scripts"
-        type: string
-        required: false
-        default: ""
-      # Mirror the workflow_dispatch inputs as workflow_call inputs so a trigger
-      # stub can forward them. The job's env block already reads `inputs.*`;
-      # these resolve from whichever trigger fired (dispatch or call).
       pr_url:
         description: "Optional: review a single PR URL instead of enumerating"
-        type: string
         required: false
-        default: ""
+        type: string
       dry_run:
         description: "If true, never submit reviews or comments"
-        type: string
         required: false
-        default: ""
+        default: "false"
+        type: string
       force_review:
-        description: "If true, bypass idempotency and re-review at the same head SHA"
+        description: "If true, bypass idempotency check and re-review even if already reviewed at head SHA (use for @mention-triggered reviews)"
+        required: false
+        default: "false"
         type: string
+      agent_ref:
+        description: "Git ref (branch/tag/SHA) of petry-projects/.github-private to check out for scripts. Empty defaults to main."
         required: false
         default: ""
-    secrets:
-      CLAUDE_CODE_OAUTH_TOKEN:
-        required: false
-      GOOGLE_API_KEY:
-        required: false
-      COPILOT_GITHUB_TOKEN:
-        required: false
-      DON_PETRY_BOT_GH_PAT:
-        required: false
-      # Classic PAT for the bot. Required for `gh pr review --approve`
-      # (addPullRequestReview), which fails for fine-grained PATs. Preferred
-      # over DON_PETRY_BOT_GH_PAT when set; see docs/pr-review-agent/machine-user-setup.md.
-      DON_PETRY_BOT_GH_PAT_CLASSIC:
-        required: false
-      GH_PAT:
-        required: false
-
-# ── Reusable-only (#497 self-host pinning) ───────────────────────────────
-# Event-driven triggering now lives in the thin caller `pr-review-trigger.yml`,
-# which invokes this workflow pinned to `pr-review.yml@pr-review/stable` and
-# passes `agent_ref: pr-review/stable` so the agent's own scripts run at the
-# pinned version too. Keeping this file reusable-only is what lets
-# .github-private's OWN PR reviews run the known-good `stable` release — not
-# whatever is on the branch under review — which is what breaks the
-# self-hosting circular dependency. The job below still reads `github.event.*`
-# (inherited from the caller's triggering event) and `inputs.*` (forwarded by
-# the stub), so its behaviour is unchanged.
+        type: string
+  repository_dispatch:
+    # Triggered by the petry-projects/.github mention-listener workflow.
+    # Requires only Contents: write on this repo (not Actions: write).
+    # Payload: { pr_url: "https://github.com/...", force_review: "true" }
+    types: [pr-review-mention]
 
 permissions:
   contents: read
@@ -248,11 +223,12 @@ jobs:
           fi
           if [[ "$_fgpat" -eq 1 ]]; then
             unset _fgpat
-            echo "::error::Fine-grained PAT detected — fine-grained PATs are not supported by this workflow."
-            echo "::error::Fine-grained PATs fail at addPullRequestReview (GraphQL: Resource not accessible by personal access token)."
-            echo "::error::Replace DON_PETRY_BOT_GH_PAT with a classic PAT that has repo, workflow, and read:org scopes."
-            echo "::error::See docs/pr-review-agent/setup.md → Troubleshooting for details."
-            exit 1
+            echo "::warning::Fine-grained PAT detected — gh pr review --approve (addPullRequestReview) will fail."
+            echo "::warning::Set DON_PETRY_BOT_GH_PAT_CLASSIC (classic PAT with repo + read:org) to enable approvals."
+            echo "::warning::See docs/pr-review-agent/machine-user-setup.md for the dual-secret setup."
+            echo "::warning::Proceeding with reduced functionality (read/comment; no approval submissions)."
+            echo 'HAS_CLASSIC_PAT=false' >> "$GITHUB_ENV"
+            exit 0
           fi
           unset _fgpat
 
