claude-sonnet-4-5 predates auto mode, so Claude Code fell back to its
default permission mode in the dedupe job. Move it and claude.yml to
claude-sonnet-4-6. The action sets --permission-mode acceptEdits for
@claude mentions and appends the workflow's claude_args after it, so the
--permission-mode auto in claude.yml wins. Drop claude.yml from
EXEMPT_FROM_AUTO_MODE.
The check now also fails when a step in auto mode names a model older than
claude-opus-4-6.
A settings file that an earlier step writes at run time can't be read by
the step-level check, so also fail when the job's definition mentions
defaultMode at all.
The security check looked for defaultMode only in an inline 'settings'
input. Also read the file a 'settings' input or a --settings flag in
claude_args names, when it is inside the repository, and fail if it sets
a permission mode.
- .github/egress-firewall.yaml: the hosts that jobs on the
egress-firewall runner may reach, in enforce mode, each with what
uses it.
- .github/workflows/workflow-hardening.yml and
.github/scripts/check_workflow_hardening.py: a check that fails when a
job that calls Claude is not on the egress-firewall runner, does not
pass --permission-mode auto, or when the allow list is missing, empty, not in
enforce mode or names a host with '*'.
claude.yml is listed as exempt from the permission mode rule, with
the reason.
- CLAUDE.md: a "Security hardening for GitHub Actions" section so that
new and edited workflows keep these protections.
Move the three workflow jobs that sign in to the Claude API (claude.yml,
claude-issue-triage.yml, claude-dedupe-issues.yml) from ubuntu-latest to
GitHub's egress-firewall runner (ubuntu-24.04-firewall), and pass
--permission-mode auto to the Claude Code action in the triage and
dedupe steps.
In auto permission mode Claude Code reviews each tool call that needs
permission and that the command's allowed-tools list does not cover, and
runs it only if Claude Code's safety review passes it. Until now these runs, which
have nobody to ask, refused every such call. Anyone can start both jobs by opening
an issue, and the triage job also by commenting on one, so both steps
also pass a --disallowedTools list for tools they never need.
claude.yml answers @claude mentions, and for those the action sets
--permission-mode acceptEdits itself. Its permission mode is unchanged.
Allowed tools, models, triggers and permissions are unchanged. The
network allow list for the firewall follows in the next change.
The workflow has been failing daily since 2026-04-27 with HTTP 422
"Pagination with the page parameter is not supported for large
datasets" at page=100. The repo now has ~58k closed issues and the
script was paging past ~10k already-locked ones every run before
reaching any candidates.
Replace listForRepo + page=N with the search API
(is:issue is:closed is:unlocked updated:<cutoff), which returns only
the issues that actually need locking. Cap at 250/run with a 1s sleep
between locks to stay under secondary rate limits.
Claude-Session: https://claude.ai/code/session_016EWY3FKCJyfUdCAZkXfi7i
Replace the static ANTHROPIC_API_KEY secret with Workload Identity
Federation inputs in claude.yml, claude-issue-triage.yml, and
claude-dedupe-issues.yml. The federation rule, organization, service
account, and workspace IDs are read from repository variables.
Updates edit-issue-labels.sh and comment-on-duplicates.sh to read the
issue number from GITHUB_EVENT_PATH (the workflow event payload) instead
of accepting it as a CLI argument. Simplifies the call signature and
keeps the scripts aligned with the triggering issue.
Also updates the /triage-issue and /dedupe command docs to match.
🏠 Remote-Dev: homespace
Extract triage prompt into /triage-issue command and use a dedicated
edit-issue-labels.sh script for label operations instead of raw
gh issue edit. The script validates labels against the repo's existing
labels before applying them.
The sweep script was closing issues based solely on when a lifecycle label
was applied, ignoring any human comments posted after the label. This caused
active issues (like #11792) to be closed even when users responded to the
stale warning.
Three changes:
1. Teach the triage bot about `stale` and `autoclose` labels so it removes
them when a human comments on the issue.
