Repository navigation
Conversation
Proposed. Admits anthropics/claude-code-action at v1.0.268, pinned by SHA; runs start only from Hafeok's label or @claude comment on an issue, behind the action's own write-access check; commits are signed with the agent key as Claude (Emil), with Claude Code's attribution off; the OAuth token, not an API key; plan first, revisions, and approval of the newest plan; one repository, 180 minutes, one run per issue, no workflows permission. The job token starts no gates, so Emil opens the pull request and checks the gates ran on its head. Refs #170 Signed-off-by: Emil Okkels Klein <emil@okkels-klein.dk> Claude-Session: https://claude.ai/code/session_01NbWSYRYCm8wULG3wF2NvgE
Triggered by issues: labeled and issue_comment: created, with the job's if: requiring Hafeok as the label's sender or the comment's author, a comment on an issue, and the @claude prefix. Checkout and setup-dotnet at the SHAs gates.yml pins; the action at c0949c50 (v1.0.268) in tag mode, with the run's rules appended to its system prompt. Refs #170 Signed-off-by: Emil Okkels Klein <emil@okkels-klein.dk> Claude-Session: https://claude.ai/code/session_01NbWSYRYCm8wULG3wF2NvgE
eng/gates/claude-workflow.sh fails when claude.yml departs from ADR-0014 D1 to D7. selftest plants an action pinned to a tag, a SHA with no version, workflows: write, id-token: write, a job's own permissions, each missing actor check, a check present only in a comment, pull request comments admitted, a pull_request_target trigger, allowed_bots, a prompt input, attribution left on, and no timeout. Each fails with its finding; the clean file passes. Refs #170 Signed-off-by: Emil Okkels Klein <emil@okkels-klein.dk> Claude-Session: https://claude.ai/code/session_01NbWSYRYCm8wULG3wF2NvgE
How to start a run (the label, revisions, @claude approved, opening the pull request and checking its gates), what a run may do, untrusted issue text, and which issues must not get the label. Refs #170 Signed-off-by: Emil Okkels Klein <emil@okkels-klein.dk> Claude-Session: https://claude.ai/code/session_01NbWSYRYCm8wULG3wF2NvgE
The descriptor for ADR-0014 and claude.yml, with accepted-by left for Emil, and the host's version to match. If #169 lands first, this descriptor and the version are renumbered, as the ADR is. Refs #170 Signed-off-by: Emil Okkels Klein <emil@okkels-klein.dk> Claude-Session: https://claude.ai/code/session_01NbWSYRYCm8wULG3wF2NvgE
The brief and the approval, verbatim; what was read, at the action's pinned commit; what the session found in the action's source and in Claude Code's settings reference; the commits with GitHub's verification under the Claude (Emil) identity; every commit checked on its own; the build, tests and smoke at the head; the plants' findings; and the deviations from the plan, with their reasons. Refs #170 Signed-off-by: Emil Okkels Klein <emil@okkels-klein.dk> Claude-Session: https://claude.ai/code/session_01NbWSYRYCm8wULG3wF2NvgE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Refs #170. This implements the plan, as approved with its answers and additions.
This PR changes a workflow, so it was written in a normal key-holding session, not by the action.
What changes
anthropics/claude-code-action@c0949c50a78c1ec8ce2647db36629b870e715d0c # v1.0.268.Hafeok, either theclaudelabel or an issue comment starting@claude, and it also passes the action's own write-access check. Comments on pull requests don't start a run.AGENT_SSH_SIGNING_KEY.bot_id/bot_nameare2194785/Hafeok, and the author and committer are set toClaude (Emil).CLAUDE_CODE_OAUTH_TOKEN, with the job token for GitHub, so there is noid-tokenpermission.@claudecomment revises the plan,@claude approvedapproves the newest one, and the run treats only text fromHafeokas instructions.workflowspermission."attribution": { "commit": "", "pr": "" }turns it off, and no--modelis passed..github/workflows/claude.yml, as the ADR states it. Run instructions go through--append-system-prompt, because apromptinput would switch the action out of tag mode.claude-workflow, a new gate ingates.yml(eng/gates/claude-workflow.sh).selftestplants 14 cases, the brief's three among them, and each fails with its own finding.AGENTS.mdgains an "Issue sessions" section and a row in the gates table.releases/v0.8.0-preview.3.yaml, withaccepted-byleft for Emil, and<Version>raised to0.8.0-preview.3.docs/traceability/2026-11-06-issue-170-issue-sessions.md.Checks
commits,adr-shape,adr-text,no-toolchain,claude-workflow(from the commit that adds it) andselftestall pass.6c7965c: the build has 0 errors, and 43 tests pass. The linux-x64 AOT publish and smoke pass:product 0.8.0-preview.3 (commit 6c7965c…).Hafeok, underClaude (Emil) <claude+emil@okkels-klein.dk>.For Emil
gates.ymlran on the head before approving.claude-workflowtomain's required checks if you want it required.Generated by Claude Code