From e9a25e8d835743689a92a2d95806481c4c94fec2 Mon Sep 17 00:00:00 2001 From: Andrea Bueide Date: Fri, 28 Aug 2026 12:15:50 -0500 Subject: [PATCH 1/2] ci: push fix branches instead of attempting gh pr create GitHub Actions cannot create pull requests in this org - it's blocked at the enterprise level (confirmed via a real run against issue #1309: `gh pr create` failed with "GitHub Actions is not permitted to create or approve pull requests", and a repo-level API attempt to enable it was rejected with "The enterprise does not allow..."). This applied to both claude-doc-sync.yml and claude-issue-investigate.yml identically, and neither had ever actually reached that step in a real run before. Rather than routing around the restriction with a PAT, both workflows now just push the branch and stop. Each writes a result file ( doc-sync-result.md / investigation-report.md) with a ready-to-click compare link (.../compare/base...branch?expand=1) so a maintainer can open the PR themselves in one click. Drops pull-requests: write from both workflows' permissions - neither reads or writes PR data anymore. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/claude-doc-sync.yml | 15 +++++++-------- .github/workflows/claude-issue-investigate.yml | 11 ++++++----- 2 files changed, 13 insertions(+), 13 deletions(-) diff --git a/.github/workflows/claude-doc-sync.yml b/.github/workflows/claude-doc-sync.yml index bb6c88908..32f37a971 100644 --- a/.github/workflows/claude-doc-sync.yml +++ b/.github/workflows/claude-doc-sync.yml @@ -8,7 +8,6 @@ on: permissions: contents: write - pull-requests: write jobs: doc-sync: @@ -60,6 +59,7 @@ jobs: PR_NUMBER: ${{ github.event.pull_request.number }} PR_TITLE: ${{ github.event.pull_request.title }} BASE_REF: ${{ github.event.pull_request.base.ref }} + REPO: ${{ github.repository }} run: | cat > "$RUNNER_TEMP/claude-prompt.txt" < "$RUNNER_TEMP/claude-prompt.txt" < Date: Fri, 28 Aug 2026 12:24:15 -0500 Subject: [PATCH 2/2] ci: require a proof-of-fix regression test, forbid guessing Step 2 now asks for a real regression test in the appropriate existing test file (not just a throwaway script) that fails on current code for the same reason the issue describes. Step 4 requires re-running that same test after the fix and reporting both results (failing before, passing after) as evidence the fix addresses the diagnosed cause, rather than just asserting the fix is correct. Steps 3, 5, 6, and 8 now explicitly forbid presenting a guess as a finding: if the root cause, the fix, or the reproduction itself is uncertain, the report must say so plainly and state what information or access is needed, rather than filling the gap with speculation. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/claude-issue-investigate.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/claude-issue-investigate.yml b/.github/workflows/claude-issue-investigate.yml index 470568a1f..6d57708df 100644 --- a/.github/workflows/claude-issue-investigate.yml +++ b/.github/workflows/claude-issue-investigate.yml @@ -50,13 +50,13 @@ jobs: Investigate GitHub issue #$ISSUE_NUMBER in this repository. 1. Run \`gh issue view $ISSUE_NUMBER\` to read the full issue (title, body, comments). - 2. Based on the description, actually try to reproduce the reported problem using this repository's existing code and test tooling - write and run a small script or test case that exercises the described behavior, don't just reason about whether it would fail. - 3. If you reproduce it, identify the root cause in the source code. - 4. If you can reproduce it and you're confident the fix is small, narrow, and clearly correct, implement it, create a new branch off master named \`fix/issue-$ISSUE_NUMBER\`, commit, and push it. Do not run \`gh pr create\` or attempt to open a pull request - GitHub Actions is not permitted to create pull requests in this organization and it will fail. Instead, include the branch name and this link in the report so a maintainer can open the PR themselves: https://github.com/$REPO/compare/master...fix/issue-$ISSUE_NUMBER?expand=1 - 5. If the right fix is unclear, would need broader changes, or you're not confident it's correct, do not push anything - note that in the report instead. - 6. If you cannot reproduce the issue at all, explain exactly what you tried, why it didn't reproduce, and what additional information (exact repro steps, versions, environment) would help. + 2. Based on the description, actually try to reproduce the reported problem using this repository's existing code and test tooling - don't just reason about whether it would fail. If it's reproducible, write a real regression test in the appropriate existing test file, following this repo's existing test conventions, and confirm it fails on the current code for the same reason the issue describes. + 3. If you reproduce it, identify the root cause in the source code using actual evidence from your reproduction - do not guess. If you cannot pin down the root cause with real evidence, say so plainly in the report instead of presenting a guess as a diagnosis, and state what information or access would let you confirm it. + 4. If you found the root cause and you're confident the fix is small, narrow, and clearly correct, implement it. Include the regression test from step 2 in the same change, run it again to confirm it now passes, and report both results (failing before, passing after) as proof the fix addresses what you diagnosed. Then create a new branch off master named \`fix/issue-$ISSUE_NUMBER\`, commit, and push it. Do not run \`gh pr create\` or attempt to open a pull request - GitHub Actions is not permitted to create pull requests in this organization and it will fail. Instead, include the branch name and this link in the report so a maintainer can open the PR themselves: https://github.com/$REPO/compare/master...fix/issue-$ISSUE_NUMBER?expand=1 + 5. If the right fix is unclear, would need broader changes, or you're not confident it's correct, do not push anything and do not guess at a fix - state plainly in the report what's unclear and what you'd need (from the reporter, a maintainer, or elsewhere) to move forward. + 6. If you cannot reproduce the issue at all, explain exactly what you tried, why it didn't reproduce, and what additional information (exact repro steps, versions, environment) would help - do not assume it isn't real just because you couldn't trigger it. 7. Do not comment on the issue itself. - 8. Always write your findings to investigation-report.md in the repository root: a summary, the exact reproduction steps you tried, whether it reproduced, your root-cause diagnosis if found, and whether you pushed a fix branch (with its name and compare link) or why you decided not to. + 8. Always write your findings to investigation-report.md in the repository root: a summary, the exact reproduction steps you tried, whether it reproduced, your root-cause diagnosis (or an explicit statement that you couldn't confirm one and what's missing), the regression test's before/after results if you wrote a fix, and whether you pushed a fix branch (with its name and compare link) or why you decided not to. Never present a guess as a finding anywhere in the report - be explicit about what you verified versus what remains uncertain. EOF - name: Investigate with Claude