feat(claude-code-reusable): enable rebases in interactive job#235
feat(claude-code-reusable): enable rebases in interactive job#235don-petry wants to merge 30 commits into
Conversation
Allow the interactive claude job to handle PRs that need a rebase or pull before pushing. PR #166 hit this when auto-rebase pushed merge commits to the remote during the run and Claude could not fast-forward. - fetch-depth: 1 -> 0 so rebase/merge against main works. - Add explicit --allowedTools covering git fetch/pull/rebase/merge plus the standard git, gh CLI, and Edit/Write/Read surface. Setting claude_args.--allowedTools replaces the action defaults, so the list is written out comprehensively. https://claude.ai/code/session_01Udspx48vYhjiEG3fnraMKV
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe reusable Claude Code workflow now checks out full git history (fetch-depth: 0) and expands the Claude action's ChangesWorkflow Tool Configuration
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Enables the interactive claude job in the central reusable workflow to better handle cases where the remote PR branch advances mid-run (e.g., due to auto-rebase activity), by ensuring the workspace has sufficient git history and by explicitly allowing git/gh operations.
Changes:
- Switch
actions/checkoutfromfetch-depth: 1tofetch-depth: 0for the interactiveclaudejob. - Add an explicit
claude_args --allowedToolsallowlist to permit selectedgitandghoperations (plusEdit/Write/Read) during interactive runs.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Full history so Claude can rebase / pull / resolve conflicts against main. | ||
| fetch-depth: 0 | ||
| token: ${{ secrets.GH_PAT_WORKFLOWS || github.token }} |
| checks: read | ||
| # yamllint disable rule:line-length | ||
| claude_args: | | ||
| --allowedTools "Bash(git fetch:*),Bash(git pull:*),Bash(git rebase:*),Bash(git merge:*),Bash(git status:*),Bash(git diff:*),Bash(git log:*),Bash(git add:*),Bash(git commit:*),Bash(git push:*),Bash(gh pr view:*),Bash(gh pr comment:*),Bash(gh pr checkout:*),Bash(gh api:*),Bash(gh run view:*),Bash(gh run list:*),Bash(gh run watch:*),Edit,Write,Read" |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 1272435b13fdb4acb2de927d76806ee7e2280ff9
Review mode: triage-approved (single reviewer)
Summary
Prompt-only changes to the org status report template that reduce output size by ~29K bytes. Three changes: (1) Open Issues grouped by repo subsection instead of flat table, dropping the repeated Repo column; (2) duplicate [#N](url) | [title](url) cells merged into single [#N — title](url) cells across Needs Human Review, Open Issues, and Open Discussions tables; (3) MAX_BYTES bumped from 60000 to 64000 (still 1536 bytes below GitHub's 65536 char limit). No data-shape changes.
Linked issue analysis
No closing issue linked, but the PR body clearly describes the problem: daily report #233 exceeded the 60000-byte truncation threshold, causing head -c to drop the start of the report (the @org-leads opener and first three sections). The changes directly address this by shrinking the rendered output.
Findings
No issues found.
- MAX_BYTES 64000: Safe — leaves 1536 bytes of headroom below GitHub's 65536-char issue body limit. Combined with the ~29K reduction in report size, truncation should rarely trigger.
- Prompt template changes: Clean restructuring. The per-repo subsection format for Open Issues and the single-link cell pattern are consistent across all three tables.
- No security concerns: No secrets, auth, eval, injection vectors, or CI security changes.
- Copilot's suppressed comment about UTF-8 truncation in
head -cis a pre-existing concern in the truncation step, not introduced by this PR.
