melodic-software
diff --git a/‎.github/workflows/claude-review.yml‎
Lines changed: 110 additions & 4 deletions b/‎.github/workflows/claude-review.yml‎
Lines changed: 110 additions & 4 deletions
@@ -265,7 +265,7 @@ jobs:
         # findings go to PR comments, not the exit code. continue-on-error keeps
         # an OIDC/usage-limit/SDK blip from showing as a red check.
         continue-on-error: true
-        uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1.0.166
+        uses: anthropics/claude-code-action@12531344451323133b0493233c759991ac61da12 # v1.0.174
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           track_progress: ${{ inputs.track-progress }}
@@ -288,16 +288,122 @@ jobs:
             https://github.com/${{ github.repository }}/blob/${{ github.event.pull_request.head.sha }}/<path>#L<line>
 
       - name: Report review outcome
+        id: review-outcome
         if: always()
         env:
           REVIEW_OUTCOME: ${{ steps.claude-review.outcome }}
+          EXECUTION_FILE: ${{ steps.claude-review.outputs.execution_file }}
         run: |
           if [ "$REVIEW_OUTCOME" = "success" ]; then
             echo "Claude review completed. Findings (if any) are in the PR comments."
+            echo "review_failed=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Prior to claude-code-action v1.0.172, the action reported `success`
+          # even when the underlying SDK result had is_error:true (upstream
+          # #1495, fixed in #1496) — this branch was effectively dead. Bumping
+          # past the fix makes REVIEW_OUTCOME finally reflect real failures, so
+          # this now needs to actually surface them instead of just logging.
+          #
+          # This is a public repo, so the raw SDKResultMessage is NOT safe to
+          # publish as-is: its `result` field is model-authored free text (per
+          # the Claude Agent SDK message schema) and CLAUDE.md keeps
+          # display_report/show_full_output off for exactly this leak risk.
+          # Project only the safe, structured metadata fields — never the last
+          # message wholesale.
+          detail="(no execution file was produced)"
+          if [ -n "${EXECUTION_FILE:-}" ] && [ -f "$EXECUTION_FILE" ]; then
+            detail=$(jq -c '
+              (.[-1] // empty) as $last
+              | if $last == null then empty
+                else $last | {subtype, is_error, num_turns, duration_ms, total_cost_usd}
+                end
+            ' "$EXECUTION_FILE" 2>/dev/null || true)
+            [ -n "$detail" ] || detail="(execution file present but unparsable)"
+          fi
+
+          echo "::error::Claude review exited with: $REVIEW_OUTCOME" \
+            "(infrastructure error, not a code-quality signal — e.g. usage limit," \
+            "OIDC failure, SDK crash, is_error result, or max-turns exhaustion)." \
+            "Last SDK result: $detail"
+
+          echo "review_failed=true" >> "$GITHUB_OUTPUT"
+          echo "review_detail=$detail" >> "$GITHUB_OUTPUT"
+
+      # Runs only on a genuine infra failure (never on a clean review) and only
+      # when the token can write: fork-triggered pull_request runs get a
+      # read-only GITHUB_TOKEN and no secrets by design (CLAUDE.md), so
+      # gh pr comment would just fail there — skip rather than error.
+      # Targets the marker comment by ID (never --edit-last, which edits the
+      # PR's last comment from ANY author) so a stuck placeholder comment from
+      # track_progress is never mistaken for "no findings" and an unrelated
+      # bot comment is never clobbered — this is the failure mode this whole
+      # change exists to fix.
+      - name: Comment on genuine review failure
+        if: >-
+          always() && steps.review-outcome.outputs.review_failed == 'true' &&
+          github.event.pull_request.number != '' &&
+          github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          REVIEW_DETAIL: ${{ steps.review-outcome.outputs.review_detail }}
+        run: |
+          marker="<!-- claude-review-infra-status -->"
+          body=$(printf '%s\n' \
+            "$marker" \
+            "> [!WARNING]" \
+            "> **Automated review did not complete** — this is an infrastructure failure, not a review verdict." \
+            ">" \
+            "> Treat any Claude comment on this PR (including a placeholder like \"I'll analyze this and get back to you\") as incomplete, not \"no findings.\"" \
+            ">" \
+            "> - Run: $RUN_URL" \
+            "> - Last SDK result: \`$REVIEW_DETAIL\`" \
+            ">" \
+            "> Re-running the job, or pushing a new commit, will retry the review.")
+
+          comment_id=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" --paginate |
+            jq -r --arg marker "$marker" '
+              [.[] | select(.user.login == "github-actions[bot]" and (.body | startswith($marker)))]
+              | last | .id // empty
+            ')
+
+          if [ -n "$comment_id" ]; then
+            gh api "repos/$REPO/issues/comments/$comment_id" -X PATCH -f "body=$body" --silent
           else
-            echo "::warning::Claude review exited with: $REVIEW_OUTCOME" \
-              "(infrastructure error, not a code-quality signal — e.g. usage limit," \
-              "OIDC failure, SDK crash, or max-turns exhaustion)."
+            gh pr comment "$PR_NUMBER" --body "$body"
+          fi
+
+      # Symmetric counterpart to the failure step above: a transient infra
+      # failure (e.g. an OIDC blip) can leave the marker comment behind on the
+      # PR, and the failure-only condition previously meant no later code path
+      # ever touched it again. Once a retry (rerun or new push) succeeds, clear
+      # that stale warning so it is not mistaken for a still-open problem.
+      # Same fork guard and marker lookup as the failure step — never
+      # --edit-last, for the same clobbering risk.
+      - name: Clear stale failure comment after successful review
+        if: >-
+          always() && steps.review-outcome.outputs.review_failed == 'false' &&
+          github.event.pull_request.number != '' &&
+          github.event.pull_request.head.repo.full_name == github.repository
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          marker="<!-- claude-review-infra-status -->"
+
+          comment_id=$(gh api "repos/$REPO/issues/$PR_NUMBER/comments" --paginate |
+            jq -r --arg marker "$marker" '
+              [.[] | select(.user.login == "github-actions[bot]" and (.body | startswith($marker)))]
+              | last | .id // empty
+            ')
+
+          if [ -n "$comment_id" ]; then
+            gh api "repos/$REPO/issues/comments/$comment_id" -X DELETE --silent
           fi
 
       # zizmor `artipacked` mitigation — scrub the GITHUB_TOKEN that checkout