pull-request.yml

name: Pull Request

on:
  workflow_call:
    inputs:
      internal_app:
        description: "Set true for internal apps where low-risk changes do not require approval"
        type: boolean
        required: false
        default: false
      claude_model:
        description: "Claude model used for automated PR review"
        type: string
        required: false
        default: claude-opus-5
      claude_extra_prompt:
        description: "Optional repository-specific Claude review instructions"
        type: string
        required: false
        default: ""
      claude_allowed_bots:
        description: "Comma-separated bot actors allowed to trigger automated Claude PR review"
        type: string
        required: false
        default: "github-actions,github-actions[bot],simple-analytics-ai"
      context_repositories:
        description: "Newline-separated GitHub repositories to clone as read-only review context"
        type: string
        required: false
        default: |
          simpleanalytics/admin
          simpleanalytics/assistant
          simpleanalytics/boardroom
          simpleanalytics/chat
          simpleanalytics/common
          simpleanalytics/compare-node-versions-action
          simpleanalytics/dashboard
          simpleanalytics/docs
          simpleanalytics/dropzone
          simpleanalytics/elasticsearch-api
          simpleanalytics/embed
          simpleanalytics/extension
          simpleanalytics/github-actions
          simpleanalytics/google-tag-manager
          simpleanalytics/infrastructure
          simpleanalytics/intranet
          simpleanalytics/main
          simpleanalytics/marketing-site
          simpleanalytics/news-alerts
          simpleanalytics/notify
          simpleanalytics/online
          simpleanalytics/playground.simpleanalytics.com
          simpleanalytics/queue
          simpleanalytics/recall
          simpleanalytics/screenshot-grabber
          simpleanalytics/scripts
          simpleanalytics/status
          simpleanalytics/strapi
          simpleanalytics/support-reminder
          simpleanalytics/wordpress-plugin
      context_clone_concurrency:
        description: "Maximum number of context repositories to clone in parallel"
        type: number
        required: false
        default: 8
    secrets:
      ANTHROPIC_API_KEY:
        required: true
      SA_PAT_ADRIAAN_READ_REPOS:
        required: false

jobs:
  claude-review:
    runs-on: ubuntu-latest
    if: ${{ !github.event.pull_request.draft && github.event_name == 'pull_request' && contains(fromJson('["opened", "reopened", "synchronize"]'), github.event.action) }}
    concurrency:
      group: claude-pr-review-${{ github.repository }}-${{ github.event.pull_request.number }}
      cancel-in-progress: false
    permissions:
      contents: read
      pull-requests: write
      issues: write
      actions: read
    steps:
      - name: Ensure SDLC labels
        uses: actions/github-script@v9
        with:
          script: |
            const labels = [
              {
                name: 'change: needs review',
                color: 'b60205',
                description: 'Changes affecting security, data protection, or system stability.',
              },
              {
                name: 'change: routine',
                color: 'fbca04',
                description: 'Changes to internal tools or low-risk changes (e.g., design updates or content modifications)',
              },
            ];

            for (const label of labels) {
              try {
                await github.rest.issues.getLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  name: label.name,
                });

                await github.rest.issues.updateLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  name: label.name,
                  new_name: label.name,
                  color: label.color,
                  description: label.description,
                });
              } catch (error) {
                if (error.status !== 404) throw error;

                await github.rest.issues.createLabel({
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  name: label.name,
                  color: label.color,
                  description: label.description,
                });
              }
            }

      - name: Checkout pull request branch
        uses: actions/checkout@v7
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0

      - name: Fetch base branch
        env:
          BASE_REF: ${{ github.event.pull_request.base.ref }}
        run: |
          git remote add base "https://github.com/${{ github.repository }}.git" 2>/dev/null || git remote set-url base "https://github.com/${{ github.repository }}.git"
          git fetch --no-tags --prune --depth=200 base "$BASE_REF"

      - name: Index current pull request patches
        id: current_patches
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          merge_base="$(git merge-base "$BASE_SHA" "$HEAD_SHA")"
          patch_index="$RUNNER_TEMP/current-pr-patches.tsv"
          : > "$patch_index"

          while read -r commit_sha; do
            parent_sha="$(git rev-parse "$commit_sha^" 2>/dev/null || true)"
            [[ -n "$parent_sha" ]] || continue

            patch_id="$(
              git diff --binary "$parent_sha" "$commit_sha" |
                git patch-id --stable |
                awk 'NR == 1 { print $1 }'
            )"

            if [[ "$patch_id" =~ ^[a-f0-9]{40}$ ]]; then
              printf '%s\t%s\n' "$patch_id" "$commit_sha" >> "$patch_index"
            fi
          done < <(git rev-list --reverse "$merge_base..$HEAD_SHA" | tail -n 500)

          patches_json="$(jq -Rn '[inputs | split("\t") | {patch_id: .[0], commit_sha: .[1]}]' < "$patch_index")"

          {
            echo "merge_base=$merge_base"
            echo "patches_json<<EOF"
            echo "$patches_json"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Find previous Claude review checkpoint
        id: previous_review
        uses: actions/github-script@v9
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const nameWithOwner = `${owner}/${repo}`;
            const issueNumber = context.payload.pull_request.number;
            const trustedBotLogins = new Set(['github-actions[bot]']);
            const markerPattern = /<!--\s*simpleanalytics-claude-pr-review-checkpoint\s+([\s\S]*?)\s*-->/g;

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner,
              repo,
              issue_number: issueNumber,
              per_page: 100,
            });

            const checkpoints = [];
            const fallbackClaudeComments = [];

            for (const comment of comments) {
              if (!trustedBotLogins.has(comment.user?.login)) continue;

              const body = comment.body || '';
              let match;
              markerPattern.lastIndex = 0;
              while ((match = markerPattern.exec(body)) !== null) {
                try {
                  const checkpoint = JSON.parse(match[1].trim());

                  if (
                    [1, 2].includes(checkpoint.version) &&
                    checkpoint.repository === nameWithOwner &&
                    Number(checkpoint.pull_request) === Number(issueNumber) &&
                    /^[a-f0-9]{40}$/i.test(checkpoint.head_sha || '')
                  ) {
                    checkpoints.push({
                      headSha: checkpoint.head_sha,
                      reviewedAt: checkpoint.reviewed_at || comment.updated_at || comment.created_at,
                      commentId: comment.id,
                    });
                  }
                } catch (error) {
                  core.warning(`Ignoring invalid Claude review checkpoint in comment ${comment.id}: ${error.message}`);
                }
              }

              if (/\bclaude\b/i.test(body)) {
                fallbackClaudeComments.push({
                  reviewedAt: comment.updated_at || comment.created_at,
                  commentId: comment.id,
                });
              }
            }

            checkpoints.sort((left, right) => new Date(right.reviewedAt) - new Date(left.reviewedAt));
            fallbackClaudeComments.sort((left, right) => new Date(right.reviewedAt) - new Date(left.reviewedAt));

            const checkpoint = checkpoints[0];
            if (checkpoint) {
              core.setOutput('head_sha', checkpoint.headSha);
              core.setOutput('reviewed_at', checkpoint.reviewedAt);
              core.setOutput('source', `checkpoint-comment-${checkpoint.commentId}`);
              core.info(`Found previous Claude review checkpoint ${checkpoint.headSha} from ${checkpoint.reviewedAt}.`);
              return;
            }

            const fallback = fallbackClaudeComments[0];
            if (fallback) {
              core.setOutput('head_sha', '');
              core.setOutput('reviewed_at', fallback.reviewedAt);
              core.setOutput('source', `claude-comment-${fallback.commentId}`);
              core.info(`No checkpoint marker found. Falling back to latest trusted Claude bot comment from ${fallback.reviewedAt}.`);
              return;
            }

            core.setOutput('head_sha', '');
            core.setOutput('reviewed_at', '');
            core.setOutput('source', '');
            core.info('No previous Claude review checkpoint found.');

