sandbox: Don't create shared propagation peer group #1488

Workflow file for this run

.github/workflows/claude-review.yml at 4e73bdf

	# Integrates Claude Code as an AI assistant for reviewing pull requests.
	# Mention @claude in any PR comment to request a review. Claude authenticates
	# via AWS Bedrock using OIDC — no long-lived API keys required.
	#
	# Architecture: The workflow is split into three jobs for least-privilege:
	# 1. "setup" — fetches PR context, posts/updates tracking comment (write permissions)
	# 2. "review" — runs Claude with read-only permissions, produces structured JSON
	# 3. "post" — reads the JSON and posts comments to the PR (write permissions)

	name: Claude Review

	on:
	pull_request_target:
	types: [opened, synchronize, reopened, labeled]
	# Strangely enough you have to use issue_comment to react to regular comments on PRs.
	# See https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_comment-use-issue_comment.
	issue_comment:
	types: [created]
	pull_request_review_comment:
	types: [created]
	pull_request_review:
	types: [submitted]

	concurrency:
	group: claude-review-${{ github.event.pull_request.number \|\| github.event.issue.number }}

	jobs:
	setup:
	runs-on: ubuntu-latest
	env:
	PR_NUMBER: ${{ github.event.pull_request.number \|\| github.event.issue.number }}

	if: \|
	github.repository_owner == 'systemd' &&
	((github.event_name == 'pull_request_target' &&
	(github.event.action == 'labeled' && github.event.label.name == 'claude-review' && github.event.sender.login != 'github-actions[bot]' \|\|
	github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'claude-review') \|\|
	github.event.action == 'opened' &&
	github.event.pull_request.base.ref == 'main' &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.pull_request.author_association) &&
	github.event.pull_request.user.login != 'YHNdnzj')) \|\|
	(github.event_name == 'issue_comment' &&
	github.event.issue.pull_request &&
	contains(github.event.comment.body, '@claude review') &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association)) \|\|
	(github.event_name == 'pull_request_review_comment' &&
	contains(github.event.comment.body, '@claude review') &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.comment.author_association)) \|\|
	(github.event_name == 'pull_request_review' &&
	contains(github.event.review.body, '@claude review') &&
	contains(fromJSON('["MEMBER","OWNER","COLLABORATOR"]'), github.event.review.author_association)))

	permissions:
	contents: read
	pull-requests: write

	outputs:
	pr_number: ${{ steps.context.outputs.pr_number }}
	comment_id: ${{ steps.context.outputs.comment_id }}

	steps:
	- name: Auto-add claude-review label for trusted contributors
	if: github.event_name == 'pull_request_target' && github.event.action == 'opened'
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	run: gh pr edit --repo "${{ github.repository }}" "$PR_NUMBER" --add-label claude-review

	- name: Fetch PR context and create tracking comment
	id: context
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
	with:
	script: \|
	const owner = context.repo.owner;
	const repo = context.repo.repo;
	const prNumber = parseInt(process.env.PR_NUMBER, 10);
	const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
	const MARKER = "<!-- claude-pr-review -->";

	/* Fetch all PR data in parallel. */
	const [pr, reviews, issueComments, reviewComments] = await Promise.all([
	github.rest.pulls.get({ owner, repo, pull_number: prNumber }),
	github.paginate(github.rest.pulls.listReviews, { owner, repo, pull_number: prNumber, per_page: 100 }),
	github.paginate(github.rest.issues.listComments, { owner, repo, issue_number: prNumber, per_page: 100 }),
	github.paginate(github.rest.pulls.listReviewComments, { owner, repo, pull_number: prNumber, per_page: 100 }),
	]);

	/* Find or create tracking comment. */
	const existing = issueComments.find((c) => c.body && c.body.includes(MARKER));
	let commentId;
	let trackingCommentBody = null;

	if (existing) {
	console.log(`Updating existing tracking comment ${existing.id}.`);
	/* Prepend a re-reviewing banner but keep the previous review visible. */
	const prevBody = existing.body.replace(/\n\n\[Workflow run\]$[^)]*$$/, "");
	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: existing.id,
	body: `> Claude is re-reviewing this PR… ([workflow run](${runUrl}))\n\n${prevBody}`,
	});
	commentId = existing.id;
	trackingCommentBody = prevBody;
	} else {
	console.log("Creating new tracking comment.");
	const {data: created} = await github.rest.issues.createComment({
	owner,
	repo,
	issue_number: prNumber,
	body: `Claude is reviewing this PR… ([workflow run](${runUrl}))\n\n${MARKER}`,
	});
	commentId = created.id;
	}