@@ -358,6 +334,73 @@ jobs:
               ;;
           esac
 
+      - name: Verify auth
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT_WORKFLOWS }}
+        run: |
+          set -euo pipefail
+
+          if auth_status="$(gh auth status 2>&1)"; then
+            :
+          else
+            auth_rc=$?
+            printf '%s\n' "$auth_status"
+            echo "::error::gh auth status failed"
+            exit "$auth_rc"
+          fi
+          printf '%s\n' "$auth_status"
+
+          # Fine-grained PATs are NOT supported — they fail at addPullRequestReview.
+          # Two detection methods: (1) prefix in auth status output; (2) gh auth token
+          # for gh versions that mask the prefix in status output (token never logged).
+          _fgpat=0
+          if grep -qi 'Token:.*github_pat_' <<< "$auth_status"; then
+            _fgpat=1
+          else
+            _tok="$(gh auth token 2>/dev/null || true)"
+            if [[ "${_tok:-}" == github_pat_* ]]; then
+              _fgpat=1
+            fi
+            unset _tok
+          fi
+          if [[ "$_fgpat" -eq 1 ]]; then
+            unset _fgpat
+            echo "::warning::Fine-grained GH_PAT_WORKFLOWS detected. Skipping workflow-token scope validation."
+            echo "::warning::PR approval capability is determined by the main review GH_TOKEN validation step."
+            exit 0
+          fi
+          unset _fgpat
+
+          scopes_line="$(grep 'Token scopes:' <<< "$auth_status" || true)"
+          normalized_scopes="${scopes_line//,/ }"
+          normalized_scopes="${normalized_scopes//$'\''/ }"
+
+          if [ -z "$normalized_scopes" ] || grep -qiE '(cannot determine|fine.grained)' <<< "$auth_status"; then
+            echo "::warning::Token scopes could not be determined. Skipping scope validation."
+            echo "::warning::Ensure the token has: repo + read:org (classic PAT) or contents + pull_requests:write."
+            exit 0
+          fi
+
+          if grep -qE "(^|[[:space:]])repo([[:space:]]|$)" <<< "$normalized_scopes"; then
+            if ! grep -qE "(^|[[:space:]])read:org([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN has 'repo' scope but is missing 'read:org'."
+              echo "::error::PRs with team-based reviewers will fail at 'gh pr view --json reviewRequests'."
+              echo "::error::Edit the classic PAT and check the 'read:org' box (no regeneration needed)."
+              exit 1
+            fi
+          else
+            if ! grep -qE "(^|[[:space:]])contents(:[^[:space:]]+)?([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN is missing required scope: contents"
+              echo "::error::Token must have either 'repo' + 'read:org' (classic) or 'contents' + 'pull_requests:write'"
+              exit 1
+            fi
+            if ! grep -qE "(^|[[:space:]])pull_requests(:write)?([[:space:]]|$)" <<< "$normalized_scopes"; then
+              echo "::error::GH_TOKEN is missing required scope: pull_requests with write access"
+              echo "::error::Token must have either 'repo' + 'read:org' (classic) or 'contents' + 'pull_requests:write'"
+              exit 1
+            fi
+          fi
+
       # ── LSP-MCP review pilot (epic #839, story #842) ─────────────────────
       # Opt-in ONLY: runs when the repo variable LSP_PILOT_ENABLED == 'true'.
       # When off (the default) this step is skipped entirely, REVIEW_MCP_CONFIG