      - name: Find reviewed patches in related pull requests
        id: related_reviews
        uses: actions/github-script@v9
        env:
          CURRENT_PATCHES_JSON: ${{ steps.current_patches.outputs.patches_json }}
          CURRENT_PR_NUMBER: ${{ github.event.pull_request.number }}
          LOOKUP_TIMEOUT_MS: 30000
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const nameWithOwner = `${owner}/${repo}`;
            const currentPrNumber = Number(process.env.CURRENT_PR_NUMBER);
            const timeoutMs = Number(process.env.LOOKUP_TIMEOUT_MS || 30000);
            const trustedBotLogins = new Set(['github-actions', 'github-actions[bot]']);
            const markerPattern = /<!--\s*simpleanalytics-claude-pr-review-checkpoint\s+([\s\S]*?)\s*-->/g;
            const shaPattern = /^[a-f0-9]{40}$/i;

            function emptyResult(status, message) {
              core.setOutput('reviewed_commit_shas', '[]');
              core.setOutput('source_pull_requests', '[]');
              core.setOutput('legacy_checkpoints', '[]');
              core.setOutput('matched_patch_count', '0');
              core.setOutput('lookup_status', status);
              core.setOutput('lookup_message', message || '');
              if (status === 'failed') {
                core.warning(message, { title: 'Cross-PR review deduplication' });
              } else if (message) {
                core.info(message);
              }
            }

            let currentPatches;
            try {
              currentPatches = JSON.parse(process.env.CURRENT_PATCHES_JSON || '[]');
            } catch (error) {
              emptyResult('failed', `Could not parse the current patch index: ${error.message}`);
              return;
            }

            const currentPatchCommits = new Map();
            for (const entry of currentPatches) {
              if (!shaPattern.test(entry.patch_id || '') || !shaPattern.test(entry.commit_sha || '')) continue;
              const patchId = entry.patch_id.toLowerCase();
              const commits = currentPatchCommits.get(patchId) || [];
              commits.push(entry.commit_sha.toLowerCase());
              currentPatchCommits.set(patchId, commits);
            }

            if (!currentPatchCommits.size) {
              emptyResult('no-patches', 'The current pull request has no patch IDs to compare.');
              return;
            }

            const query = `
              query RelatedReviewCheckpoints($owner: String!, $repo: String!) {
                repository(owner: $owner, name: $repo) {
                  openPullRequests: pullRequests(
                    states: OPEN
                    first: 50
                    orderBy: { field: UPDATED_AT, direction: DESC }
                  ) {
                    nodes {
                      number
                      firstComments: comments(first: 20) {
                        nodes { id author { login } body updatedAt }
                      }
                      lastComments: comments(last: 20) {
                        nodes { id author { login } body updatedAt }
                      }
                    }
                  }
                  mergedPullRequests: pullRequests(
                    states: MERGED
                    first: 20
                    orderBy: { field: UPDATED_AT, direction: DESC }
                  ) {
                    nodes {
                      number
                      mergedAt
                      firstComments: comments(first: 20) {
                        nodes { id author { login } body updatedAt }
                      }
                      lastComments: comments(last: 20) {
                        nodes { id author { login } body updatedAt }
                      }
                    }
                  }
                }
              }
            `;

            const controller = new AbortController();
            const timeoutId = setTimeout(() => controller.abort(), timeoutMs);
            let result;
            try {
              const response = await github.request('POST /graphql', {
                query,
                variables: { owner, repo },
                request: { signal: controller.signal },
              });
              if (response.data.errors?.length) {
                throw new Error(response.data.errors.map((error) => error.message).join('; '));
              }
              result = response.data.data;
            } catch (error) {
              emptyResult('failed', `Cross-PR checkpoint lookup failed; reviewing normally: ${error.message}`);
              return;
            } finally {
              clearTimeout(timeoutId);
            }

            const mergedCutoff = Date.now() - (14 * 24 * 60 * 60 * 1000);
            const candidates = [
              ...(result.repository.openPullRequests.nodes || []),
              ...(result.repository.mergedPullRequests.nodes || []).filter(
                (pullRequest) => Date.parse(pullRequest.mergedAt || 0) >= mergedCutoff,
              ),
            ].filter((pullRequest) => Number(pullRequest.number) !== currentPrNumber);

            const reviewedCommitShas = new Set();
            const sourcePullRequests = new Set();
            const legacyCheckpoints = [];

            for (const pullRequest of candidates) {
              const commentsById = new Map();
              for (const comment of [
                ...(pullRequest.firstComments?.nodes || []),
                ...(pullRequest.lastComments?.nodes || []),
              ]) {
                commentsById.set(comment.id, comment);
              }

              const checkpoints = [];
              for (const comment of commentsById.values()) {
                if (!trustedBotLogins.has(comment.author?.login)) continue;

                markerPattern.lastIndex = 0;
                let match;
                while ((match = markerPattern.exec(comment.body || '')) !== null) {
                  try {
                    const checkpoint = JSON.parse(match[1].trim());
                    if (
                      [1, 2].includes(checkpoint.version) &&
                      checkpoint.repository === nameWithOwner &&
                      Number(checkpoint.pull_request) === Number(pullRequest.number) &&
                      shaPattern.test(checkpoint.base_sha || '') &&
                      shaPattern.test(checkpoint.head_sha || '')
                    ) {
                      checkpoints.push(checkpoint);
                    }
                  } catch (error) {
                    core.warning(`Ignoring invalid cross-PR checkpoint in comment ${comment.id}: ${error.message}`);
                  }
                }
              }

              checkpoints.sort(
                (left, right) => Date.parse(right.reviewed_at || 0) - Date.parse(left.reviewed_at || 0),
              );
              const checkpoint = checkpoints[0];
              if (!checkpoint) continue;

              if (checkpoint.version === 1) {
                legacyCheckpoints.push({
                  base_sha: checkpoint.base_sha.toLowerCase(),
                  head_sha: checkpoint.head_sha.toLowerCase(),
                  pull_request: Number(pullRequest.number),
                });
                continue;
              }

              if (!Array.isArray(checkpoint.reviewed_patch_ids)) continue;
              for (const patchId of checkpoint.reviewed_patch_ids) {
                const commitShas = currentPatchCommits.get(String(patchId).toLowerCase()) || [];
                for (const commitSha of commitShas) {
                  reviewedCommitShas.add(commitSha);
                  sourcePullRequests.add(Number(pullRequest.number));
                }
              }
            }

            core.setOutput('reviewed_commit_shas', JSON.stringify([...reviewedCommitShas]));
            core.setOutput('source_pull_requests', JSON.stringify([...sourcePullRequests].sort((a, b) => a - b)));
            core.setOutput('legacy_checkpoints', JSON.stringify(legacyCheckpoints));
            core.setOutput('matched_patch_count', String(reviewedCommitShas.size));
            const lookupMessage = (
              reviewedCommitShas.size
                ? `Matched ${reviewedCommitShas.size} reviewed patches from PRs ${[...sourcePullRequests].join(', ')}.`
                : 'No matching version-2 patch fingerprints were found in related pull requests.'
            );
            core.setOutput('lookup_status', reviewedCommitShas.size ? 'matched' : 'no-match');
            core.setOutput('lookup_message', lookupMessage);
            core.info(lookupMessage);