	/* Build context JSON for Claude. */
	const prContext = {
	pr: pr.data,
	reviews,
	issue_comments: issueComments,
	tracking_comment: trackingCommentBody,
	review_comments: reviewComments,
	};

	core.setOutput("pr_number", prNumber);
	core.setOutput("comment_id", commentId);

	const fs = require("fs");
	fs.writeFileSync("pr-context.json", JSON.stringify(prContext));

	# archive: false makes upload-artifact use the file's basename
	# (pr-context.json) as the artifact name, ignoring the name input.
	- name: Upload PR context
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
	with:
	path: pr-context.json
	archive: false
	retention-days: 7

	review:
	runs-on: ubuntu-latest
	needs: setup
	timeout-minutes: 60

	permissions:
	contents: read
	id-token: write # Authenticate with AWS via OIDC

	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
	with:
	# Need full history for git worktree add to work on all PR commits.
	fetch-depth: 0
	persist-credentials: false

	- name: Download PR context
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: pr-context.json

	- name: Prettify PR context
	run: \|
	jq . pr-context.json > pr-context-pretty.json
	mv pr-context-pretty.json pr-context.json

	- name: Prepare PR worktrees
	env:
	PR_NUMBER: ${{ needs.setup.outputs.pr_number }}
	run: \|
	git fetch origin "pull/${PR_NUMBER}/head"
	# Chronological commit order, oldest first. The worktree dirs are
	# SHA-named, so listing them doesn't preserve order — reviewers read
	# this manifest to review commits in the order they were authored.
	git log --reverse --format=%H HEAD..FETCH_HEAD > commit-order.txt
	while read -r sha; do
	git worktree add "worktrees/$sha" "$sha"
	git -C "worktrees/$sha" diff HEAD~..HEAD > "worktrees/$sha/commit.patch"
	git -C "worktrees/$sha" log -1 --format='%B' HEAD > "worktrees/$sha/commit-message.txt"
	done < commit-order.txt

	- name: Install sandbox dependencies
	run: \|
	sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
	sudo apt-get update && sudo apt-get install -y bubblewrap socat

	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@acca2b1b2070338fb9fd1ca27ecee81d687e58e5
	with:
	role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/${{ secrets.AWS_ROLE_NAME }}
	role-session-name: GitHubActions-Claude-${{ github.run_id }}
	aws-region: us-east-1

	- name: Install Claude Code
	run: curl -fsSL https://claude.ai/install.sh \| bash

	- name: Run Claude Code
	env:
	CLAUDE_CODE_DISABLE_BACKGROUND_TASKS: "1"
	CLAUDE_CODE_USE_BEDROCK: "1"
	# Pin the `opus` alias (used by the review subagents) to 4.8 so they
	# don't silently resolve to an older model the Bedrock alias points at.
	ANTHROPIC_DEFAULT_OPUS_MODEL: us.anthropic.claude-opus-4-8
	run: \|
	mkdir -p ~/.claude

	cat > ~/.claude/settings.json << 'SETTINGS'
	{
	"permissions": {
	"allow": [
	"Bash",
	"Read",
	"Edit(/${{ github.workspace }}/**)",
	"Write(/${{ github.workspace }}/**)",
	"Grep",
	"Glob",
	"Agent",
	"Task",
	"TaskOutput",
	"ToolSearch"
	]
	},
	"sandbox": {
	"enabled": true,
	"autoAllowBashIfSandboxed": true,
	"allowUnsandboxedCommands": false,
	"filesystem": {
	"allowWrite": ["/tmp", "/var/tmp", "${{ github.workspace }}"]
	}
	}
	}
	SETTINGS

	cat > review-schema.json << 'SCHEMA'
	{
	"type": "object",
	"required": ["summary", "comments"],
	"properties": {
	"summary": { "type": "string" },
	"comments": {
	"type": "array",
	"items": {
	"type": "object",
	"required": ["path", "line", "severity", "body", "commit"],
	"properties": {
	"path": { "type": "string" },
	"line": { "type": "integer" },
	"side": { "enum": ["LEFT", "RIGHT"] },
	"start_line": { "type": "integer" },
	"start_side": { "enum": ["LEFT", "RIGHT"] },
	"severity": { "enum": ["must-fix", "suggestion", "nit"] },
	"body": { "type": "string" },
	"commit": { "type": "string" }
	}
	}
	},
	"resolve": { "type": "array", "items": { "type": "integer" } }
	}
	}
	SCHEMA

	cat > /tmp/review-prompt.txt << 'PROMPT'
	You are a code reviewer for the ${{ github.repository }} project.
	Review this pull request. All required context has been
	pre-fetched into local files.

