From aafb5ea151555ff363609ba352c661dedce8382d Mon Sep 17 00:00:00 2001 From: Andrea Bueide Date: Fri, 28 Aug 2026 10:57:21 -0500 Subject: [PATCH 1/2] ci: add label-gated issue investigation via Claude Adds .github/workflows/claude-issue-investigate.yml: when a maintainer adds the 'investigate' label to an issue, has Claude read it, attempt a real reproduction using the repo's own tooling, and write a diagnosis to investigation-report.md, uploaded as a job artifact. Gated on issues: labeled (checking for the 'investigate' label) rather than issues: opened, since this is a public repo and anyone can open an issue - a maintainer triages first, so no budget gets spent on spam/junk issues. Read-only permissions throughout (contents: read, issues: read) plus id-token: write for the existing Artifactory OIDC step yarn install depends on - Claude has no path to commit, push, open a PR, or write to the issue even if it tried, regardless of what's in the issue body. Issue title/body are never spliced into our own shell script; only the numeric issue number is, and Claude fetches the actual content itself via `gh issue view`. No turn/budget cap for now, by request - it runs until it reproduces the issue or concludes it needs more information. Also creates the 'investigate' label on the repo so it's actually assignable (didn't exist before this). Co-Authored-By: Claude Sonnet 5 --- .../workflows/claude-issue-investigate.yml | 67 +++++++++++++++++++ 1 file changed, 67 insertions(+) create mode 100644 .github/workflows/claude-issue-investigate.yml diff --git a/.github/workflows/claude-issue-investigate.yml b/.github/workflows/claude-issue-investigate.yml new file mode 100644 index 000000000..63da5944c --- /dev/null +++ b/.github/workflows/claude-issue-investigate.yml @@ -0,0 +1,67 @@ +name: Investigate issue + +# Gated on a maintainer-added label rather than issues: opened, since this is a public repo and anyone can open an issue - this way a human triages first before spending budget on a Claude session. +on: + issues: + types: [labeled] + +permissions: + contents: read + issues: read + id-token: write + +jobs: + investigate: + if: github.event.label.name == 'investigate' + runs-on: ubuntu-latest-large + env: + ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }} + steps: + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + + - name: Artifactory OIDC Auth + uses: ./.github/actions/artifactory-oidc + + - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 + with: + node-version: 22 + + - run: corepack enable + + - name: Install dependencies + run: yarn install --immutable + + - name: Install Claude Code CLI + run: npm install -g @anthropic-ai/claude-code + + # ISSUE_NUMBER only - title/body are untrusted, so Claude fetches them itself via gh rather than us splicing them into this script. + - name: Write prompt + env: + ISSUE_NUMBER: ${{ github.event.issue.number }} + run: | + cat > "$RUNNER_TEMP/claude-prompt.txt" < Date: Fri, 28 Aug 2026 11:05:33 -0500 Subject: [PATCH 2/2] ci: let issue investigation open a fix PR for simple, confident fixes Elevates permissions from read-only to contents: write and pull-requests: write, since Claude may now branch, commit, push, and open a PR when it both reproduces an issue and is confident the fix is small and clearly correct. Ambiguous or broad fixes still just get noted in the report, no PR. The investigate label remains the trust gate: a maintainer decides an issue is worth Claude's time (and now write access) before this runs at all, same reasoning as before, just now justifying the wider permission set. Any PR still needs human review to merge - branch protection on master isn't bypassed by this workflow. No cap on reproduction effort, per earlier direction - runs until it reproduces or concludes it needs more information. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/claude-issue-investigate.yml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/claude-issue-investigate.yml b/.github/workflows/claude-issue-investigate.yml index 63da5944c..0189701cf 100644 --- a/.github/workflows/claude-issue-investigate.yml +++ b/.github/workflows/claude-issue-investigate.yml @@ -6,7 +6,8 @@ on: types: [labeled] permissions: - contents: read + contents: write + pull-requests: write issues: read id-token: write @@ -34,6 +35,12 @@ jobs: - name: Install Claude Code CLI run: npm install -g @anthropic-ai/claude-code + # New commits need an author - Claude never has repo write access outside this job. + - name: Configure git identity for Claude's commits + run: | + git config --global user.email "claude-bot@users.noreply.github.com" + git config --global user.name "claude-bot" + # ISSUE_NUMBER only - title/body are untrusted, so Claude fetches them itself via gh rather than us splicing them into this script. - name: Write prompt env: @@ -45,9 +52,10 @@ jobs: 1. Run \`gh issue view $ISSUE_NUMBER\` to read the full issue (title, body, comments). 2. Based on the description, actually try to reproduce the reported problem using this repository's existing code and test tooling - write and run a small script or test case that exercises the described behavior, don't just reason about whether it would fail. 3. If you reproduce it, identify the root cause in the source code. - 4. If you cannot reproduce it, explain exactly what you tried, why it didn't reproduce, and what additional information (exact repro steps, versions, environment) would help. - 5. Do not commit, push, open a PR, or comment on the issue - your only output is the report file below. - 6. Write your findings to investigation-report.md in the repository root: a summary, the exact reproduction steps you tried, whether it reproduced, your root-cause diagnosis if found, and a suggested fix approach if you have one. + 4. If you can reproduce it and you're confident the fix is small, narrow, and clearly correct, implement it, create a new branch off master named \`fix/issue-$ISSUE_NUMBER\`, commit, push it, and open a pull request against master with \`gh pr create\` that includes "Fixes #$ISSUE_NUMBER" in the body. If the right fix is unclear, would need broader changes, or you're not confident it's correct, do not open a PR - note that in the report instead. + 5. If you cannot reproduce it, explain exactly what you tried, why it didn't reproduce, and what additional information (exact repro steps, versions, environment) would help. + 6. Do not comment on the issue itself. + 7. Always write your findings to investigation-report.md in the repository root: a summary, the exact reproduction steps you tried, whether it reproduced, your root-cause diagnosis if found, and whether you opened a fix PR (with its number) or why you decided not to. EOF - name: Investigate with Claude