      - name: Resolve review scope
        id: review_scope
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          LAST_REVIEWED_SHA: ${{ steps.previous_review.outputs.head_sha }}
          LAST_REVIEWED_AT: ${{ steps.previous_review.outputs.reviewed_at }}
          LAST_REVIEW_SOURCE: ${{ steps.previous_review.outputs.source }}
          CURRENT_MERGE_BASE: ${{ steps.current_patches.outputs.merge_base }}
          RELATED_REVIEWED_SHAS_JSON: ${{ steps.related_reviews.outputs.reviewed_commit_shas }}
          RELATED_REVIEW_SOURCE_PRS: ${{ steps.related_reviews.outputs.source_pull_requests }}
          RELATED_LEGACY_CHECKPOINTS: ${{ steps.related_reviews.outputs.legacy_checkpoints }}
          RELATED_LOOKUP_STATUS: ${{ steps.related_reviews.outputs.lookup_status }}
          RELATED_LOOKUP_MESSAGE: ${{ steps.related_reviews.outputs.lookup_message }}
        run: |
          full_pr_range="$BASE_SHA...$HEAD_SHA"
          mode="full-pr"
          diff_range="$full_pr_range"
          scope_start_sha="$CURRENT_MERGE_BASE"
          scope_description="Review the full pull request diff: $full_pr_range."
          last_review_note="No previous trusted Claude review checkpoint was found."

          if [[ -n "$LAST_REVIEWED_SHA" ]]; then
            if git cat-file -e "$LAST_REVIEWED_SHA^{commit}" 2>/dev/null && git merge-base --is-ancestor "$LAST_REVIEWED_SHA" "$HEAD_SHA"; then
              mode="since-last-claude-review"
              diff_range="$LAST_REVIEWED_SHA..$HEAD_SHA"
              scope_start_sha="$LAST_REVIEWED_SHA"
              scope_description="Review current PR changes not checked since Claude last reviewed commit $LAST_REVIEWED_SHA. Use $full_pr_range as the current full PR diff and ignore base-only branch update changes."
              last_review_note="Last trusted Claude checkpoint: $LAST_REVIEWED_SHA from $LAST_REVIEW_SOURCE."
            else
              echo "::warning::Previous Claude checkpoint $LAST_REVIEWED_SHA is not available on the current PR branch. Reviewing the full PR diff instead."
              last_review_note="Previous trusted Claude checkpoint $LAST_REVIEWED_SHA from $LAST_REVIEW_SOURCE is not available on this branch, so the workflow fell back to the full PR diff."
            fi
          elif [[ -n "$LAST_REVIEWED_AT" ]]; then
            checkpoint_sha="$(git rev-list -n 1 --before="$LAST_REVIEWED_AT" "$HEAD_SHA" 2>/dev/null || true)"
            if [[ -n "$checkpoint_sha" ]] && git merge-base --is-ancestor "$checkpoint_sha" "$HEAD_SHA"; then
              mode="since-last-claude-comment"
              diff_range="$checkpoint_sha..$HEAD_SHA"
              scope_start_sha="$checkpoint_sha"
              scope_description="Review current PR changes not checked since the latest trusted Claude bot comment at $LAST_REVIEWED_AT. Use $full_pr_range as the current full PR diff and ignore base-only branch update changes."
              last_review_note="No checkpoint marker existed. Approximated the last reviewed commit as $checkpoint_sha from trusted Claude bot comment time $LAST_REVIEWED_AT."
            else
              echo "::warning::Could not map the latest trusted Claude bot comment at $LAST_REVIEWED_AT to a commit. Reviewing the full PR diff instead."
              last_review_note="A trusted Claude bot comment existed at $LAST_REVIEWED_AT, but it could not be mapped to a commit, so the workflow fell back to the full PR diff."
            fi
          fi

          related_reviewed_index="$RUNNER_TEMP/related-reviewed-shas.txt"
          : > "$related_reviewed_index"
          jq -r '.[] | select(test("^[a-f0-9]{40}$"))' <<< "${RELATED_REVIEWED_SHAS_JSON:-[]}" >> "$related_reviewed_index"

          source_pr_index="$RUNNER_TEMP/related-review-source-prs.txt"
          : > "$source_pr_index"
          jq -r '.[]' <<< "${RELATED_REVIEW_SOURCE_PRS:-[]}" >> "$source_pr_index"

          while IFS=$'\t' read -r legacy_base legacy_head legacy_pr; do
            if
              [[ "$legacy_base" =~ ^[a-f0-9]{40}$ ]] &&
              [[ "$legacy_head" =~ ^[a-f0-9]{40}$ ]] &&
              [[ "$legacy_pr" =~ ^[0-9]+$ ]] &&
              git cat-file -e "$legacy_base^{commit}" 2>/dev/null &&
              git cat-file -e "$legacy_head^{commit}" 2>/dev/null &&
              git merge-base --is-ancestor "$legacy_base" "$scope_start_sha" &&
              git merge-base --is-ancestor "$scope_start_sha" "$legacy_head" &&
              git merge-base --is-ancestor "$legacy_head" "$HEAD_SHA"
            then
              git rev-list "$scope_start_sha..$legacy_head" >> "$related_reviewed_index"
              echo "$legacy_pr" >> "$source_pr_index"
            fi
          done < <(
            jq -r '.[] | [.base_sha, .head_sha, (.pull_request | tostring)] | @tsv' <<< "${RELATED_LEGACY_CHECKPOINTS:-[]}"
          )

          source_prs="$(
            sort -nu "$source_pr_index" |
              jq -Rrsc 'split("\n") | map(select(length > 0) | tonumber) | unique | map("#" + tostring) | join(", ")'
          )"
          sort -u -o "$related_reviewed_index" "$related_reviewed_index"

          reviewed_commits=()
          unreviewed_commits=()
          while read -r commit_sha; do
            if grep -Fxq "$commit_sha" "$related_reviewed_index"; then
              reviewed_commits+=("$commit_sha")
            else
              unreviewed_commits+=("$commit_sha")
            fi
          done < <(git rev-list --reverse "$scope_start_sha..$HEAD_SHA")

          reviewed_commit_shas="${reviewed_commits[*]}"
          unreviewed_commit_shas="${unreviewed_commits[*]}"

          if (( ${#reviewed_commits[@]} > 0 )); then
            mode="cross-pr-deduplicated"
            scope_description="Review only these unreviewed commits: ${unreviewed_commit_shas:-none}. Treat commits already reviewed in ${source_prs:-related pull requests} as context only and do not repeat their findings."
            last_review_note="$last_review_note Cross-PR reviewed commits: $reviewed_commit_shas from ${source_prs:-related pull requests}."
            echo "::notice title=Cross-PR review deduplication::Skipped ${#reviewed_commits[@]} already-reviewed commit(s) from ${source_prs:-related pull requests}; ${#unreviewed_commits[@]} commit(s) remain for review."
          fi

