docs: a pull request can't self-test its own OIDC workflow-file change - #51
Conversation
Generalises the existing Dependabot-specific note in "Automated upstream bumps" into a standing rule: any of the three App-identity dogfooding workflows (claude-review.yml, claude-triage.yml, claude-interactive.yml) fails GitHub's own workflow-byte-identical platform check on a pull request that edits that same file, no-oping gracefully rather than crashing. Confirmed live when headroom_enabled was first added to claude-review.yml in the same pull request that tried to dogfood it against itself -- the run reported success, but zero API calls ever happened. Validate such a change with a separate temporary workflow instead, not the file under test.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Approving — nothing blocking.
This is a docs-only addition to README.md (mirrored into CLAUDE.md via the existing symlink), generalising the Dependabot-specific "workflow byte-identical" platform-check note in "Automated upstream bumps" into a standing rule covering all three App-identity dogfooding workflows. Checked:
- The new paragraph's cross-reference ("the same mechanism the 'Automated upstream bumps' section below documents") is directionally correct — that section is later in the file.
- Content is consistent with, and doesn't duplicate, the existing Dependabot-specific paragraph elsewhere in the doc; it reads as the generalisation the PR description claims.
- Title and description are already specific and accurate against the diff, so I left them as-is.
- No prior reviews or inline comments existed on this PR (first review), so there's nothing to reconcile or resolve.
I can't independently verify the underlying GitHub-platform behaviour (the byte-identical workflow-validation check and its silent no-op) from within this repository — it's an operational claim about upstream anthropics/claude-code-action and GitHub Actions itself, not something the diff or repo code can confirm — but the PR description states it was confirmed live in #50, and the prose is consistent with how the rest of this document already describes that same mechanism for the Dependabot case.
|
🗜️ Headroom compressed this run's context: proxied 17 request(s), saving 21763 tokens (1.6% average compression). |
|
🎉 This PR is included in version 1.8.2 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
1 participant
Generalises the existing Dependabot-specific note in "Automated upstream bumps" into a standing rule: any of the three App-identity dogfooding workflows (`claude-review.yml`, `claude-triage.yml`, `claude-interactive.yml`) fails GitHub's own workflow-byte-identical platform check on a pull request that edits that same file, no-oping gracefully rather than crashing.
Confirmed live: this is exactly what happened when `headroom_enabled: true` was added to `claude-review.yml` in #50 -- that PR's own dogfood review reported success, but the workflow-validation skip meant zero API calls ever happened, so no review posted and Headroom correctly saw zero proxied requests. Not a bug in Headroom; a pre-existing GitHub platform limitation this repo already documented for the analogous Dependabot case, now generalised.
This PR itself doesn't touch any of the three workflow files, so its own dogfood review should run cleanly through the now-merged `headroom_enabled: true` -- the actual first live confirmation that the dogfooding change works.