CI status
All checks passed:
- Lint: ✓
- ShellCheck: ✓
- Agent Security Scan: ✓
- AgentShield: ✓
- CodeQL (actions): ✓
- SonarCloud: ✓ (0 new issues, 0 security hotspots)
- Dependency audit: ✓
Reviewed automatically by the PR-review agent (single-reviewer). Reply if you need a human review.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Address Copilot review on #235: 1. --allowedTools was a narrow allowlist that would hard-fail on any missing git/gh verb (since the flag replaces action defaults). Broaden to Bash(git:*),Bash(gh:*) plus common shell utilities and the full core tool set (Edit, Write, Read, Grep, Glob, LS, MultiEdit, WebFetch, WebSearch, Task, TodoWrite, BashOutput, KillBash). 2. standards/ci-standards.md was documenting fetch-depth: 1 for the interactive claude job and had no allowedTools snippet. Sync the example with the actual reusable workflow and add a comment explaining why the allowlist is intentionally broad. https://claude.ai/code/session_01Udspx48vYhjiEG3fnraMKV
don-petry
dismissed stale reviews from coderabbitai[bot] and donpetry-bot
via
9eea0d9
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude-code-reusable.yml:
- Line 47: Update the documentation examples in standards/ci-standards.md that
currently reference anthropics/claude-code-action@v1.0.89 (and its old SHA) to
match the workflow: replace those references with
anthropics/claude-code-action@476e359e6203e73dad705c8b322e333fabbd7416 #
v1.0.119 so the examples match the actual workflow usage; search for any
occurrences of "anthropics/claude-code-action@v1.0.89" or the old SHA in
standards/ci-standards.md and update them to the new SHA and version string.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: c01ff119-899a-4513-a52b-4ef3f258c2a9
📒 Files selected for processing (2)
.github/workflows/claude-code-reusable.ymlstandards/ci-standards.md
CodeRabbit flagged that standards/ci-standards.md still showed anthropics/claude-code-action@6e2bd528... # v1.0.89 in the claude and claude-issue job examples, while the actual reusable workflow uses @476e359e6203e73dad705c8b322e333fabbd7416 # v1.0.119 (bumped by Dependabot #226). Sync the docs. https://claude.ai/code/session_01Udspx48vYhjiEG3fnraMKV
|
@donpetry-bot - please review again |
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: MEDIUM
Reviewed commit: 9af3e4ec697e8bf7acb8b4770e207793187972fb
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6)
Summary
PR enables Claude to handle mid-run rebase scenarios by switching to full git history checkout and adding a broad --allowedTools allowlist. All CI checks pass (Lint, ShellCheck, AgentShield, Agent Security Scan, CodeQL, SonarCloud); the CodeRabbit CHANGES_REQUESTED was for outdated action SHA in docs, which the final commit (9af3e4e) fully addresses. Merge is blocked only by stale review state — CodeRabbit was rate-limited and could not re-review.
Findings
- INFO: MergeStateStatus BLOCKED due to CodeRabbit CHANGES_REQUESTED on commit 9eea0d9. The requested change (sync claude-code-action SHA to v1.0.119 in standards/ci-standards.md) is fully addressed in head commit 9af3e4e. CodeRabbit is rate-limited and cannot re-review. Safe to dismiss the stale review and merge.
- MINOR: Bash(gh:*) wildcard allows Claude to invoke any gh CLI subcommand (merge PRs, create releases, delete branches, etc.) during interactive runs. Actual capability is bounded by the token scope (GH_PAT_WORKFLOWS or github.token), and both AgentShield and Agent Security Scan passed — but this warrants awareness. The PR body explicitly calls this out and documents the rationale for a comprehensive allowlist. (
.github/workflows/claude-code-reusable.yml:53) - INFO: fetch-depth: 0 fetches full git history on every interactive Claude run, which increases checkout time on repos with deep history. Acceptable trade-off for enabling rebases; no security concern. (
.github/workflows/claude-code-reusable.yml:42) - INFO: standards/ci-standards.md now correctly documents fetch-depth: 0, the broad --allowedTools list, and the bumped claude-code-action@v1.0.119 SHA across both the claude and claude-issue job examples. Docs match the actual workflow. (
standards/ci-standards.md)
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply if you need a human review.
|
@coderabbitai review Generated by Claude Code |
|
✅ Actions performedReview triggered.
