|
32 | 32 | # Drafts aren't ready for review, and a fork PR gets no secrets (so |
33 | 33 | # CLAUDE_CODE_OAUTH_TOKEN would be empty) and a read-only token it could |
34 | 34 | # not post with. Skip rather than fail a contributor's PR with a red X. |
| 35 | + # |
| 36 | + # Also skip the dev -> main release PR. It is an aggregation of commits that |
| 37 | + # were each already reviewed on their own PR, so re-reviewing the whole |
| 38 | + # release adds nothing — and the diff is large enough that it reliably |
| 39 | + # exhausts the turn budget and fails, putting a red X on the release. |
35 | 40 | if: | |
36 | 41 | github.event.pull_request.draft == false && |
37 | | - github.event.pull_request.head.repo.full_name == github.repository |
| 42 | + github.event.pull_request.head.repo.full_name == github.repository && |
| 43 | + !(github.event.pull_request.head.ref == 'dev' && github.event.pull_request.base.ref == 'main') |
38 | 44 | runs-on: ubuntu-latest |
39 | 45 |
|
40 | 46 | steps: |
@@ -91,14 +97,16 @@ jobs: |
91 | 97 | `confirmed: true`) to flag specific lines. |
92 | 98 | Only post GitHub comments - do not return review text as a message. |
93 | 99 |
|
94 | | - # --allowedTools REPLACES the default tool set rather than adding to it. |
95 | | - # Without Read/Grep/Glob the reviewer cannot open a single file in the |
96 | | - # checked-out branch, which is exactly what the prompt above asks it to |
97 | | - # do. PR #399 burned all 20 turns on denied calls |
98 | | - # (permission_denials_count was 10) and failed without posting anything. |
| 100 | + # --allowedTools REPLACES the default tool set rather than adding to it, |
| 101 | + # so anything omitted here is denied at runtime. A denied call still |
| 102 | + # consumes a turn, so a too-narrow list burns the budget and the review |
| 103 | + # fails having posted nothing — that is how #399 (10 denials) and the |
| 104 | + # v1.19.0 release PR (20 denials) both died. |
| 105 | + # |
| 106 | + # Everything here is read-only except the two comment-posting tools. |
99 | 107 | claude_args: | |
100 | | - --max-turns 40 |
101 | | - --allowedTools "Read,Grep,Glob,mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(git diff:*),Bash(git log:*)" |
| 108 | + --max-turns 60 |
| 109 | + --allowedTools "Read,Grep,Glob,TodoWrite,mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*),Bash(gh api:*),Bash(git diff:*),Bash(git log:*),Bash(git show:*),Bash(git status:*),Bash(ls:*),Bash(cat:*),Bash(head:*),Bash(tail:*),Bash(wc:*),Bash(find:*),Bash(rg:*)" |
102 | 110 |
|
103 | 111 | # Fork PRs: GitHub withholds repository secrets from `pull_request` runs on |
104 | 112 | # forks and issues a read-only GITHUB_TOKEN, so this workflow cannot review |
|
0 commit comments