pr-review-security lane reports success and marks the head reviewed after permission denials stop it early #6421

Activity

1. github-actions

   added

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 5, 2026
2. github-actions commented on Oct 5, 2026

   

   github-actionsBot

   on Oct 5, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for the report. Automated triage handed this issue to a maintainer.

   _{Automated triage. A maintainer reviews it.}
3. github-actions

   added

   needs-humanHuman-in-the-loop required; autonomous sessions must not resolve items carrying this.Human-in-the-loop required; autonomous sessions must not resolve items carrying this.

   on Oct 5, 2026
4. kyle-sexton commented on Oct 11, 2026

   

   kyle-sexton

   on Oct 11, 2026

   MemberAuthor

   More actions

   The same failure hits the code-review lane, not only the security lane. On PR #7060, .github/workflows/pr-review-hosted.yml, job pr-review / claude-review-status:

   • Run 38119559231 (head 660c0bc, job 114411329359): the SDK result was subtype:"success", is_error:false, num_turns:42, permission_denials_count:5.
   • Run 38120506944 (head 61ab590, job 114414070418): subtype:"success", num_turns:22, permission_denials_count:5.

   In both runs the progress comment stayed at "Code review in progress", with "Fan out hunters + adversarial verification" and "Post findings / summary" unchecked. Even so, "Report review outcome" logged "Claude review completed", the reviewed-head marker was written, and the check went green. Neither run timed out or hit the turn cap (75). Other runs on the same PR (38121164028 with 8 denials, 38121689718, 38119866298) did post, so the denials alone don't always stop it.

   The issue title could drop "security" so it covers both lanes.

   🤖 Generated with Claude Code
5. kyle-sexton

   added the

   Bug

   issue type on Oct 12, 2026
6. kyle-sexton

   removed

   needs-triageNot yet classified. Floor until a type and one priority tier are set.Not yet classified. Floor until a type and one priority tier are set.

   on Oct 12, 2026
7. kyle-sexton commented on Oct 13, 2026

   

   kyle-sexton

   on Oct 13, 2026

   MemberAuthor

   More actions

   Decision recorded. The owner approved applying independently verified recommendations (high-risk set, reviewed) on 2026-10-13.

   Both AI review lanes concluded success and wrote the reviewed-head marker even when the run stopped before posting findings. ci-workflows #740 (merged 2026-10-12) makes a run with no completed review fail as incomplete without a marker, and both hosted review workflows here pin that commit (v0.41.0).

   Verification notes:

   • Assumption that denial-truncated runs are caught by the new verify step is plausible from the step's design (no completed review -> incomplete, no marker), but no run has been observed under the v0.41.0 pin yet.

   Verified by an independent fresh-context check (confirmed, risk high): gh issue view 6421 incl. owner comment 2026-10-11 (same failure on the code-review lane); melodic-software/ci-workflows#740 MERGED 2026-10-12, merge commit a621ef8112677a519b662ec5d2547475c0101f7e = tag v0.41.0; origin/main .github/workflows/pr-review-hosted.yml:84 and pr-review-security-hosted.yml:85 pin a621ef8; ci-workflows@a621ef8 pr-review.yml (:64, :151 incomplete class) and pr-review-security.yml (:480-483 'Verify the review completed', no marker on incomplete); #7257 OPEN umbrella

   Closing: Shipped upstream: ci-workflows #740 adds a 'Verify the review completed' step that fails both review lanes as incomplete and writes no marker, and this repo pins that commit.
8. kyle-sexton

   closed this as completedon Oct 13, 2026