          {
            echo "### Cross-PR review deduplication"
            if (( ${#reviewed_commits[@]} > 0 )); then
              echo "- Result: skipped ${#reviewed_commits[@]} already-reviewed commit(s); ${#unreviewed_commits[@]} remain for review."
              echo "- Source PRs: ${source_prs:-unknown}"
              echo "- Skipped commits: $reviewed_commit_shas"
              echo "- Remaining commits: ${unreviewed_commit_shas:-none}"
            elif [[ "$RELATED_LOOKUP_STATUS" == "failed" ]]; then
              echo "- Result: lookup failed; retained the normal review scope."
              echo "- Details: ${RELATED_LOOKUP_MESSAGE:-unknown failure}"
            elif [[ "$RELATED_LOOKUP_STATUS" == "no-patches" ]]; then
              echo "- Result: the current PR has no patch fingerprints to compare."
            else
              echo "- Result: no previously reviewed patches apply to the active review scope."
            fi
          } >> "$GITHUB_STEP_SUMMARY"

          {
            echo "mode=$mode"
            echo "diff_range=$diff_range"
            echo "full_pr_diff_range=$full_pr_range"
            echo "reviewed_commit_shas=$reviewed_commit_shas"
            echo "unreviewed_commit_shas=$unreviewed_commit_shas"
            echo "related_review_source_prs=$source_prs"
            echo "scope_description<<EOF"
            echo "$scope_description"
            echo "EOF"
            echo "last_review_note<<EOF"
            echo "$last_review_note"
            echo "EOF"
          } >> "$GITHUB_OUTPUT"

      - name: Checkout Simple Analytics context
        id: checkout_context
        env:
          CONTEXT_REPOSITORIES: ${{ inputs.context_repositories }}
          CONTEXT_CLONE_CONCURRENCY: ${{ inputs.context_clone_concurrency }}
          CURRENT_REPOSITORY: ${{ github.repository }}
          READ_TOKEN: ${{ secrets.SA_PAT_ADRIAAN_READ_REPOS }}
        run: |
          context_dir="$RUNNER_TEMP/simpleanalytics-context"
          echo "context_dir=$context_dir" >> "$GITHUB_OUTPUT"
          mkdir -p "$context_dir"
          status_dir="$RUNNER_TEMP/simpleanalytics-context-status"
          rm -rf "$status_dir"
          mkdir -p "$status_dir"

          if [[ -z "$READ_TOKEN" ]]; then
            message="SA_PAT_ADRIAAN_READ_REPOS is not set. Continuing with current-repo context only. Add this repo or org secret from 1Password by searching for SA_PAT_ADRIAAN_READ_REPOS."
            echo "::warning::$message"
            {
              echo "### Cross-repo context"
              echo "$message"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          export GIT_TERMINAL_PROMPT=0

          askpass="$RUNNER_TEMP/simpleanalytics-git-askpass.sh"
          cat > "$askpass" <<'EOF'
          #!/usr/bin/env bash
          case "$1" in
            *Username*) echo "x-access-token" ;;
            *Password*) echo "$READ_TOKEN" ;;
            *) echo "" ;;
          esac
          EOF
          chmod 700 "$askpass"
          export GIT_ASKPASS="$askpass"

          github_api_status() {
            local url="$1"
            local output="$2"

            curl --retry 2 --retry-delay 1 --connect-timeout 5 --max-time 20 --silent --show-error \
              --output "$output" \
              --write-out "%{http_code}" \
              --header "Authorization: Bearer $READ_TOKEN" \
              --header "Accept: application/vnd.github+json" \
              --header "X-GitHub-Api-Version: 2022-11-28" \
              "$url" || true
          }

          token_status="$(github_api_status "https://api.github.com/user" "$status_dir/token-user.json")"
          if [[ "$token_status" != "200" ]]; then
            message="SA_PAT_ADRIAAN_READ_REPOS is set, but GitHub rejected it or it is not authorized for API access (HTTP ${token_status:-000}). Continuing with current-repo context only. Update the secret from 1Password, authorize it for the Simple Analytics organization if SSO is required, and grant read access to repository contents."
            echo "::warning::$message"
            {
              echo "### Cross-repo context"
              echo "$message"
            } >> "$GITHUB_STEP_SUMMARY"
            exit 0
          fi

          clone_concurrency="$CONTEXT_CLONE_CONCURRENCY"
          if ! [[ "$clone_concurrency" =~ ^[0-9]+$ ]] || [[ "$clone_concurrency" -lt 1 ]]; then
            clone_concurrency=8
          fi

          diagnose_repo_access() {
            local repo="$1"
            local safe_name="$2"
            local repo_status contents_status

            repo_status="$(github_api_status "https://api.github.com/repos/$repo" "$status_dir/$safe_name.repo.json")"

            case "$repo_status" in
              200)
                contents_status="$(github_api_status "https://api.github.com/repos/$repo/contents" "$status_dir/$safe_name.contents.json")"
                if [[ "$contents_status" == "200" ]]; then
                  echo "SA_PAT_ADRIAAN_READ_REPOS can read this repo via the API, but git clone failed. Confirm the token is authorized for SSO and that checkout credentials are not overriding the read token."
                else
                  echo "SA_PAT_ADRIAAN_READ_REPOS can see this repo, but cannot read repository contents via the API (HTTP ${contents_status:-000}). For a fine-grained PAT, add this repository and grant Contents: Read."
                fi
                ;;
              401)
                echo "SA_PAT_ADRIAAN_READ_REPOS was rejected by GitHub (HTTP 401). Update the secret from 1Password; the token is likely expired, revoked, or invalid."
                ;;
              403)
                echo "SA_PAT_ADRIAAN_READ_REPOS is forbidden from this repo (HTTP 403). Authorize the token for the Simple Analytics organization if SSO is required, add this repository to the token, and grant Contents: Read."
                ;;
              404)
                echo "SA_PAT_ADRIAAN_READ_REPOS cannot see this repo (HTTP 404). Add this repository to the token's selected repositories, grant Contents: Read, or verify the repo name still exists."
                ;;
              *)
                echo "Could not verify SA_PAT_ADRIAAN_READ_REPOS access for this repo via the GitHub API (HTTP ${repo_status:-000}). Check token validity, organization SSO authorization, and network/API availability."
                ;;
            esac
          }

          clone_repo() {
            local repo="$1"
            local safe_name="${repo//\//__}"
            local owner="${repo%%/*}"
            local name="${repo#*/}"
            local target="$context_dir/$owner/$name"
            local log_file="$status_dir/$safe_name.log"
            local diagnosis

            mkdir -p "$(dirname "$target")"

            if (
              cd "$RUNNER_TEMP"
              git -c "http.https://github.com/.extraheader=" -c credential.helper= clone --depth=1 --filter=blob:none "https://github.com/$repo.git" "$target"
            ) >"$log_file" 2>&1; then
              echo "$repo" > "$status_dir/$safe_name.ok"
              printf 'Cloned %s\n' "$repo"
            else
              diagnosis="$(diagnose_repo_access "$repo" "$safe_name")"
              printf '%s\t%s\n' "$repo" "$diagnosis" > "$status_dir/$safe_name.fail"
              cat "$log_file"
              echo "::warning::Could not clone $repo for Claude context. Continuing without it. $diagnosis"
              rm -rf "$target"
            fi
          }

          while IFS= read -r raw_repo; do
            repo="${raw_repo%%#*}"
            repo="$(printf '%s' "$repo" | xargs)"

            if [[ -z "$repo" || "$repo" == "$CURRENT_REPOSITORY" ]]; then
              continue
            fi

            clone_repo "$repo" &

            while [[ "$(jobs -rp | wc -l | xargs)" -ge "$clone_concurrency" ]]; do
              wait -n || true
            done
          done <<< "$CONTEXT_REPOSITORIES"

          wait || true

          cloned="$(find "$status_dir" -name '*.ok' -type f | wc -l | xargs)"
          failed="$(find "$status_dir" -name '*.fail' -type f | wc -l | xargs)"

