Skip to content

ci(review): add the shadow caller for the launcher-based review lanes - #9292

Closed
kyle-sexton wants to merge 1 commit into
mainfrom
ci/pr-review-shadow-hosted
Closed

kyle-sexton wants to merge 1 commit into
mainfrom
ci/pr-review-shadow-hosted

Conversation

@kyle-sexton

@kyle-sexton kyle-sexton commented Oct 23, 2026 •

Copy link
Copy Markdown
Member

Refs: melodic-software/claude-code-account-rotation#259

Summary

Adds pr-review-shadow-hosted.yml, a shadow run of ci-workflows' launcher-based pr-review-cli.yml (v0.63.0) in summary mode, one job per lane (pr-review-shadow, pr-review-security-shadow), beside the live review lanes. It posts nothing: each lane leaves a job summary and a scanned JSON artifact to compare with the live review of the same head.

Fix

  • Funding: the reviews role's API key (REVIEWS_CLAUDE_API_KEY) only; no subscription token is passed.
  • Who runs: ready, same-repository pull requests, with the reusable's bot gate repeated in the caller so the reusable is only called where its status job reports. A pull request that changes the shadow workflow always runs it; otherwise only when REVIEWS_SHADOW_ENABLED is true and the number is a multiple of 4. The org and repository lane kill switches stop both.
  • Model parity: the gate resolves the live review-code and review-security model routes from the default branch; a failure or a subagent model leaves the reusable's defaults, as the live callers do. The security shadow passes the live security lane's docs-only paths.
  • Never red: every gate step continues on error and leaves the lanes skipped; no concurrency block, since a cancelled run reads as red.
  • Isolation: its own file, workflow name and job ids, so pr-feedback-dispatch.yml and babysit's review evidence never see it.
  • lane-funding.json catalogs both lanes under reviews (now keyed), and callers.test.mjs covers the pin, grants, secret map, summary mode, the gate's outputs and its decision script.

Verification

  • node --test .github/actions/resolve-config/callers.test.mjs: 124 pass.
  • scripts/check-affected.sh --tests: 9 passed, 5 skipped.
  • actionlint and zizmor: no findings.
  • runner-policy.mjs: fails on both lane jobs, because no reviewed contract exists yet for pr-review-cli.yml@8778094. The contract has to be registered in melodic-software/standards and synced here before this can merge.
  • Self-test shadow run: not run yet. The shadow runs only on a ready pull request, so it runs when this one is marked ready. On the draft head the workflow concluded skipped, not failed.

Related

  • Plan: review lanes on run-claude-cli, PR 4 of 8 (shadow caller).
  • ccp#9277 made the review skills read the diff and PR context files this lane writes.

🤖 Generated with Claude Code

pr-review-shadow-hosted.yml calls ci-workflows' pr-review-cli.yml
(v0.63.0) in summary mode, one job per lane, on the reviews role's API
key alone. A gate job runs it for a pull request that changes the file,
else for one numbered a multiple of 4 when REVIEWS_SHADOW_ENABLED is
true, under the org and repository kill switches, with the live lanes'
model routes. No concurrency block, and every gate step continues on
error, so no path leaves a red or cancelled check.

lane-funding.json catalogs both lanes under reviews, now keyed, and
callers.test.mjs covers the pin, grants, secret, summary mode and the
gate's decision.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@kyle-sexton

Copy link
Copy Markdown
Member Author

Superseded: the owner decided (Q39, 2026-10-23) to drop the review shadow and convert the live review lanes directly onto ci-workflows pr-review-cli.yml, one workflow per lane.

@kyle-sexton
kyle-sexton deleted the ci/pr-review-shadow-hosted branch October 23, 2026 03:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge Hard merge gate: do not merge while applied.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant