feat: split Claude workflow into interactive + issue automation jobs

[don-petry]

Summary

Aligns claude.yml with the org standard from combsmith/.github#54 + #55:

• Split single job into claude (interactive PR review) + claude-issue (issue automation)
• Issue-triggered work now creates PRs, self-reviews, checks CI, and tags code owners
• Added actions: read + checks: read for CI monitoring
• Added concurrency guard (claude-issue-<issue#>) to prevent duplicate runs on re-labeling
• Added missing allowedTools entries (gh pr comment, gh pr review, gh api) so the automation can post comments, submit reviews, and resolve review threads
• Added merge conflict resolution step to the automation prompt

Why?

Without this split, the single claude job conflated interactive PR review with issue automation. The org standard separates these concerns so that:

1. PR review runs only on PRs and @claude mentions (no accidental triggers)
2. Issue automation has its own job with constrained tools, progress tracking, and concurrency control
3. The allowedTools allowlist matches the prompt's instructions — without the added entries, the automation would silently fail to comment, review, or resolve threads
4. Merge conflicts are handled explicitly rather than leaving the PR in a broken state

Test plan

• Label an issue with claude and verify a PR is created automatically
• Verify @claude mentions on PRs still work
• Re-label the same issue and confirm only one automation run proceeds (concurrency cancels prior)

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Automated issue handling now runs separately: labeled issues are turned into draft pull requests with progress tracking, self-review, iterative CI fixes, conflict resolution, and final notifications.
  • Comment- and PR-triggered automation remains separate for faster interactive runs.

• Chores

  • CI workflow split into distinct paths and updated with expanded permissions and explicit automation steps to improve reliability and review automation.

[coderabbitai]

Warning

Rate limit exceeded

@don-petry has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 9 minutes and 58 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 9 minutes and 58 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a9966246-79d9-42d7-801f-7f0230b37bdb

📥 Commits

Reviewing files that changed from the base of the PR and between 220e0a4 and 64b7901.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

📝 Walkthrough

Walkthrough

Split Claude automation into two GitHub Actions jobs: claude now handles PR/comment triggers with expanded permissions and explicit action inputs; claude-issue is a new job handling issues labeled claude, with concurrency, progress tracking, constrained tool usage, and a scripted prompt for implementation→PR→CI→iterative fixes.

Changes

Cohort / File(s)

Summary

GitHub Actions Workflow .github/workflows/claude.yml

Split automation into two jobs: modified claude (removed issue-label trigger, added actions: read and checks: read permissions, explicit uses: anthropics/claude-code-action@... step with claude_code_oauth_token and additional_permissions) and added claude-issue (new job with if for issue label, concurrency keyed by issue number, cancel-in-progress: true, expanded permissions, label_trigger: "claude", track_progress: "true", constrained claude_args whitelist, and a scripted prompt directing implementation → open PR → self-review → CI-driven iterative fixes → CODEOWNERS notification).

Sequence Diagram(s)

mermaid
sequenceDiagram
participant User as User
participant GH as GitHub Events
participant Actions as GitHub Actions
participant Claude as anthropics/claude-code-action
participant Repo as Repository (Issues/PRs)
participant CI as CI/Checks

User->>GH: open PR / comment "@claude"
GH->>Actions: trigger claude job
Actions->>Claude: run with oauth token + permissions
Claude->>Repo: post review comments / create PRs (if applicable)
Claude->>CI: request checks / read status
CI->>Repo: update check status
Claude->>Repo: update review threads

mermaid
sequenceDiagram
participant Maintainer as Maintainer
participant GH as GitHub Events
participant Actions as GitHub Actions
participant ClaudeIssue as anthropics/claude-code-action (issue job)
participant Repo as Repository (Issue/PR)
participant CI as CI/Checks

Maintainer->>GH: label issue "claude"
GH->>Actions: trigger claude-issue job (concurrency by issue)
Actions->>ClaudeIssue: run with oauth token, track_progress, claude_args whitelist, scripted prompt
ClaudeIssue->>Repo: create implementation branch & PR, comment on issue/PR
ClaudeIssue->>CI: run checks, observe failures
CI->>ClaudeIssue: return failures
ClaudeIssue->>Repo: iterate fixes via commits/PR updates, add review comments, notify CODEOWNERS

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: splitting the Claude workflow into two separate jobs for interactive PR review and issue automation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/claude-auto-pr

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

Updates the repository’s Claude Code GitHub Actions workflow to match the org standard by separating interactive PR review behavior from issue-driven automation.