          {
            echo "### Cross-repo context"
            echo "Cloned $cloned repositories into \`$context_dir\` with concurrency $clone_concurrency."
            if [[ "$failed" != "0" ]]; then
              echo ""
              echo "$failed repositories could not be cloned. The review continued without them."
              echo ""
              find "$status_dir" -name '*.fail' -type f | sort | while IFS=$'\t' read -r repo diagnosis; do
                echo "- \`$repo\`: $diagnosis"
              done
            fi
          } >> "$GITHUB_STEP_SUMMARY"

      - name: Capture existing linked issue
        id: existing_issue
        uses: actions/github-script@v9
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const nameWithOwner = `${owner}/${repo}`;
            const prNumber = context.payload.pull_request.number;
            const refs = [];

            function addBodyRefs(body) {
              const pattern = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+((?:[\w.-]+\/[\w.-]+)?#\d+)/gi;
              let match;

              while ((match = pattern.exec(body || '')) !== null) {
                refs.push(match[1]);
              }
            }

            const { data: pullRequest } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: prNumber,
            });
            addBodyRefs(pullRequest.body || '');

            try {
              const result = await github.graphql(`
                query($owner: String!, $repo: String!, $number: Int!) {
                  repository(owner: $owner, name: $repo) {
                    pullRequest(number: $number) {
                      closingIssuesReferences(first: 20) {
                        nodes {
                          number
                          repository {
                            nameWithOwner
                          }
                        }
                      }
                    }
                  }
                }
              `, { owner, repo, number: prNumber });

              for (const issue of result.repository.pullRequest.closingIssuesReferences.nodes) {
                refs.push(issue.repository.nameWithOwner === nameWithOwner
                  ? `#${issue.number}`
                  : `${issue.repository.nameWithOwner}#${issue.number}`);
              }
            } catch (error) {
              core.warning(`Could not capture closingIssuesReferences via GraphQL: ${error.message}`);
            }

            const issueRef = refs.find(Boolean) || '';
            core.setOutput('ref', issueRef);
            core.info(issueRef
              ? `Captured existing linked issue ${issueRef}.`
              : 'No existing linked issue was found.');

      - name: Classify PR description provenance
        id: description_provenance
        uses: actions/github-script@v9
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const prNumber = context.payload.pull_request.number;
            const capturedAt = new Date().toISOString();
            const workflowLogins = new Set(['github-actions', 'github-actions[bot]']);
            const knownAutomatedLogins = new Set([
              'claude',
              'claude[bot]',
              'github-actions',
              'github-actions[bot]',
              'simple-analytics-ai',
              'simple-analytics-ai[bot]',
            ]);

            function normalizedLogin(login) {
              return String(login || '').trim().toLowerCase();
            }

            function loginLooksAutomated(login) {
              const normalized = normalizedLogin(login);
              if (!normalized) return false;
              if (knownAutomatedLogins.has(normalized)) return true;
              return /(?:^|[-_])(ai|bot|chatgpt|claude|codex|openai)(?:$|[-_\[])/i.test(normalized);
            }

            function actorIsAutomated(actor) {
              const type = actor?.type || actor?.__typename || '';
              return type === 'Bot' || type === 'App' || loginLooksAutomated(actor?.login);
            }

            function actorIsHuman(actor) {
              const type = actor?.type || actor?.__typename || '';
              return type === 'User' && !loginLooksAutomated(actor?.login);
            }

            function identityTextLooksAutomated(...values) {
              const text = values.filter(Boolean).join(' ');
              return /\b(?:chatgpt|claude|codex|openai)\b|codex@simpleanalytics\.invalid|@anthropic\.com/i.test(text);
            }

            function bodyLooksAutomated(body) {
              return [
                /(?:generated|written|created)\s+(?:with|by)\s+(?:an?\s+)?(?:ai|chatgpt|claude|codex|openai)\b/i,
                /co-authored-by:\s*(?:chatgpt|claude|codex|openai)\b/i,
                /<!--\s*(?:ai|chatgpt|claude|codex|openai)[^>]*(?:generated|written|created)/i,
              ].some((pattern) => pattern.test(body || ''));
            }

            function commitLooksAutomated(commit) {
              return (
                actorIsAutomated(commit.author) ||
                actorIsAutomated(commit.committer) ||
                identityTextLooksAutomated(
                  commit.commit?.author?.name,
                  commit.commit?.author?.email,
                  commit.commit?.committer?.name,
                  commit.commit?.committer?.email,
                  commit.commit?.message
                )
              );
            }

            const { data: pullRequest } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: prNumber,
            });
            const body = pullRequest.body || '';
            const edits = [];

            try {
              const result = await github.graphql(`
                query($owner: String!, $repo: String!, $number: Int!) {
                  repository(owner: $owner, name: $repo) {
                    pullRequest(number: $number) {
                      userContentEdits(first: 100) {
                        nodes {
                          editedAt
                          editor {
                            __typename
                            login
                          }
                        }
                      }
                    }
                  }
                }
              `, { owner, repo, number: prNumber });

              edits.push(...(result.repository.pullRequest.userContentEdits.nodes || []));
            } catch (error) {
              core.warning(`Could not inspect PR description edit history: ${error.message}`);
            }

            edits.sort((left, right) => new Date(right.editedAt) - new Date(left.editedAt));

            const commits = await github.paginate(github.rest.pulls.listCommits, {
              owner,
              repo,
              pull_number: prNumber,
              per_page: 100,
            });
            const automatedCommits = commits.filter(commitLooksAutomated);
            const humanEdit = edits.find((edit) => actorIsHuman(edit.editor));
            const latestNonWorkflowEdit = edits.find((edit) =>
              edit.editor && !workflowLogins.has(normalizedLogin(edit.editor.login))
            );
            const pullRequestAuthor = pullRequest.user;
            const automatedBranch = /^(?:ai|bot|chatgpt|claude|codex)[\/-]/i.test(pullRequest.head?.ref || '');
            const explicitBodySignal = bodyLooksAutomated(body);
            const workflowBodySignal = body.includes('<!-- simpleanalytics:changes-start -->');

            let kind = 'human';
            let reason = 'No reliable automation signal was found; preserving the description as human-authored.';

            if (humanEdit) {
              reason = `A human (${humanEdit.editor.login}) edited the description; human content takes precedence over every automation signal.`;
            } else if (latestNonWorkflowEdit && actorIsAutomated(latestNonWorkflowEdit.editor)) {
              kind = 'automated';
              reason = `The latest substantive description editor is automated (${latestNonWorkflowEdit.editor.login}).`;
            } else if (explicitBodySignal) {
              kind = 'automated';
              reason = 'The description contains an explicit AI-generation marker.';
            } else if (actorIsHuman(pullRequestAuthor)) {
              reason = `The pull request author is human (${pullRequestAuthor.login}) and no direct description signal indicates automation.`;
            } else if (actorIsAutomated(pullRequestAuthor)) {
              kind = 'automated';
              reason = `The pull request author is automated (${pullRequestAuthor.login}).`;
            } else if (commits.length > 0 && automatedCommits.length === commits.length) {
              kind = 'automated';
              reason = 'Every pull request commit has an automated author, committer, or AI attribution.';
            } else if (automatedBranch && automatedCommits.length > 0) {
              kind = 'automated';
              reason = 'The agent branch name and commit attribution both indicate automation.';
            } else if (workflowBodySignal && automatedCommits.length > 0) {
              kind = 'automated';
              reason = 'The workflow-managed description marker and commit attribution both indicate automation.';
            }

            core.setOutput('kind', kind);
            core.setOutput('reason', reason);
            core.setOutput('body_base64', Buffer.from(body, 'utf8').toString('base64'));
            core.setOutput('captured_at', capturedAt);
            core.info(`Classified the existing PR description as ${kind}: ${reason}`);