	## Phase 1: Review the PR through multiple lenses

	First, read `review-schema.json` and `commit-order.txt` in the repository
	root. `commit-order.txt` lists the commit SHAs in chronological order,
	oldest first — this is the order in which commits must be reviewed. Each
	worktree at `worktrees/<sha>/` contains the full source tree checked out at
	that commit, plus `commit.patch` (the diff) and `commit-message.txt` (the
	commit message).

	mkosi is a Python tool for building operating system images. You will
	review the PR through a set of lenses. Every review uses these four base
	lenses:
	1. Correctness & error handling — logic errors, edge cases, wrong
	conditionals, off-by-one, incorrect None/Optional handling, exceptions
	that are swallowed or caught too broadly, mishandled error paths, and
	wrong handling of subprocess exit codes, stdout/stderr, or return values.
	2. Resource lifetimes & cleanup — file descriptors, open files,
	subprocesses, mounts and bind mounts, loop devices, and temporary
	files/directories. Check that resources are released on every path
	(including error paths), that `with`/context managers and `ExitStack`
	are used correctly, and that nothing is leaked between operations.
	3. Security & robustness — handling of untrusted input (config, downloaded
	packages, image contents), path and symlink handling (path traversal,
	TOCTOU, sandbox/chroot escapes), command injection when building
	subprocess argument lists or using a shell, privilege boundaries
	(running as root, user namespaces, capabilities, sandbox setup), and
	resource exhaustion.
	4. API design, style & maintainability — consistency with existing mkosi
	idioms and `docs/CODING_STYLE.md`, naming, type hints, error propagation
	via exceptions, coercing Path-like objects with `os.fspath`, dead code,
	and needless complexity.

	### Add PR-specific lenses

	Before spawning, briefly inspect what this PR actually changes so you can
	add domain-specific lenses. Read each worktree's `commit-message.txt` and
	skim the changed file paths and hunk headers in each `commit.patch`, in
	chronological order — just enough to understand which subsystems and
	problem domains are touched. Do
	NOT perform the review yourself or read the full source; that is the
	subagents' job.

	Based on that, add 1 to 3 EXTRA lenses targeting the specific concerns of
	this PR. Each extra lens needs a short name and a one-sentence description
	of what it must check. For example:
	- a PR changing sandboxing, namespaces, or mount logic (e.g.
	`mkosi/sandbox.py`, `mkosi/mounts.py`) → a "sandbox isolation & mount
	safety" lens (namespace and uid/gid mapping setup, bind-mount ordering,
	chroot correctness, unmount/cleanup, privilege drops).
	- a PR changing a distribution or package manager backend (e.g.
	`mkosi/distribution/`) → a "package manager integration" lens (correct
	invocation, repository and GPG key handling, cache locking,
	reproducibility).
	- a PR changing config parsing (e.g. `mkosi/config.py`) → a "config
	compatibility" lens (setting semantics, defaults, backward
	compatibility, and keeping `mkosi/resources/man/` docs in sync).
	- a PR touching boot, initrd, or systemd-repart integration → a
	"boot & image layout" lens.
	Only add extra lenses genuinely warranted by the diff — for a small or
	generic change the four base lenses may be enough, in which case add none.

	### Spawn the reviewers

	Then spawn exactly one review subagent per lens (the base lenses plus any
	extra lenses you derived), all in a single message so they run
	concurrently. Each subagent reviews EVERY commit (every worktree
	directory), but only through the perspective of its assigned lens.

	Each subagent must be spawned with `model: "opus"`.

	Each subagent prompt must include:
	- The name and full description of its assigned lens, with an instruction
	to report ONLY findings that fall under that lens and to ignore issues
	belonging to the other lenses — those are covered by other reviewers.
	- Instructions to read `pr-context.json` in the repository root for additional
	context.
	- The contents of `review-schema.json` (paste it into each prompt so the
	agent doesn't have to read it separately).
	- The list of every worktree path in chronological order (oldest commit
	first, matching `commit-order.txt`), with an instruction to review the
	commits in that order and read each one's `commit-message.txt` and
	`commit.patch`.
	- Instructions that each finding's `commit` field must be the SHA of the
	worktree the finding belongs to, and that every `line` and `start_line`
	value must be verified against the hunk ranges in that commit's
	`commit.patch` before returning.
	- Instructions to return ONLY a raw JSON array of findings. No markdown,
	no explanation, no code fences — just the JSON array. If there are no
	findings, return `[]`.
	- Instructions that `severity` is a separate structured field — do NOT
	repeat it inside `body` (no "must-fix:", "suggestion:", etc.
	prefix). The posting step adds the severity label itself, so
	including it in `body` produces duplicates.

	## Phase 2: Collect, deduplicate, and summarize

	After all reviews are done, read `pr-context.json` from the repository root.
	It contains PR metadata from the GitHub API. Rules for its `review_comments`
	field:
	- Only look at your own comments (user.login == "github-actions[bot]" and
	body starts with "Claude: "). Ignore all other comments.
	- Items checked off in the `tracking_comment` (`- [x]`) are resolved.
	- You will need the `id` fields of your own unresolved comments to
	populate the `resolve` array.
	- If `tracking_comment` is non-null, use it as the basis for your summary.

	Trust the subagent findings — do NOT re-verify them by running your own
	bash, grep, sed, or awk commands against the source code. Phase 2 should
	only read `pr-context.json` and then produce the structured output.

	Then:
	1. Collect all issues. Merge duplicates across agents (same file, same
	problem, lines within 3 of each other). Because the lenses overlap,
	the same issue is often reported by more than one lens — collapse
	these into a single comment, keeping the clearest wording.
	2. Drop any issue whose suggestion is to add a code comment, docstring,
	or documentation (e.g. "add a comment explaining…", "missing
	docstring", "document this function", "would benefit from a
	comment"). mkosi style is to write no comments unless the WHY is
	non-obvious, so these are noise — drop them from `comments` and from
	the `summary`.
	3. Drop issues that already have a review comment on the same file about
	the same problem, or where the PR author replied disagreeing.
	4. Populate the `resolve` array with the `id` of your own review comment
	threads (user.login == "github-actions[bot]", body starts with
	"Claude: ") that should be resolved — either because the issue was
	fixed or because the author dismissed it. Use the first comment `id`
	in each thread. Do not resolve threads from human reviewers.
	5. Write a `summary` field in markdown for a top-level tracking comment.

	If no existing tracking comment was found (first run):
	Use this format:

	```
	## Claude review of PR #<number> (<HEAD SHA>)

	<!-- claude-pr-review -->

	### Must fix
	- [ ] short title — `path:line` — brief explanation

	### Suggestions
	- [ ] short title — `path:line` — brief explanation

	### Nits
	- [ ] short title — `path:line` — brief explanation
	```

	Omit empty sections. Each checkbox item must correspond to an entry in `comments`.
	If there are no issues at all, write a short message saying the PR looks good.

	If an existing tracking comment was found (subsequent run):
	Use the existing comment as the starting point. Preserve the order and wording
	of all existing items. Then apply these updates:
	- Update the HEAD SHA in the header line.
	- For each existing item, re-check whether the issue is still present in the
	current diff. If it has been fixed, mark it checked: `- [x]`.
	- If the PR author replied dismissing an item, mark it:
	`- [x] ~~short title~~ (dismissed)`.
	- Preserve checkbox state that was already set by previous runs or by hand.
	- Append any new issues found in this run that aren't already listed,
	in the appropriate severity section, after the existing items.
	- Do not reorder, reword, or remove existing items.

	## Error tracking

	If any errors prevented you from doing your job fully (tools that were
	not available, git commands that failed, etc.), append a `### Errors`
	section to the summary listing each failed action and the error message.

	## Output formatting

	Do NOT escape characters in `body` or `summary`. Write plain markdown — no
	backslash escaping of `!` or other characters. In particular, HTML comments
	like `<!-- ... -->` must be written verbatim, never as `<\!-- ... -->`.

	## Review result

	Produce your review result with a single `StructuredOutput` call that
	contains all of these fields together:
	- `summary`: The markdown summary for the tracking comment.
	- `comments`: Array of review comments (same schema as the reviewer output above).
	- `resolve`: REST API IDs of review comment threads to resolve.

