From 47f5201cacf0c80132b64ce84400689c24785ab2 Mon Sep 17 00:00:00 2001 From: jnasbyupgrade Date: Wed, 5 Aug 2026 17:15:31 -0500 Subject: [PATCH] CI: fix silent cache-write warning and silently-dropped inline comments Two independent fixes to claude-code-review.yml, both confirmed against this repo's own actual runs: - actions: write added to permissions -- there is no narrower cache-write-only scope. Without it the job still succeeds but silently fails to cache every run ("Cache reservation failed: cache write denied: token has no writable scopes"), exactly the warning seen on PR #10's first successful review run. - claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment' added alongside prompt:. A bare prompt: (agent mode) decides which MCP servers to start from an --allowedTools flag, not from the invoked plugin's own frontmatter -- without this the inline-comment tool never exists in the session, so the code-review plugin was silently falling back to one consolidated comment instead of real per-line inline comments, with no error at all. --- .github/workflows/claude-code-review.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index 02426fb..f8aff0a 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -42,6 +42,11 @@ jobs: contents: read pull-requests: write # post the review comments checks: read # read sibling check-runs for the cost gate + actions: write # lets a step save its Actions cache -- there is no + # narrower cache-write-only scope; without this the + # job still succeeds but silently fails to cache, + # logging "Cache reservation failed: cache write + # denied: token has no writable scopes" every run steps: # COST GATE: the paid Claude review is the last thing to run. Wait for the # PR head's OTHER check-runs to finish and only proceed if they are clean. @@ -122,6 +127,16 @@ jobs: # works, so a slow run is visible instead of silent. (Pattern # modeled on Postgres-Extensions/cat_tools PR #69.) track_progress: true + # A bare `prompt:` (no `@claude` mention) runs the action in "agent + # mode", which decides which MCP servers to start by scanning an + # --allowedTools flag inside claude_args -- it does NOT consult the + # invoked plugin's own allowed-tools frontmatter. Without this, the + # github_inline_comment MCP server never starts, so the tool the + # code-review plugin needs for real per-line inline comments doesn't + # exist in this session at all -- not blocked, absent. The plugin + # silently falls back to one consolidated PR comment instead, with + # no error/warning. (Found in Postgres-Extensions/cat_tools PR #62.) + claude_args: '--allowedTools mcp__github_inline_comment__create_inline_comment' # NOTE: plugin_marketplaces can't be pinned — it tracks the # marketplace repo's default branch (upstream anthropics/claude-code). plugin_marketplaces: 'https://github.com/anthropics/claude-code.git'