|
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@standards/ci-standards.md`:
- Around line 386-387: The Version policy table is inconsistent with the new
pin: update the "Version Inconsistencies" table entry that currently lists
anthropics/claude-code-action as v1.0.89 to reflect the pinned value v1.0.119 to
match the uses line (uses:
anthropics/claude-code-action@476e359e6203e73dad705c8b322e333fabbd7416) and
ensure the table header "Version Inconsistencies" and any references to
anthropics/claude-code-action are synchronized.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 609f2e60-5f41-4b83-87d5-c05e9ee830b8
📒 Files selected for processing (1)
standards/ci-standards.md
CodeRabbit flagged the "Version Inconsistencies" table (line 1045) still listed Claude Code Action as v1.0.89 (6e2bd528), inconsistent with the v1.0.119 (476e359e) pin documented in the example workflows just bumped in 9af3e4e. https://claude.ai/code/session_01Udspx48vYhjiEG3fnraMKV
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
standards/ci-standards.md (1)
430-430: 🧹 Nitpick | 🔵 Trivial | 💤 Low valueNote:
claude-issuejob retains narrowerallowedToolslist.The
claudejob (interactive mode) received a broad--allowedToolslist includingBash(git:*)for rebase capabilities (line 396), but theclaude-issuejob (automation mode) retains its original narrower list focused ongh pr,gh issue, andgh runcommands.This appears intentional based on the PR objectives ("enable rebases in interactive job"), since automation-mode PRs are created from fresh branches rather than needing to rebase existing PRs. However, if the automation job can also encounter scenarios where it needs to fetch/pull/rebase (e.g., when updating an existing PR it created), it may need similar git tool permissions.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@standards/ci-standards.md` at line 430, The claude-issue job's --allowedTools list is narrower than the interactive claude job and may lack git permissions needed when automation updates existing PRs; update the claude-issue job's --allowedTools string (the value passed to --allowedTools in the claude-issue job) to include the same Bash(git:*) permission (or otherwise add the necessary Bash(git:fetch|pull|rebase) entries) so its allowedTools matches the interactive claude job's rebase-capable set, ensuring the claude-issue job can perform fetch/pull/rebase operations when required.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@standards/ci-standards.md`:
- Line 386: The pinned action reference "uses:
anthropics/claude-code-action@476e359e6203e73dad705c8b322e333fabbd7416" is
mismatched with the v1.0.119 tag; update the line so the comment and pinned SHA
agree by either replacing the SHA with the canonical v1.0.119 commit SHA
(2703d6e89559c31037b8083eff3cc5ba56502f1e) or changing the version comment to
reflect the actual tag for 476e359e6203e73dad705c8b322e333fabbd7416, ensuring
the uses reference and the trailing version comment are consistent.
---
Outside diff comments:
In `@standards/ci-standards.md`:
- Line 430: The claude-issue job's --allowedTools list is narrower than the
interactive claude job and may lack git permissions needed when automation
updates existing PRs; update the claude-issue job's --allowedTools string (the
value passed to --allowedTools in the claude-issue job) to include the same
Bash(git:*) permission (or otherwise add the necessary
Bash(git:fetch|pull|rebase) entries) so its allowedTools matches the interactive
claude job's rebase-capable set, ensuring the claude-issue job can perform
fetch/pull/rebase operations when required.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: f38927f8-77be-4a63-8dee-21d564510c40
📒 Files selected for processing (1)
standards/ci-standards.md
|
Auto-rebase blocked — the base branch contains Please rebase this branch manually: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
@dev-lead - please fix this PR |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
|
Auto-rebase failed — merge conflict — this branch has conflicts with dev-lead will attempt to resolve this automatically. If it cannot, a follow-up comment will explain what needs manual attention. To resolve manually instead: |
Summary
Allow the interactive
claudejob inclaude-code-reusable.ymlto recover when the remote branch advances mid-run (e.g. auto-rebase pushes merge commits).fetch-depth: 1→0so rebase/merge againstmainis possible.--allowedToolscoveringgit fetch/pull/rebase/mergeplus the standardgit,ghCLI, andEdit/Write/Readsurface.Motivation
PR #166's
@clauderun failed at push time because auto-rebase had advanced the remote branch during the run. With--allowedToolsunset, the action defaults didn't includegit pull/git fetch, so Claude couldn't integrate the new remote commits before pushing.Caveat
Setting
claude_args.--allowedToolsreplaces the action defaults rather than extending them. The list here is written out comprehensively. If something is missing and users start hitting "tool not allowed" prompts, extend the list — don't remove the flag.Test plan
@claudeon a PR that has remote commits the local branch doesn't (e.g. fix(standards): pin auto-rebase stub to SHA to satisfy SonarCloud security gate #166 after merge).git fetch+git pull --rebase(orgit rebase origin/main) and push successfully.@claudeflows (review-comment responses, simple edits).https://claude.ai/code/session_01Udspx48vYhjiEG3fnraMKV
Generated by Claude Code
Summary by CodeRabbit