Picks up the allowed_tools fix from kcl-ci — claude.yml tag-mode
workflow now uses Bash(git:*),Bash(bun:*),Bash(curl:*) sub-patterns
instead of bare Bash, enabling auto-approval in CI.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bare `Bash` in allowed_tools makes the tool available but individual
commands still require interactive approval. In CI there's nobody to
approve, so git push, bun test, and curl all fail with
"Error: This command requires approval".
Changes:
- Switch to Bash(git:*), Bash(bun:*), Bash(curl:*) sub-patterns
- Add GITHUB_SERVER_URL env var so Claude doesn't need `export`
- Update prompt to reflect env var is pre-set
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add show_full_output: true to both claude.yml and upstream-sync.yml
- Add allowed_tools (Bash, Read, Write, etc.) to upstream-sync merge step
- Upgrade kcl-ci to v1.37.0 (defaults show_full_output and full tools)
Fixes: Claude was burning 38 turns hitting sandbox permission denials
trying to run bun test and git push during upstream sync.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove wait-for-checks from kcl-ci-build (not needed for this repo).
Add .forgejo/workflows/ to .prettierignore since KCL controls formatting.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- New merge-upstream job: creates branch, merges upstream, runs Claude
agent mode to review, resolve conflicts, run tests, and create a PR
- Dynamic fork impact analysis: computes overlap between fork-modified
files and upstream-changed files to assess conflict risk
- Claude reviews ALL upstream changes for fork compatibility (renamed
imports, changed APIs, GitHub-only assumptions) not just conflicts
- Maintainability principle: minimize fork divergence, prefer adapters
- Remove ANTHROPIC_API_KEY (using OAuth token only)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add .forgejo/kcl-ci/ with kcl.mod, main.k, Taskfile.yaml
- claude.yml: use claude.k module (fixes #comment YAML validation error,
removes duplicate pull_request_comment trigger)
- ci.yml: add paths-ignore for kcl-ci paths, named jobs for check constants
- test-action.yml: regenerated from KCL (functionally identical)
- upstream-sync.yml: regenerated from KCL (functionally identical)
- kcl-ci-build.yml: new auto-regeneration workflow (waits for CI checks)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add inline comments explaining:
- Forgejo never fires pull_request_review (sends pull_request_comment)
- Why workflow if-condition cannot gate on @claude for these events
(payload fields are empty, confirmed by run 12084 being skipped)
- The @claude check is handled in trigger.ts via payload inspection
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo's pull_request_comment payload does not populate
github.event.comment.body or github.event.review.body in a way
the workflow contains() expression can read, causing legitimate
@claude reviews to be skipped (run 12084).
Revert to unconditional pass at the workflow level. The @claude
check is handled properly in trigger.ts which inspects the actual
payload fields with fallback logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previously, all pull_request_comment events on Forgejo triggered the
full Claude pipeline unconditionally — both in the workflow if-condition
and in trigger.ts. This wasted CI resources and API credits on reviews
without @claude mentions (e.g. plain "LGTM" reviews).
Workflow: add @claude check via contains() on comment.body and review.body.
Trigger validation: replace blind auto-trigger with payload-aware check
that inspects available body fields, falling back only when no body exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo runner's expression parser rejects '#' characters inside
if: | blocks (run 52778: "unexpected character '#' while lexing
expression"). Move all comments above the if: key and switch from
block scalar (|) to folded scalar (>-) to avoid multiline issues.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add inline comments explaining:
- Forgejo never fires pull_request_review (sends pull_request_comment)
- Why workflow if-condition cannot gate on @claude for these events
(payload fields are empty, confirmed by run 12084 being skipped)
- The @claude check is handled in trigger.ts via payload inspection
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo's pull_request_comment payload does not populate
github.event.comment.body or github.event.review.body in a way
the workflow contains() expression can read, causing legitimate
@claude reviews to be skipped (run 12084).