2. Add a safety net in `closeExpired()` that checks for non-bot comments
posted after the lifecycle label was applied — if any exist, skip closing.
3. Extend the 10-upvote protection (which previously only applied to
enhancements) to all issue types, in both `markStale()` and
`closeExpired()`.
Fixes#16497
## Test plan
Trace through scenarios manually:
- Issue with stale label + human comment after → triage removes label;
sweep skips even if triage hasn't run yet (safety net)
- Issue with stale label + no human comment → closes as before
- Issue with 10+ upvotes of any type → never marked stale or closed
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When lifecycle labels (needs-info, needs-repro, invalid, stale, autoclose)
are applied to an issue, the author currently only sees a label change with
no explanation. They then get a closing comment days later without ever
being nudged to respond.
Add a GitHub Actions workflow that triggers on issues.labeled and runs a
new lifecycle-comment.ts script to post a comment explaining what's needed
and how long before auto-close.
Extract lifecycle config (labels, timeouts, close reasons, nudge messages)
into a shared issue-lifecycle.ts so the sweep script and comment script
stay in sync. Previously the timeouts were duplicated between the sweep
script and the comment messages.
- needs-info: asks for version, OS, error messages
- needs-repro: asks for steps to trigger the issue
- invalid: links to the Claude Code repo and Anthropic support
- stale/autoclose: explains inactivity auto-close
The script no-ops for non-lifecycle labels, so the workflow fires on every
label event and lets the script decide — single source of truth.
## Test plan
Dry-run all labels locally:
GITHUB_REPOSITORY=anthropics/claude-code LABEL=needs-info ISSUE_NUMBER=12345 bun run scripts/lifecycle-comment.ts --dry-run
GITHUB_REPOSITORY=anthropics/claude-code LABEL=needs-repro ISSUE_NUMBER=12345 bun run scripts/lifecycle-comment.ts --dry-run
GITHUB_REPOSITORY=anthropics/claude-code LABEL=invalid ISSUE_NUMBER=12345 bun run scripts/lifecycle-comment.ts --dry-run
GITHUB_REPOSITORY=anthropics/claude-code LABEL=stale ISSUE_NUMBER=12345 bun run scripts/lifecycle-comment.ts --dry-run
GITHUB_REPOSITORY=anthropics/claude-code LABEL=autoclose ISSUE_NUMBER=12345 bun run scripts/lifecycle-comment.ts --dry-run
Verified sweep.ts still works:
GITHUB_TOKEN=$(gh auth token) GITHUB_REPOSITORY_OWNER=anthropics GITHUB_REPOSITORY_NAME=claude-code bun run scripts/sweep.ts --dry-run
* Unify issue lifecycle labeling and sweep into a single system
Consolidate issue triage, stale detection, and lifecycle enforcement into
two components: a Claude-powered triage workflow and a unified sweep script.
Triage workflow changes:
- Add issue_comment trigger so Claude can re-evaluate lifecycle labels when
someone responds to a needs-repro/needs-info issue
- Add concurrency group per issue with cancel-in-progress to avoid pile-up
- Filter out bot comments to prevent sweep/dedupe triggering re-triage
- Hardcode allowed label whitelist to prevent label sprawl (was discovering
labels via gh label list, leading to junk variants like 'needs repro' vs
'needs-repro')
- Replace MCP GitHub server with gh CLI — simpler, no Docker dependency,
chaining is caught by the action so permissions are equivalent
- Add lifecycle labels (needs-repro, needs-info) for bugs missing info
- Add invalid label for off-topic issues (Claude API, billing, etc.)
- Add anti-patterns to prevent false positives (don't require specific
format, model behavior issues don't need traditional repro, etc.)