Changes:

• Split the workflow into two jobs: claude (interactive PR review / @claude mentions) and claude-issue (issue label automation).
• Added CI visibility permissions (actions: read, checks: read) and passed them through to the Claude action for monitoring runs.
• Introduced an issue-labeled automation prompt to implement fixes, open PRs, self-review, check CI, and notify code owners.

Comments suppressed due to low confidence (1)

.github/workflows/claude.yml:26

• The claude job still auto-runs on every pull_request event for in-repo branches. With the new claude-issue job creating PRs, those bot-created PRs will also trigger claude, potentially causing redundant reviews and (depending on action behavior) feedback loops. Consider excluding PRs authored by the automation account (e.g., github-actions[bot] / the OAuth user used to create the PR) or gating the pull_request path behind an explicit signal (label or @claude mention) to avoid double-execution.

    if: >-
      (github.event_name == 'pull_request' &&
        github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'issue_comment' && github.event.issue.pull_request &&
        contains(github.event.comment.body, '@claude') &&

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/claude.yml:
- Around line 55-60: The claude-issue job can run concurrently for the same
issue when the issues:labeled event is retriggered; add a concurrency block to
the claude-issue job (named "claude-issue") to serialize runs per issue by using
a group key that includes the issue identifier (e.g., github.event.issue.number)
and set cancel-in-progress to true so a new labeled event cancels the previous
in-flight run for that same issue.
- Around line 83-94: The allowedTools allowlist in the workflow's prompt is
missing entries needed to post comments, submit PR reviews, and resolve review
threads; update the allowedTools string (the value assigned to allowedTools in
the prompt) to include Bash(gh pr comment:*), Bash(gh pr review:*), and Bash(gh
api:*), so the automation can run gh pr comment, gh pr review and call the
GitHub API to resolve threads; ensure the entries are comma-separated with the
existing tools and preserve the surrounding quotes in the allowedTools value.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5aff506f-0abd-4190-87bf-8e71d15398bd

📥 Commits

Reviewing files that changed from the base of the PR and between a6ac870 and 56d85e9.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/claude.yml:
- Around line 87-97: Update the "prompt" block in the workflow (the prompt: |
multiline string) to add a step instructing the agent to handle merge conflicts:
detect if the PR has merge conflicts, rebase or merge from the base branch
(e.g., main) and resolve conflicts locally before running CI or continuing the
automation, then re-run tests and push the resolved branch; insert this new
guidance as a new step between the CI-check step and the final code-owner
notification (i.e., after step 4 and before step 5) so the agent knows to
resolve conflicts before assuming CI failures are code issues.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: eb779872-b777-49a8-9eb9-810b4ab883c0

📥 Commits

Reviewing files that changed from the base of the PR and between 56d85e9 and 1c0ee95.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/claude.yml:
- Around line 28-30: The pull_request_review_comment branch condition lacks the
same-repo guard and may run for forked PRs; update the conditional that checks
(github.event_name == 'pull_request_review_comment' &&
contains(github.event.comment.body, '@claude') && contains(...)) to also require
the same-repo check used in the pull_request branch
(github.event.pull_request.head.repo.full_name == github.repository) so that the
job only runs when the review comment originates from a PR in the same
repository.
- Around line 85-86: The workflow includes a step (step 5) that instructs Claude
to "rebase or merge the base branch to resolve" conflicts but the
claude-code-action configuration (claude_args allowedTools string) does not
permit git merge/rebase operations and the action version does not support them;
either remove step 5 from the workflow or explicitly add the minimal git/gh
commands to claude_args (e.g., include "Bash(git merge:*),Bash(git
rebase:*),Bash(gh pr merge:*),Bash(gh pr checkout:* )") and verify the
claude-code-action version supports push+merge/rebase before keeping the step,
updating the action version if necessary; update the claude_args entry and/or
delete the conflicting step accordingly so the workflow and allowedTools remain
consistent.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9915c6bf-cce8-454a-aee8-a7ca5fbe933f

📥 Commits

Reviewing files that changed from the base of the PR and between 1c0ee95 and 220e0a4.

📒 Files selected for processing (1)

• .github/workflows/claude.yml

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud