ci: add standard Claude workflow callers - #1
Merged
Merged
Conversation
Onboards this repo to the fleet standard: blocking-review and assistant callers delegating to smartwatermelon/github-workflows. This repo was one of three with no .github/workflows directory at all (issue #126 item 3). Both callers track floating @V3 rather than an exact @v3.x.y pin. Exact pins are immutable and silently miss security fixes — that is how 19 repos never received the GHSA-8q5r-mmjf-575q remediation. Committed with SKIP=zizmor: zizmor flags unpinned-uses against the @V3 tag ref, but reusable workflows in this fleet use a repo-wide semver tag convention rather than per-action SHA pinning. That is deliberate documented policy, not an oversight. Claude-Session: https://claude.ai/code/session_01SimcNSM4P5hpb1dQVejqcF
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Onboards this repo to the fleet standard. Per smartwatermelon/github-workflows#126 item 3, this was one of three repos with no
.github/workflowsdirectory at all — no blocking review, no assistant.Files added
.github/workflows/claude-blocking-review.yml→claude-blocking-review.yml@v3.github/workflows/claude.yml→claude-assistant.yml@v3Both are thin delegates copied from the canonical fleet stubs, including the explanatory comments. No caller-side customization.
Token status
CLAUDE_CODE_OAUTH_TOKENis already present in this repo (set 2026-07-14), so no human setup step is needed here. This is the only one of the three repos in issue #126 item 3 that already had it.Once this lands and a first run is observed green,
claude-review / run-reviewcan be added as a required status check under branch protection.Ref policy
Floating
@v3, not an exact@v3.x.y. Exact tags are immutable, so a caller pinned to one silently misses security fixes — that is how 19 repos never received the GHSA-8q5r-mmjf-575q remediation. See "Prefer floating @V3 over an exact pin" in the github-workflows README.https://claude.ai/code/session_01SimcNSM4P5hpb1dQVejqcF