      - name: Capture existing SDLC label
        id: existing_sdlc_label
        uses: actions/github-script@v9
        with:
          script: |
            const { data: issue } = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.payload.pull_request.number,
            });
            const labels = issue.labels.map((label) => typeof label === 'string' ? label : label.name);
            const existingLabel = ['change: needs review', 'change: routine'].find((label) => labels.includes(label)) || '';
            core.setOutput('label', existingLabel);

      - name: Run Claude PR review
        id: claude
        uses: anthropics/claude-code-action@v1
        env:
          GH_TOKEN: ${{ github.token }}
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ github.token }}
          track_progress: false
          use_sticky_comment: false
          include_fix_links: true
          allowed_bots: ${{ inputs.claude_allowed_bots }}
          additional_permissions: |
            actions: read
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            PR URL: ${{ github.event.pull_request.html_url }}
            INTERNAL APP: ${{ inputs.internal_app }}
            REVIEW MODE: ${{ steps.review_scope.outputs.mode }}
            REVIEW RANGE: ${{ steps.review_scope.outputs.diff_range }}
            FULL PR RANGE: ${{ steps.review_scope.outputs.full_pr_diff_range }}
            REVIEW SCOPE: ${{ steps.review_scope.outputs.scope_description }}
            LAST REVIEW: ${{ steps.review_scope.outputs.last_review_note }}
            CROSS-PR REVIEWED COMMITS: ${{ steps.review_scope.outputs.reviewed_commit_shas }}
            UNREVIEWED COMMITS: ${{ steps.review_scope.outputs.unreviewed_commit_shas }}
            RELATED REVIEWED PRS: ${{ steps.review_scope.outputs.related_review_source_prs }}
            CROSS-REPO CONTEXT DIR: ${{ steps.checkout_context.outputs.context_dir }}
            EXISTING LINKED ISSUE: ${{ steps.existing_issue.outputs.ref }}
            EXISTING SDLC LABEL: ${{ steps.existing_sdlc_label.outputs.label }}
            PR DESCRIPTION PROVENANCE: ${{ steps.description_provenance.outputs.kind }}
            PR DESCRIPTION PROVENANCE REASON: ${{ steps.description_provenance.outputs.reason }}

            Review this pull request for security vulnerabilities, privacy risks, correctness bugs, data loss, runtime/deployment failures, and high-confidence regressions.

            Scope rules:
            - For full-pr mode, review the full PR diff.
            - For since-last-claude-review and since-last-claude-comment mode, focus findings on current PR changes that were not checked after the last trusted Claude review checkpoint.
            - For cross-pr-deduplicated mode, review only UNREVIEWED COMMITS with `git show`. Treat CROSS-PR REVIEWED COMMITS as context only; do not report code or documentation findings solely from those commits unless an unreviewed commit materially changes their behavior.
            - If cross-pr-deduplicated mode has no UNREVIEWED COMMITS, do not post code or documentation findings; only return any required SDLC assessment through structured output.
            - REVIEW RANGE may include base branch update commits. Use FULL PR RANGE as the current pull request diff and do not report base-only branch update changes.
            - Do not report issues that already existed before the last trusted Claude review checkpoint unless they are critical, exploitable, or made materially worse by the new commits.
            - For SDLC label classification, consider the full pull request, not only the incremental range.
            - Use local git commands such as `git diff ${{ steps.review_scope.outputs.diff_range }}` and `git diff ${{ steps.review_scope.outputs.full_pr_diff_range }}` when helpful.
            - You may inspect read-only cross-repo context under `${{ steps.checkout_context.outputs.context_dir }}`. Do not edit files there.

            Documentation review rules:
            - When the pull request changes a user-facing feature, workflow, setting, integration, API, or other documented behavior, inspect the read-only documentation repository at `${{ steps.checkout_context.outputs.context_dir }}/simpleanalytics/docs`.
            - If documentation is missing or outdated, add exactly one top-level PR comment using the template below.
            - Replace every placeholder and do not add text before or after the template.
            - Repeat the file block when multiple documentation files need changes.
            - Do not post documentation feedback inline or repeat it elsewhere.
            - Do not edit the documentation repository or request docs changes for internal-only behavior.

            Documentation comment template:
            ## Documentation update

            ### [`<docs-file-path>`](https://github.com/simpleanalytics/docs/blob/master/<docs-file-path>)

            **Location:** `<heading or exact place where the text belongs>`

            Copy and paste this into the documentation repository:

            ```md
            <complete, ready-to-paste documentation text>
            ```

            SDLC label rules:
            - If EXISTING SDLC LABEL is non-empty, treat it as authoritative. Do not reassess, change, remove, or comment on it; return empty strings for `sdlc_label` and `sdlc_reason`.
            - Otherwise, return exactly one of `change: needs review` or `change: routine` in `sdlc_label` and a short reason in `sdlc_reason`, without the label prefix or "because".
            - Never apply labels or post an SDLC label message yourself, including in review comments or summaries. The workflow preserves existing labels and posts a reason only when neither an SDLC label nor an earlier SDLC message exists.
            - Start with `change: routine`. Use `change: needs review` only when the full PR diff establishes at least one concrete, material impact listed below.
            - Use `change: needs review` for a material change to:
              - who can access customer, user, or sensitive data, or how that data is collected, exposed, shared, transferred, deleted, or retained;
              - authentication, authorization, permissions, privacy controls, or security boundaries;
              - prices, charges, invoices, subscriptions, or other billing behavior;
              - database schemas, data migrations, or destructive or bulk data operations;
              - production infrastructure, routing, certificates, secrets, deployment safety, or rollback behavior;
              - concurrency, queues, storage, retries, or reliability where the diff creates a credible outage, data-loss, or corruption risk; or
              - account or team deletion, data exports or transfers, or similarly critical system functionality.
            - Use `change: routine` for all other changes, including ordinary product features and bug fixes, UI or display settings, copy or terminology, design, content, refactors, tests, documentation, developer tooling, and dependency maintenance that do not materially change one of the risks above.
            - Routine examples include relabeling an existing analytics field without changing its collection or storage, and adding view display settings while preserving existing authorization and data-lifecycle boundaries.
            - Needs-review examples include changing tenant or JWT authorization scope, account deletion behavior, bulk data migrations, billing calculations, or production certificate and routing behavior.
            - Merely touching production code, changing user-visible behavior, or mentioning customers, users, data, security, or privacy is not enough to require review.
            - If INTERNAL APP is true and the PR does not touch customer/user data, security, privacy, or critical functionality, use `change: routine`.
            - If the evidence is uncertain or no concrete material impact can be named, use `change: routine`.

