Skip to content

ci: run Claude Opus 5.5 with a supported CLI #3432

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cquil11 merged 2 commits into from
Sep 25, 2026
+63 −12
Merged

ci: run Claude Opus 5.5 with a supported CLI #3432

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
568cf3e
ci: run Claude Opus 5.5 with a supported CLI
cquil11 Sep 25, 2026
775769f
ci: document pinned Claude CLI installation
cquil11 Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 20 additions & 4 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,9 +38,16 @@ jobs:
- name: Set up uv
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

- name: Install Claude Code 2.1.282
id: claude_cli
run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282
claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218
uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
env:
# Repository agent credential; the pinned action authorizes the triggering actor.
GH_TOKEN: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env]
Expand All @@ -50,6 +57,7 @@ jobs:
BASH_DEFAULT_TIMEOUT_MS: "1800000"
BASH_MAX_TIMEOUT_MS: "3600000"
with:
path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
# Repository agent credential; the pinned action authorizes the triggering actor.
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
# Repository agent credential; the pinned action authorizes the triggering actor.
Expand All @@ -63,7 +71,7 @@ jobs:
{"fastMode": true}

claude_args: |
--model 'claude-fable-5-1'
--model 'claude-opus-5-5'
--mcp-config .github/mcp-ci.json '{"mcpServers": {"fetch": {"command": "npx", "args": ["-y", "@anthropic-ai/mcp-server-fetch@latest"]}}}'
--allowedTools "Write,Edit,Read,Glob,Grep,WebFetch,mcp__github__*,mcp__github_inline_comment__create_inline_comment,mcp__github_ci__*,mcp__fetch__*,mcp__inferencemax-repos__*,Bash"
prompt: |
Expand Down Expand Up @@ -315,11 +323,19 @@ jobs:
- name: Set up uv
uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

- name: Install Claude Code 2.1.282
id: claude_cli
run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282
claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
- name: PR Review with Claude
uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218
uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
env:
INFERENCEMAX_ROOT: ${{ github.workspace }}
with:
path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
# Repository review credential; the job gates eligible review requests.
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
trigger_phrase: "@pr-claude"
Expand All @@ -329,7 +345,7 @@ jobs:
{"fastMode": true}

claude_args: |
--model 'claude-fable-5-1'
--model 'claude-opus-5-5'
--mcp-config .github/mcp-ci.json
--allowedTools "mcp__github_inline_comment__create_inline_comment,mcp__inferencemax-repos__*,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
prompt: |
Expand Down
13 changes: 11 additions & 2 deletions .github/workflows/codeowner-signoff-verify.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,10 +87,18 @@ jobs:
grep -q "PR #${PR_NUMBER}" /tmp/codeowner-signoff-verify-prompt.md
wc -c /tmp/codeowner-signoff-verify-prompt.md

- name: Install Claude Code 2.1.282
id: claude_cli
if: steps.resolve.outputs.proceed == 'true'
run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282
claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
- name: Verify sign-off with Claude
id: claude
if: steps.resolve.outputs.proceed == 'true'
uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218
uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
env:
# Repository verifier credential; trusted code checks writer authorization before this step.
GH_TOKEN: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env]
Expand All @@ -104,6 +112,7 @@ jobs:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
# Repository verifier credential; trusted code checks writer authorization before this step.
github_token: ${{ secrets.AGENT_PAT }} # zizmor: ignore[secrets-outside-env]
path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
track_progress: false
allowed_bots: ''
additional_permissions: |
Expand All @@ -112,7 +121,7 @@ jobs:
{"fastMode": true}