	`comments` and `resolve` are required — include them in the same call even
	when they are empty (`[]`). Never emit a call with `summary` alone; a call
	missing `comments` is rejected and wastes a full retry. Build `comments`
	first, then write `summary` from it, then emit everything in one call.

	Keep `summary` concise: each checkbox is a short title, `path:line`, and a
	one-line explanation — the detailed reasoning belongs in the matching
	`comments` entry, not the summary. Do not restate full findings prose in
	the summary.
	PROMPT

	claude \
	--model us.anthropic.claude-opus-4-8 \
	--effort xhigh \
	--max-turns 200 \
	--setting-sources user \
	--output-format stream-json \
	--json-schema "$(cat review-schema.json)" \
	--verbose \
	-p "$(cat /tmp/review-prompt.txt)" \
	\| tee claude.json

	jq '.structured_output \| select(. != null)' claude.json > review-result.json

	- name: Upload review result
	if: always()
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
	with:
	path: review-result.json
	if-no-files-found: ignore
	archive: false
	retention-days: 7

	post:
	runs-on: ubuntu-latest
	needs: [setup, review]
	if: always() && needs.setup.result == 'success'

	permissions:
	pull-requests: write

	steps:
	- name: Download review result
	if: needs.review.result == 'success'
	continue-on-error: true
	uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
	with:
	name: review-result.json

	- name: Post review comments
	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
	env:
	REVIEW_RESULT: ${{ needs.review.result }}
	PR_NUMBER: ${{ needs.setup.outputs.pr_number }}
	COMMENT_ID: ${{ needs.setup.outputs.comment_id }}
	with:
	script: \|
	const fs = require("fs");
	const owner = context.repo.owner;
	const repo = context.repo.repo;
	const prNumber = parseInt(process.env.PR_NUMBER, 10);
	const commentId = parseInt(process.env.COMMENT_ID, 10);
	const runUrl = `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
	const MARKER = "<!-- claude-pr-review -->";

	/* If the review job failed or was cancelled, update the tracking
	* comment to reflect that and bail out. */
	if (process.env.REVIEW_RESULT !== "success") {
	const verb = process.env.REVIEW_RESULT === "cancelled" ? "was cancelled" : "failed";
	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: commentId,
	body: `Claude review ${verb} — see [workflow run](${runUrl}) for details.\n\n${MARKER}`,
	});
	core.setFailed("Review job did not succeed.");
	return;
	}

	/* Parse Claude's review result from the downloaded artifact. */
	let raw = "";
	try {
	raw = fs.readFileSync("review-result.json", "utf8");
	} catch (e) {
	console.log(`Failed to read review-result.json: ${e.message}`);
	}
	console.log("Review result from Claude:");
	console.log(raw \|\| "(empty)");

	let comments = [];
	let resolveIds = [];
	let summary = "";
	if (raw) {
	try {
	const review = JSON.parse(raw);
	if (Array.isArray(review.comments))
	comments = review.comments;
	if (Array.isArray(review.resolve))
	resolveIds = review.resolve;
	if (typeof review.summary === "string")
	summary = review.summary;
	} catch (e) {
	core.warning(`Failed to parse structured output: ${e.message}`);
	}
	}

	console.log(`Claude produced ${comments.length} review comment(s).`);

	/* Post each inline comment individually. Deduplication against existing
	* comments is handled by Claude in the prompt, so we just post whatever
	* it returns. Using individual comments (rather than a review) means
	* re-runs only add new comments instead of creating a whole new review. */
	const inlineComments = comments.filter((c) => c.path && c.line);
	const skipped = comments.length - inlineComments.length;
	if (skipped > 0)
	console.log(`Skipping ${skipped} comment(s) missing path or line number.`);

	let posted = 0;
	for (const c of inlineComments) {
	console.log(` Posting comment on ${c.path}:${c.line}`);
	try {
	await github.rest.pulls.createReviewComment({
	owner,
	repo,
	pull_number: prNumber,
	commit_id: c.commit,
	path: c.path,
	line: c.line,
	...(c.side != null && { side: c.side }),
	...(c.start_line != null && { start_line: c.start_line }),
	...(c.start_side != null && { start_side: c.start_side }),
	body: `Claude: ${c.severity}: ${c.body}`,
	});
	posted++;
	} catch (e) {
	/* GitHub rejects comments on lines outside the diff context. Log
	* and continue — the tracking comment still contains all findings. */
	console.log(` Warning: failed to post comment on ${c.path}:${c.line}: ${e.message}`);
	}
	}

	if (posted > 0)
	console.log(`Posted ${posted}/${inlineComments.length} inline comment(s).`);
	else if (inlineComments.length > 0)
	console.log(`Could not post any of ${inlineComments.length} inline comment(s) — see warnings above.`);
	else
	console.log("No inline comments to post.");

	/* Resolve review threads that Claude identified as addressed or dismissed. */
	if (resolveIds.length > 0) {
	const resolveSet = new Set(resolveIds);

	/* Fetch all review threads and map first-comment database IDs to thread IDs. */
	let threads = [];
	try {
	let threadCursor = null;
	do {
	const threadQuery = `
	query($owner: String!, $repo: String!, $number: Int!, $cursor: String) {
	repository(owner: $owner, name: $repo) {
	pullRequest(number: $number) {
	reviewThreads(first: 100, after: $cursor) {
	pageInfo { hasNextPage endCursor }
	nodes {
	id
	isResolved
	comments(first: 1) {
	nodes {
	databaseId
	}
	}
	}
	}
	}
	}
	}
	`;

	const threadResult = await github.graphql(threadQuery, { owner, repo, number: prNumber, cursor: threadCursor });
	const page = threadResult.repository.pullRequest.reviewThreads;
	threads.push(...page.nodes);
	threadCursor = page.pageInfo.hasNextPage ? page.pageInfo.endCursor : null;
	} while (threadCursor);
	} catch (e) {
	console.log(`Warning: failed to fetch review threads, skipping resolution: ${e.message}`);
	threads = [];
	}

	let resolved = 0;
	let alreadyResolved = 0;
	const matchedIds = new Set();
	for (const thread of threads) {
	const firstCommentId = thread.comments.nodes[0]?.databaseId;
	if (!firstCommentId \|\| !resolveSet.has(firstCommentId)) continue;

	matchedIds.add(firstCommentId);

	if (thread.isResolved) {
	alreadyResolved++;
	continue;
	}

	try {
	await github.graphql(`
	mutation($threadId: ID!) {
	resolveReviewThread(input: { threadId: $threadId }) {
	thread { id }
	}
	}
	`, { threadId: thread.id });
	resolved++;
	console.log(` Resolved thread for comment ${firstCommentId}`);
	} catch (e) {
	console.log(` Warning: failed to resolve thread for comment ${firstCommentId}: ${e.message}`);
	}
	}

	const requested = resolveSet.size;
	const unmatched = [...resolveSet].filter(id => !matchedIds.has(id));
	if (resolved > 0)
	console.log(`Resolved ${resolved}/${requested} review thread(s)${alreadyResolved > 0 ? ` (${alreadyResolved} already resolved)` : ""}.`);
	else if (alreadyResolved === requested)
	console.log(`All ${requested} review thread(s) were already resolved.`);
	else if (alreadyResolved > 0)
	console.log(`${alreadyResolved}/${requested} review thread(s) were already resolved; could not resolve the rest — see warnings above.`);
	else if (threads.length > 0)
	console.log(`Could not resolve any of ${requested} review thread(s) — see warnings above.`);
	if (unmatched.length > 0)
	console.log(` ${unmatched.length} comment ID(s) not found in any thread: ${unmatched.join(", ")}`);
	} else {
	console.log("No review threads to resolve.");
	}

	/* Update the tracking comment with Claude's summary. */
	if (!summary)
	summary = "Claude review: no issues found :tada:\n\n" + MARKER;
	else if (!summary.includes(MARKER))
	summary += "\n\n" + MARKER;
	summary += `\n\n[Workflow run](${runUrl})`;

	await github.rest.issues.updateComment({
	owner,
	repo,
	comment_id: commentId,
	body: summary,
	});

	console.log("Tracking comment updated successfully.");

	if (inlineComments.length > 0 && posted === 0)
	core.setFailed(`Could not post any of ${inlineComments.length} inline comment(s) — see warnings above.`);
	else if (posted < inlineComments.length)
	core.warning(`${inlineComments.length - posted}/${inlineComments.length} inline comment(s) could not be posted.`);

Navigation Menu

Uh oh!

sandbox: Don't create shared propagation peer group #1488

Workflow file

sandbox: Don't create shared propagation peer group #1488

Uh oh!

Workflow file for this run