            PR description rules:
            - If EXISTING SDLC LABEL or your new assessment is `change: needs review`, update PR #${{ github.event.pull_request.number }} with the Simple Analytics PR template before finishing. Use `gh pr edit`.
            - Read the current PR description and commit messages before updating the body.
            - The workflow classified the existing body as `PR DESCRIPTION PROVENANCE`. Follow that classification even when the PR author, branch, or commits have different provenance.
            - For a `human` description, treat every existing word as authoritative. Preserve its wording, order, headings, subheadings, images, attachment links, links, notes, and custom sections. Only add a missing required heading or minimally normalize the required `Security implications` and `Checklist` formats.
            - For an `automated` description, treat the existing text as source material. Rewrite weak, generated, placeholder, or non-template text into the required template while retaining useful concrete facts.
            - Never delete an existing Markdown image, HTML image, GitHub attachment, or media link, regardless of provenance.
            - The required headings are `Summary`, `Security implications`, `Testing`, and `Checklist`. Additional human-written headings and subheadings are allowed and must remain untouched.
            - `Summary` must describe what changed and why in concrete terms. Do not rewrite an existing human-written summary.
            - `Security implications` must be exactly one of these forms:
              - `No security impact`
              - `Has security impact - described as: <specific impact>`
            - Use `No security impact` only when you are confident the PR does not affect security, privacy, permissions, customer/user data, billing, infrastructure, production behavior, system stability, or critical functionality.
            - Preserve human-written testing notes word for word. For an automated description, `Testing` must include commands/checks you personally ran during this workflow and their result. If you did not run validation, write `Not run by Claude.`.
            - `Checklist` may contain only these workflow-created items: `Linked to an issue`, `Tested`, and `Asked for a review`. Never invent or append another checklist item. Preserve extra checklist items only when they were already present in a human-written description.
            - If EXISTING LINKED ISSUE is non-empty, preserve exactly one `Closes EXISTING LINKED ISSUE` line. Otherwise, do not add a `Closes ...` reference; the workflow adds one after creating the issue.

            Issue description rules:
            - The issue description is a separate writing task from the PR description. Do not copy or adapt the PR `Summary`.
            - If EXISTING SDLC LABEL or your new assessment is `change: needs review` and EXISTING LINKED ISSUE is empty, return an issue draft through the structured output fields.
            - `issue_title` must describe the unresolved problem. Do not prefix it with `Track:` and do not refer to the pull request.
            - `issue_problem` must describe the current problem, symptoms, impact, and useful known context in present tense. Do not claim that anything was fixed, changed, added, or implemented, and do not refer to a PR.
            - `issue_suggested_changes` must contain concise proposed outcomes, investigation areas, or requirements. Treat them as suggestions, not completed work or an exact implementation.
            - Do not include Markdown section headings in the structured fields and do not prefix suggested-change entries with bullets; the workflow adds the issue formatting.
            - If EXISTING SDLC LABEL or your new assessment is `change: routine`, or EXISTING LINKED ISSUE is non-empty, return empty strings and an empty array for the issue draft fields.

            Review comments and fixes:
            - Report actionable bugs, security or privacy risks, edge cases, regressions, maintainability issues, and useful nitpicks. Ignore formatter/linter output, preference-only feedback, and low-confidence concerns.
            - Verify findings by tracing relevant code and callers and, when practical, with a focused test or temporary local patch. Leave the working tree unchanged.
            - Keep each finding's prose to one or two sentences: the concrete impact and smallest fix. Assume an experienced developer and group repeated instances.
            - Prefer an inline comment on the narrowest relevant changed lines. Use at most one general top-level comment for unanchorable findings. A required documentation update uses its separate exact template comment.
            - Check existing Claude comments first. Never repeat an unchanged finding or documentation update, or summarize inline findings in the top-level comment.
            - Do not add generic praise, long summaries, or explanations of basic concepts.
            - Do not narrate the review process or validation. Never post `No documentation update needed`, `No actionable issues found`, `No code findings`, or equivalent status or absence text.
            - For fixes that fit in at most three small replacements, add complete GitHub `suggestion` blocks instead of changing the branch.
            - For a larger fix, leave one concise finding for the built-in `Fix this` link and include: `Create a separate branch from the current PR head, commit and push only that branch, and return its link so it can be merged into the current PR branch. Do not open a pull request.`
            - Do not create branches, commits, or pull requests during this review workflow.
            - If there are no findings or documentation update, do not post review text.
            - If validation fails or you cannot safely validate, say that plainly without long reasoning.
            - Do not create tracking issues. The workflow handles linked issue creation and final checklist enforcement after labels are finalized.
            - Your final response must satisfy the configured JSON schema. Use it for the SDLC assessment and separate issue draft fields; continue to post review findings through the normal GitHub review tools.

            Extra repository instructions:
            ${{ inputs.claude_extra_prompt }}
          claude_args: |
            --model ${{ inputs.claude_model }}
            --allowedTools "Agent,AskUserQuestion,Bash,Glob,Grep,LS,Read,Edit,MultiEdit,Write,NotebookRead,NotebookEdit,TodoRead,TodoWrite,Skill,WebFetch,WebSearch,mcp__github__*,mcp__github_inline_comment__*,mcp__github_ci__*"
            --json-schema '{"type":"object","properties":{"sdlc_label":{"type":"string","enum":["","change: routine","change: needs review"]},"sdlc_reason":{"type":"string"},"issue_title":{"type":"string"},"issue_problem":{"type":"string"},"issue_suggested_changes":{"type":"array","items":{"type":"string"}}},"required":["sdlc_label","sdlc_reason","issue_title","issue_problem","issue_suggested_changes"],"additionalProperties":false}'

      - name: Resolve reviewed HEAD
        id: reviewed_head
        run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Record Claude review checkpoint
        uses: actions/github-script@v9
        env:
          REVIEWED_HEAD_SHA: ${{ steps.reviewed_head.outputs.sha }}
          REVIEW_SCOPE_MODE: ${{ steps.review_scope.outputs.mode }}
          REVIEW_RANGE: ${{ steps.review_scope.outputs.diff_range }}
          FULL_PR_RANGE: ${{ steps.review_scope.outputs.full_pr_diff_range }}
          CURRENT_PATCHES_JSON: ${{ steps.current_patches.outputs.patches_json }}
        with:
          script: |
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const nameWithOwner = `${owner}/${repo}`;
            const issueNumber = context.payload.pull_request.number;
            const reviewedHeadSha = process.env.REVIEWED_HEAD_SHA;
            const trustedBotLogin = 'github-actions[bot]';
            const markerName = 'simpleanalytics-claude-pr-review-checkpoint';
            const standaloneName = 'simpleanalytics-claude-pr-review-checkpoint-comment';
            const markerPattern = /<!--\s*simpleanalytics-claude-pr-review-checkpoint\s+([\s\S]*?)\s*-->/;
            const markerGlobalPattern = /<!--\s*simpleanalytics-claude-pr-review-checkpoint\s+[\s\S]*?\s*-->/g;

            if (!/^[a-f0-9]{40}$/i.test(reviewedHeadSha || '')) {
              throw new Error(`Cannot record Claude review checkpoint; invalid reviewed head SHA: ${reviewedHeadSha}`);
            }

            let currentPatches;
            try {
              currentPatches = JSON.parse(process.env.CURRENT_PATCHES_JSON || '[]');
            } catch (error) {
              throw new Error(`Cannot record Claude review checkpoint; invalid patch index: ${error.message}`);
            }

