Fix Claude workflow push and tidy up review threads

[ddaspit]

Quick summary

The @claude workflow can push its branch and open a pull request again. The code review now resolves findings the author rejects and hides its earlier summaries. No library code changes.

Where to look

The checkout step in claude.yml saved the job's GITHUB_TOKEN as a git extraheader. That token only has contents: read. The header takes precedence over the app token that claude-code-action puts in the remote URL. The push in the #369 run went out as github-actions[bot] and was denied with a 403. Setting persist-credentials: false leaves the app token as the only credential. The review workflow does not push, so I left its checkout alone.

In the pr-review skill, a finding the author rejects or defers is now resolved and recorded as withdrawn or accepted. It used to stay open. After posting a new summary, the review minimizes its earlier summaries as outdated. It only minimizes its own top-level comments that contain Reviewed at, so replies to an @claude mention stay visible.

Validation

• git diff --check -- clean.
• ./local_check.sh --agent-strict -- failed at test collection with 18 errors. My environment is missing the optional extras (datasets, dynaconf, sentencepiece, transformers, thot.alignment). This PR only changes a workflow file and a skill.
• Both changes can only be verified by running the workflows. Mentioning @claude on Port 'Convert USFM versification' #369 again after this is merged will confirm the push. The next review on a PR with earlier findings will exercise the skill change.

🤖 Generated with Claude Code

---

This change is 

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.13%. Comparing base (96ec59f) to head (9054b76).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #389   +/-   ##
=======================================
  Coverage   92.13%   92.13%           
=======================================
  Files         390      390           
  Lines       24644    24644           
=======================================
  Hits        22705    22705           
  Misses       1939     1939           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[claude]

1. Verdict: approve.
2. Nothing blocks this. The diagnosis matches the #369 run, and persist-credentials: false at .github/workflows/claude.yml:45 removes the credential that caused the 403.
3. Findings: 0 Critical, 0 Important, 0 Low.
4. What I ran:
   • The job log for run 36765568905 (gh api .../actions/jobs/110058742411/logs). actions/checkout@v7 writes the extraheader to _temp/git-credentials-*.config and wires it in with includeIf.gitdir:…path. claude-code-action@v1 (SHA 12dd8d7) then logged No existing authentication headers to remove.
   • The action's replaceCheckoutCredentials at that SHA. It only scrubs the local config and include.path entries, so it never saw the includeIf file. The header survived, and the push went out as github-actions[bot], which is the 403 Claude reported on Port 'Convert USFM versification' #369.
   • With persisted credentials off, the only credential is the x-access-token origin URL that the action sets. Anonymous fetch still works because the repo is public.
   • git diff --check 96ec59f 4f58fdc: clean.
5. Not verified:
   • An actual push. Only a workflow run after merge can show that.
   • I could not parse the YAML locally because the command was not permitted.
   • I did not run ./local_check.sh; the PR changes only a workflow file.

Public API, optional dependencies, published-wheel surface, sillsdev/machine parity: none changed.

Optional: the root cause is the action scrubbing include.path but not includeIf.gitdir:*.path. That is worth an upstream issue on anthropics/claude-code-action. Once it is fixed there, this line could go.

Findings: none this round, and none from earlier rounds.

Reviewed at 4f58fdc

[claude]

1. Verdict: approve with fixes.
2. Most important: F1 at .claude/skills/pr-review/SKILL.md:48. When the author rejects a Critical (Major:) finding, even with no reason, the bot now resolves it. That conflicts with line 102, which keeps such findings Blocking until a maintainer dismisses them.
3. Findings: 0 Critical, 1 Important, 1 Low.
4. What I ran:
   • gh api .../compare/4f58fdc...8f83d36 returned ahead. git diff 4f58fdc 8f83d36 changes only .claude/skills/pr-review/SKILL.md. claude.yml has not changed since the last round.
   • git diff --check 4f58fdc 8f83d36: clean.
   • /code-review high 389: 9 candidates. I dropped the two on claude.yml, because that file has not changed since the reviewed commit and neither finding is Critical. I also dropped the candidates about idempotent re-minimizing, about earlier possibly matching the new summary (the text says earlier), about the meaning of "author" (that wording was already there), and about the Reviewed at substring matching a quoted mention reply (speculative).
5. Not verified: whether resolving a GitHub thread changes its disposition in Reviewable. The minimize step has not run yet; a review round after merge will be the first to use it.

Public API, optional dependencies, published-wheel surface, sillsdev/machine parity: none verified changed.

Findings: F1 new, F2 new. No earlier findings.

Reviewed at 8f83d36

[claude]

1. Verdict: approve.
2. Most important: none of this blocks. F1 and F2 are fixed in 9054b76. F3 at .claude/skills/pr-review/SKILL.md:49 is only about wording.
3. Findings this round: 0 Critical, 0 Important, 1 Low.
4. What I ran:
   • gh api .../compare/8f83d36...9054b76 returned ahead. git diff 8f83d36 9054b76 changes only lines 13 and 46-49 of SKILL.md.
   • git diff --check 8f83d36 9054b76: clean.
   • /code-review high 389 returned 8 candidates; I posted one, as F3. Four were on code that has not changed since 8f83d36 and none of them is Critical, so I dropped them: the minimize-step matching, the repeated re-minimizing, the review checkout keeping its persisted token, and the past-tense comment at claude.yml:44. The comment one does break the code-comments present-tense rule, and comment_hygiene.py does not scan .yml. I also dropped resolving an Important finding after a rejection that does not hold, because the PR body states it as deliberate policy and it has been in place since 8f83d36. I dropped the Reviewable sync question as a duplicate of last round's unverified item. I dropped the concern that resolved accepted findings are never re-checked, because it predates this round.
   • I did not run ./local_check.sh. The PR changes no library code.
5. Not verified: whether resolving a GitHub thread changes its Reviewable disposition. The new rules only run in a later review round.

Public API, optional dependencies, published-wheel surface, sillsdev/machine parity: none verified changed.

Findings: F1 addressed, F2 addressed, F3 new.

Reviewed at 9054b76

[Enkidu93]

@Enkidu93 reviewed 2 files and all commit messages.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on ddaspit).