Skip to content

fix(groom): run the three agent phases via the Claude CLI directly (BE-4214) #65

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mattmillerai merged 5 commits into from
Jul 24, 2026
+623 −59
Merged

fix(groom): run the three agent phases via the Claude CLI directly (BE-4214) #65

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
70098ae
fix(groom): run the three agent phases via the Claude CLI directly (B…
mattmillerai Jul 23, 2026
d938c34
fix(groom): harden the direct-CLI agent steps from the review panel (…
mattmillerai Jul 23, 2026
ada848b
fix(groom): close the agent-write escalation paths from round 2 (BE-4…
mattmillerai Jul 23, 2026
9b63c5e
fix(groom): close the round-3 review findings on the direct-CLI agent…
mattmillerai Jul 24, 2026
eab3fa1
fix(groom): scope the agent write tools to close the runner-filesyste…
mattmillerai Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions .github/workflows/ci-groom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,13 +56,18 @@ jobs:
# regardless of `if:` guards or the bot App token doing the real writes). A
# short grant fails the whole run with an opaque "workflow file issue" / 0
# jobs. groom.yml's jobs need: file -> issues: write; build_select ->
# issues: read + pull-requests: read; the finder/verifier agent jobs ->
# id-token: write (claude-code-action mints its GitHub token via OIDC).
# Grant the union or the call is rejected.
# issues: read + pull-requests: read. The finder/verifier/builder agent jobs
# need NOTHING beyond contents: read — they invoke the Claude CLI directly
# and mint no GitHub token, so `id-token: write` is no longer required
# (BE-4214). Grant the union below or the call is rejected.
# ORDERING: the pinned SHA below predates the agent jobs entirely, so
# dropping the grant is safe against it. When bumping that pin, move it to
# a SHA at or after the BE-4214 CLI migration — the intermediate main SHAs
# (#55 / #64) still declare `id-token: write` on the agent jobs and would
# be rejected by this shorter grant.
contents: read
issues: write
pull-requests: read
id-token: write
uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@07154fb5d0d979017d79b822873cfbe86483bfb3 # main (groom.yml lands here — #49 / BE-3872)
Comment thread
mattmillerai marked this conversation as resolved.
Comment thread
mattmillerai marked this conversation as resolved.
with:
# File groom's issues as cloud-code-bot (App token), not github-actions[bot].
Expand Down
Loading
Loading