claude_args: |
--model 'claude-fable-5-1'
--model 'claude-opus-5-5'
--mcp-config .github/mcp-ci.json '{"mcpServers": {"fetch": {"command": "npx", "args": ["-y", "@anthropic-ai/mcp-server-fetch@latest"]}}}'
--allowedTools "Read,Write,Glob,Grep,WebFetch,mcp__github__*,mcp__github_ci__*,mcp__fetch__*,mcp__inferencemax-repos__*,Bash"
prompt: |
Expand Down
12 changes: 10 additions & 2 deletions .github/workflows/klaud-candidate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,14 +62,22 @@ jobs:
rm -r "$RUNNER_TEMP/plan"
outcome_schema=$(uv run --project .infx-tooling --locked python -P -m infx.klaud outcome-schema)
echo "outcome-schema=$outcome_schema" >> "$GITHUB_OUTPUT"
- name: Install Claude Code 2.1.282
id: claude_cli
run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282
claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
- name: Let Klaud Cold own the candidate PR
id: claude
continue-on-error: true
uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218
uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
env:
GH_TOKEN: ${{ secrets.AGENT_PAT }}
KLAUD_DASHBOARD_API_KEY: ${{ secrets.DASH_API_KEY }}
with:
path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ secrets.AGENT_PAT }}
settings: |
Expand All @@ -83,7 +91,7 @@ jobs:
}
}
claude_args: >-
--model 'claude-fable-5-1'
--model 'claude-opus-5-5'
--max-turns 500
--json-schema '${{ steps.context.outputs.outcome-schema }}'
--add-dir '${{ runner.temp }}/klaud'
Expand Down
13 changes: 11 additions & 2 deletions .github/workflows/klaud-plan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,23 +66,32 @@ jobs:
--directory "$RUNNER_TEMP/klaud"
--review-batch-size "$REVIEW_BATCH_SIZE"
--cooldown-hours "$CANDIDATE_COOLDOWN_HOURS"
- name: Install Claude Code 2.1.282
id: claude_cli
if: steps.prepare.outputs.has_candidates == 'true'
run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282
claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
- name: Check for overlapping open PRs
id: review
if: steps.prepare.outputs.has_candidates == 'true'
continue-on-error: true
uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218
uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
env:
GH_TOKEN: ${{ github.token }}
KLAUD_EVIDENCE: ${{ runner.temp }}/klaud
with:
path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
# Repository automation credential; the planner runs only on main.
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
github_token: ${{ github.token }}
track_progress: false
settings: |
{"fastMode": false}
claude_args: >-
--model 'claude-opus-5'
--model 'claude-opus-5-5'
--max-turns 500
--add-dir '${{ runner.temp }}/klaud'
--allowedTools "Read,Glob,Grep,Bash(gh pr list:*),Bash(gh pr view:*),Bash(gh pr diff:*),Bash(gh api --method GET:*),Bash(git show:*),Bash(git diff:*),Bash(git status:*),Bash(git log:*),Bash(git ls-tree:*)"
Expand Down
13 changes: 11 additions & 2 deletions .github/workflows/run-sweep.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -266,22 +266,31 @@ jobs:
]).write();
return data.sha;
- uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
- name: Install Claude Code 2.1.282
id: claude_cli
if: vars.PRIORITY_SCHEDULER_ENABLED == 'true' && github.event_name == 'pull_request'
run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282
claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)"
echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
Comment on lines +269 to +276

@claude claude Bot Sep 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔴 The new Install Claude Code step has no continue-on-error, so an npm hiccup or a CLI version mismatch now hard-fails the job even though the Claude action step right after it still has continue-on-error: true. In run-sweep.yml this is inside the 'setup' job (run-sweep.yml:269-276); every eval job is gated on needs.setup.result == 'success' (run-sweep.yml:860), so a flaky install now skips the whole sweep instead of degrading to the '["patchwork"]' fallback at run-sweep.yml:329. Same gap in klaud-plan.yml:69-76 (continue-on-error at klaud-plan.yml:80) and klaud-candidate.yml:65-71 (continue-on-error at klaud-candidate.yml:74). Fix: add continue-on-error: true to each new Install step so it fails no harder than the step it precedes. [also at: .github/workflows/klaud-plan.yml:75 - Maintainers now get a hard job failure (and skipped downstream steps) from a transient npm/CLI issue, where the base only failed the Claude call itself.]

Why this was flagged

Trigger: an npm registry blip or claude-code version drift makes the test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" assertion fail in the 'Install Claude Code 2.1.282' step (run-sweep.yml:269-276, klaud-plan.yml:69-76, klaud-candidate.yml:65-71). That step lacks continue-on-error, so GitHub Actions marks the whole job failed regardless of later steps' continue-on-error. In run-sweep.yml this step lives in 'setup'; 'Classify priority criteria' (run-sweep.yml:277-282) has continue-on-error: true and 'Normalize priority classification' (run-sweep.yml:319-331) already falls back to '["patchwork"]', proving the workflow was built to tolerate Claude-call failures. But the Install step now fails 'setup' outright, so every downstream eval job gated on needs.setup.result == 'success' (run-sweep.yml:860) is skipped. Before this diff there was no Install step, so only the continue-on-error-protected action could fail, and 'setup'…

Verification: normal (conflicts with stated purpose, partially): merging introduces a new hard-fail point that the base branch does not have, in code whose whole design is best-effort/non-blocking. Facts, run-sweep.yml: - The new step (269-276) Install Claude Code 2.1.282 has no continue-on-error; line 275 test "$("$claude_cli" --version)" = "2.1.282 (Claude Code)" (and the npm install at 273)…

- name: Classify priority criteria
id: classify
if: >-
vars.PRIORITY_SCHEDULER_ENABLED == 'true' &&
github.event_name == 'pull_request'
continue-on-error: true
uses: anthropics/claude-code-action@0d0e0876d3eaa933f45dc692f7a4312c83caf36f # v1.0.218
uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
with:
path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
github_token: ${{ github.token }}
# Repository integration credential for the scoped sweep/ingest job.
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} # zizmor: ignore[secrets-outside-env]
track_progress: false
settings: |
{"fastMode": true}
claude_args: |
--model 'claude-opus-5'
--model 'claude-opus-5-5'
--effort low
--max-turns 8
--allowedTools "Read,Glob,Grep,Bash(git diff:*)"
Expand Down
Loading