Revert to unconditional pass at the workflow level. The @claude
check is handled properly in trigger.ts which inspects the actual
payload fields with fallback logic.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Previously, all pull_request_comment events on Forgejo triggered the
full Claude pipeline unconditionally — both in the workflow if-condition
and in trigger.ts. This wasted CI resources and API credits on reviews
without @claude mentions (e.g. plain "LGTM" reviews).
Workflow: add @claude check via contains() on comment.body and review.body.
Trigger validation: replace blind auto-trigger with payload-aware check
that inspects available body fields, falling back only when no body exists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo runner's expression parser rejects '#' characters inside
if: | blocks (run 52778: "unexpected character '#' while lexing
expression"). Move all comments above the if: key and switch from
block scalar (|) to folded scalar (>-) to avoid multiline issues.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo does not populate github.event.action in the workflow if:
context for issues events (run 12061 was skipped despite action
being 'labeled'). Same pattern as pull_request_comment (M3).
Remove the action/body/title gating from the workflow condition
and let trigger.ts handle all validation (label, assignee, mention).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The separate debug-event job ran on every event, wasting a runner.
Merged the event payload dump into the existing "Debug on failure"
step so it only runs when the claude job actually fails.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo's pull_request_review_comment event does not populate
github.event.comment.body in the workflow context (it's always
empty), so the contains() check never matches. The action code
does its own trigger phrase validation, so it's safe to let these
events through based on event name alone.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Update all runtime-relevant references to the Forgejo bot username
from 'claude-bot' to 'claude' following the bot account rename.
- .forgejo/workflows/claude.yml: bot_name input
- docs/forgejo.md: setup guide, examples, and inline references
- CLAUDE.md: bot identity description
Test fixtures and historical PRD files are left unchanged as they
use 'claude-bot' as arbitrary mock data or historical record.
Co-authored-by: vtmocanu <vtmocanu@users.noreply.github.com>
Forgejo uses the per-repo sequential run index (GITHUB_RUN_NUMBER) in
action URLs, not the internal DB run ID (GITHUB_RUN_ID). This caused
"View job" links to return 404. Fixed in all 4 URL construction sites:
create-initial comment, update-comment-link, and both prompt generators.
Also pins Bun to 1.2.21 in CI — Bun 1.3.9 broke spyOn(fs, ...) which
failed 18 upstream image-downloader tests.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add bot_email action input for custom git commit email on Forgejo
- Update claude.yml to use CLAUDE_BOT_TOKEN with bot_id/bot_name/bot_email
- Update git-config.ts to use provided email over noreply format
- Add "Dedicated Bot User" setup guide to docs/forgejo.md
- Update CLAUDE.md with bot identity documentation
Infrastructure (done outside code):
- claude-bot user created (ID 48, non-admin, with avatar)
- Claude team with write access in all 12 orgs
- CLAUDE_BOT_TOKEN org-level secret in all 12 orgs
Progress: ~85% complete - pending E2E validation after merge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Use CLAUDE_BOT_TOKEN (dedicated bot user) instead of FORGEJO_CLAUDE_TOKEN
(personal token). Comments and commits will now appear as claude-bot.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Enables @claude mentions on issues, PR review comments,
issue assignment, and label triggers on Forgejo.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Forgejo runner re-injects GITHUB_SERVER_URL after step-level env is
set, so the env: key approach doesn't override it. Using inline export
in the run command ensures the override takes effect before bun loads
modules (config.ts module-level constants read process.env at import).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Two issues found during M8 E2E testing on Forgejo:
1. CI test failures (31 tests): Unit tests assume GitHub context but
Forgejo runner sets GITHUB_SERVER_URL=git.wxs.ro, causing
detectPlatform() to return "forgejo" and module-level constants in
config.ts to use Forgejo URLs. Fixed by setting GITHUB_SERVER_URL
in the test step env. Forgejo-specific tests already override with
PLATFORM=forgejo in their beforeEach.
2. Permission check 403: Forgejo's getCollaboratorPermissionLevel
requires admin access. Added checkForgejoPermissions() that uses
GET /repos/{owner}/{repo} instead — returns a permissions object
with { admin, push, pull } booleans for the authenticated token.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