@@ -15,3 +15,19 @@ eb7fd4c955378d274794e38ee9b942912ce79c6f:tests/dev-lead/unit/test_engine_fallbac
 # 40-char classic-PAT-length test placeholder verbatim; commit a547c50 rewrote
 # it to avoid the literal. Fingerprint suppresses the historical commit's finding.
 334fac2ca4528d821b7511e1a0f8e5051a2aca65:.gitleaksignore:github-pat:5
+# commit 8183136af11619917453bf58f6195fdc9f4350c8 (frameworks subtree add): test
+# fixtures and adversarial-review samples in bmad-method and gsd frameworks contain
+# placeholder API keys used by their own test suites. These are not real credentials.
+8183136af11619917453bf58f6195fdc9f4350c8:frameworks/bmad-method/test/adversarial-review-tests/sample-content.md:generic-api-key:24
+8183136af11619917453bf58f6195fdc9f4350c8:frameworks/gsd/sdk/src/query/config-query.test.ts:generic-api-key:228
+8183136af11619917453bf58f6195fdc9f4350c8:frameworks/gsd/sdk/src/query/config-mutation.test.ts:generic-api-key:501
+8183136af11619917453bf58f6195fdc9f4350c8:frameworks/gsd/tests/commands.test.cjs:generic-api-key:759
+8183136af11619917453bf58f6195fdc9f4350c8:frameworks/gsd/tests/security-scan.test.cjs:generic-api-key:300
+# commit 1d9a5e0088cc6f0aa7db71503dd70c1ec42027c9 (refactor: migrate to org-wide .github-private convention #41):
+# same test fixtures re-committed during the migration; same dummy placeholder API keys,
+# not real credentials.
+1d9a5e0088cc6f0aa7db71503dd70c1ec42027c9:frameworks/bmad-method/test/adversarial-review-tests/sample-content.md:generic-api-key:24
+1d9a5e0088cc6f0aa7db71503dd70c1ec42027c9:frameworks/gsd/sdk/src/query/config-query.test.ts:generic-api-key:228
+1d9a5e0088cc6f0aa7db71503dd70c1ec42027c9:frameworks/gsd/sdk/src/query/config-mutation.test.ts:generic-api-key:501
+1d9a5e0088cc6f0aa7db71503dd70c1ec42027c9:frameworks/gsd/tests/commands.test.cjs:generic-api-key:759
+1d9a5e0088cc6f0aa7db71503dd70c1ec42027c9:frameworks/gsd/tests/security-scan.test.cjs:generic-api-key:300
@@ -809,14 +809,37 @@ Scanned on every `fix-reviews` trigger before acting.
 
 ### 4.2 Unit tests: `test_fix_reviews_human.bats` (5 cases)
 
-- Human instruction executed via `run_writer()` ✓
-- User instruction included in prompt ✓
-- Dry-run: no commit ✓
-- Anti-loop: agent's own reply to comment doesn't re-trigger ✓
-- Empty instruction (just `@dev-lead` with no text) → asks for clarification ✓
+Test cases cover: `@dev-lead` mention parsing, intent dispatch, rename/edit/delete operations, dry-run guard, and comment-reply confirmation.
 
 ### 4.3 Unit tests: `test_fix_rebase.bats` (6 cases)
 
+```bash
+@test "rebase: YAML SHA conflict resolved by preferring newer SHA" {
+  # Set up a fake conflict in a .yml file
+  cat > /tmp/conflict.yml << 'EOF'
+      uses: actions/checkout@abc123 # v5.0.0
+EOF
+  run bash -c '
+    source scripts/dev-lead-fix-reviews.sh
+    resolve_yaml_sha_conflict /tmp/conflict.yml
+  '
+  [ "$status" -eq 0 ]
+  # Should have picked abc123 (newer semver v5.0.0 > v4.0.0)
+  grep -q "abc123" /tmp/conflict.yml
+}
+
+@test "rebase: non-YAML conflict → abort immediately" {
+  cat > /tmp/conflict.ts << 'EOF'
+  const foo = "bar";
+EOF
+  run bash -c '
+    source scripts/dev-lead-fix-reviews.sh
+    resolve_conflict /tmp/conflict.ts
+  '
+  [ "$status" -ne 0 ]
+}
+```
+
 - YAML SHA conflict: newer semver wins ✓
 - YAML SHA conflict: both sides same version → keeps base ✓
 - YAML SHA conflict: version cannot be determined → abort ✓

@@ -147,6 +147,7 @@ def validate_directory(eval_root: Path) -> None:
           f"no cross-split id overlap.")
 
 
+
 # ── Entry point ───────────────────────────────────────────────────────────────
 
 def main() -> None:
Original file line number	Diff line number	Diff line change
Expand Up		@@ -147,6 +147,7 @@ def validate_directory(eval_root: Path) -> None:
		f"no cross-split id overlap.")



		# ── Entry point ───────────────────────────────────────────────────────────────

		def main() -> None:
Expand Down