Sweep script changes:
- Absorb stale issue detection (was separate stale-issue-manager workflow)
- Mark issues as stale after 14 days of inactivity
- Skip assigned issues (team is working on it internally)
- Skip enhancements with 10+ thumbs up (community wants it)
- Add invalid label with 3-day timeout
- Add autoclose label support to drain 200+ legacy issues
- Drop needs-votes (stale handles inactive enhancements)
- Unify close messages into a single template with per-label reasons
- Run 2x daily instead of once
Delete stale-issue-manager.yml — its logic is now in sweep.ts.
## Test plan
Dry-run sweep locally:
GITHUB_TOKEN=$(gh auth token) GITHUB_REPOSITORY_OWNER=anthropics GITHUB_REPOSITORY_NAME=claude-code bun run scripts/sweep.ts --dry-run
Triage workflow will be tested by opening a test issue after merge.
* Update .github/workflows/claude-issue-triage.yml
Co-authored-by: Ashwin Bhat <ashwin@anthropic.com>
---------
Co-authored-by: Ashwin Bhat <ashwin@anthropic.com>
Introduce a simple, mechanical daily sweep that closes issues with
lifecycle labels past their timeout:
- needs-repro: 7 days
- needs-info: 7 days
- needs-votes: 30 days
- stale: 30 days
The sweep checks when the label was last applied via the events API,
and closes the issue if the timeout has elapsed. No AI, no comment
checking — if the label is still there past its timeout, close it.
Removing a label (by a triager, slash command, or future AI retriage)
is what prevents closure.
Each close message directs the reporter to open a new issue rather
than engaging with the closed one.
The script supports --dry-run for local testing:
GITHUB_TOKEN=$(gh auth token) \
GITHUB_REPOSITORY_OWNER=anthropics \
GITHUB_REPOSITORY_NAME=claude-code \
bun run scripts/sweep.ts --dry-run
## Test plan
Ran --dry-run against anthropics/claude-code. Correctly identified 3
issues past their timeouts (1 needs-repro at 12d, 2 needs-info at
14d and 26d). No false positives.
Updates GitHub workflow files to use the new claude-code-action@v1 and replaces prompt_file with inline prompt parameter.
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Generated-By: Claude Code (cli/claude-opus-4-5=100%)
Claude-Steers: 3
Claude-Permission-Prompts: 4
Claude-Escapes: 0
Updates the oncall triage automation to require 50+ engagements
(comments + reactions) before applying the oncall label, making the
criteria more conservative to focus on the most critical issues.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Implements a GitHub Actions workflow that automatically identifies and labels critical blocking issues requiring oncall attention.
Features:
- Runs every 6 hours via cron schedule
- Fetches open issues updated in the last 3 days (5 per page to avoid context overflow)
- Orders by UPDATED_AT DESC and stops when hitting issues older than 3 days
- Evaluates each issue for bug status, engagement level (5+), and blocking severity
- Uses LLM comprehension to determine true blocking impact, not keyword matching
- Applies "oncall" label to qualifying issues via GitHub MCP tools
- Provides detailed summary including processed count, labeled issues, and close calls
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
Update all Claude Code GitHub Action workflows to use the latest Sonnet 4.5 model (claude-sonnet-4-5-20250929) instead of the default Sonnet 4.0 model. This provides improved performance and capabilities for:
- Issue commenting and PR reviews (claude.yml)
- Automated issue triage (claude-issue-triage.yml)
- Duplicate issue detection (claude-dedupe-issues.yml)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
- Update all documentation URLs from docs.anthropic.com to docs.claude.com to avoid redirects
- Change Getting Started Guide URL from /getting-started to /quickstart path
- Remove Discussions link as GitHub Discussions are not enabled for this repository
Fixes#7730
Switch from workflow_dispatch to repository_dispatch for cross-repo
triggering of issue-detective workflow in claude-cli-internal.
Changes:
- Use gh api with repository_dispatch endpoint
- Send issue_url in client_payload
- Support ISSUE_NOTIFY_TOKEN secret for better permissions
- Remove dependency on ISSUE_NOTIFY_WORKFLOW_NAME secret
This enables automatic issue detective analysis when issues are
opened in claude-code repository.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Claude