            const reviewedPatchIds = [...new Set(
              currentPatches
                .map((entry) => String(entry.patch_id || '').toLowerCase())
                .filter((patchId) => /^[a-f0-9]{40}$/.test(patchId)),
            )].slice(-500);

            const checkpoint = {
              version: 2,
              repository: nameWithOwner,
              pull_request: issueNumber,
              head_sha: reviewedHeadSha,
              base_sha: context.payload.pull_request.base.sha,
              review_mode: process.env.REVIEW_SCOPE_MODE,
              review_range: process.env.REVIEW_RANGE,
              full_pr_range: process.env.FULL_PR_RANGE,
              reviewed_patch_ids: reviewedPatchIds,
              reviewed_at: new Date().toISOString(),
              workflow_run_id: String(context.runId),
              workflow_run_attempt: String(context.runAttempt),
            };

            const marker = [
              `<!-- ${markerName}`,
              JSON.stringify(checkpoint, null, 2),
              '-->',
            ].join('\n');

            function checkpointBody() {
              return [
                `<details><summary>Claude review checkpoint</summary>`,
                '',
                `Reviewed commit \`${reviewedHeadSha}\`. This is used to keep later automated reviews focused on changes Claude has not checked yet.`,
                '',
                `<!-- ${standaloneName} -->`,
                marker,
                '',
                '</details>',
              ].join('\n');
            }

            function withMarker(body) {
              if (markerPattern.test(body || '')) {
                return body.replace(markerGlobalPattern, marker);
              }

              return `${(body || '').trim()}\n\n${marker}`.trim();
            }

            const comments = await github.paginate(github.rest.issues.listComments, {
              owner,
              repo,
              issue_number: issueNumber,
              per_page: 100,
            });

            const ownBotComments = comments.filter((comment) => comment.user?.login === trustedBotLogin);
            const newestFirst = (left, right) => new Date(right.updated_at || right.created_at) - new Date(left.updated_at || left.created_at);
            const standaloneCheckpoint = ownBotComments
              .filter((comment) => (comment.body || '').includes(`<!-- ${standaloneName} -->`))
              .sort(newestFirst)[0];
            const markedComment = ownBotComments
              .filter((comment) => markerPattern.test(comment.body || ''))
              .sort(newestFirst)[0];
            const claudeComment = ownBotComments
              .filter((comment) => /\bclaude\b/i.test(comment.body || ''))
              .sort(newestFirst)[0];

            const target = standaloneCheckpoint || markedComment || claudeComment;
            if (target) {
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: target.id,
                body: standaloneCheckpoint ? checkpointBody() : withMarker(target.body || ''),
              });
              core.info(`Updated Claude review checkpoint in comment ${target.id}.`);
            } else {
              const { data: comment } = await github.rest.issues.createComment({
                owner,
                repo,
                issue_number: issueNumber,
                body: checkpointBody(),
              });
              core.info(`Created Claude review checkpoint comment ${comment.id}.`);
            }

      - name: Finalize SDLC label
        id: sdlc_label
        uses: actions/github-script@v9
        env:
          EXISTING_SDLC_LABEL: ${{ steps.existing_sdlc_label.outputs.label }}
          CLAUDE_STRUCTURED_OUTPUT: ${{ steps.claude.outputs.structured_output }}
        with:
          script: |
            const needsReview = 'change: needs review';
            const routine = 'change: routine';
            const issueNumber = context.payload.pull_request.number;

            const { data: issue } = await github.rest.issues.get({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: issueNumber,
            });

            const labels = issue.labels.map((label) => typeof label === 'string' ? label : label.name);
            const currentLabel = [needsReview, routine].find((label) => labels.includes(label));
            const existingLabel = currentLabel || process.env.EXISTING_SDLC_LABEL;
            let assessment = {};
            try {
              assessment = JSON.parse(process.env.CLAUDE_STRUCTURED_OUTPUT || '{}') || {};
            } catch (error) {
              core.warning(`Could not read Claude's SDLC assessment: ${error.message}`);
            }
            const assessedLabel = [needsReview, routine].includes(assessment.sdlc_label) ? assessment.sdlc_label : '';
            const finalLabel = existingLabel || assessedLabel || routine;
            const reason = typeof assessment.sdlc_reason === 'string' ? assessment.sdlc_reason.trim() : '';
            let shouldComment = !existingLabel && Boolean(assessedLabel && reason);

            if (shouldComment) {
              const [comments, reviews] = await Promise.all([
                github.paginate(github.rest.issues.listComments, {
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  issue_number: issueNumber,
                  per_page: 100,
                }),
                github.paginate(github.rest.pulls.listReviews, {
                  owner: context.repo.owner,
                  repo: context.repo.repo,
                  pull_number: issueNumber,
                  per_page: 100,
                }),
              ]);
              shouldComment = ![...comments, ...reviews].some((message) => /\bSDLC label\s*:/i.test(message.body || ''));
            }

            if (!currentLabel) {
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issueNumber,
                labels: [finalLabel],
              });
            }

            if (shouldComment) {
              await github.rest.issues.createComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: issueNumber,
                body: `SDLC label: \`${finalLabel}\` because ${reason}`,
              });
            }

            core.setOutput('label', finalLabel);
            core.setOutput('requires_review', String(finalLabel === needsReview));

      - name: Enforce review-required PR template
        if: ${{ steps.sdlc_label.outputs.requires_review == 'true' }}
        uses: actions/github-script@v9
        env:
          EXISTING_ISSUE_REF: ${{ steps.existing_issue.outputs.ref }}
          CLAUDE_ISSUE_DRAFT: ${{ steps.claude.outputs.structured_output }}
          DESCRIPTION_PROVENANCE: ${{ steps.description_provenance.outputs.kind }}
          ORIGINAL_PR_BODY_BASE64: ${{ steps.description_provenance.outputs.body_base64 }}
          DESCRIPTION_CAPTURED_AT: ${{ steps.description_provenance.outputs.captured_at }}
        with:
          script: |
            const needsReview = 'change: needs review';
            const eventPullRequest = context.payload.pull_request;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const prNumber = eventPullRequest.number;
            const nameWithOwner = `${owner}/${repo}`;
            const changeSummaryStart = '<!-- simpleanalytics:changes-start -->';
            const changeSummaryEnd = '<!-- simpleanalytics:changes-end -->';

            const { data: pullRequest } = await github.rest.pulls.get({
              owner,
              repo,
              pull_number: prNumber,
            });

            async function closingIssueRefsFromGraphql() {
              try {
                const result = await github.graphql(`
                  query($owner: String!, $repo: String!, $number: Int!) {
                    repository(owner: $owner, name: $repo) {
                      pullRequest(number: $number) {
                        closingIssuesReferences(first: 20) {
                          nodes {
                            number
                            url
                            repository {
                              nameWithOwner
                            }
                          }
                        }
                      }
                    }
                  }
                `, { owner, repo, number: prNumber });

                return result.repository.pullRequest.closingIssuesReferences.nodes.map((issue) => ({
                  ref: issue.repository.nameWithOwner === nameWithOwner ? `#${issue.number}` : `${issue.repository.nameWithOwner}#${issue.number}`,
                  url: issue.url,
                }));
              } catch (error) {
                core.warning(`Could not read closingIssuesReferences via GraphQL: ${error.message}`);
                return [];
              }
            }

            function closingIssueRefsFromBody(body) {
              const refs = [];
              const pattern = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+((?:[\w.-]+\/[\w.-]+)?#\d+)/gi;
              let match;

              while ((match = pattern.exec(body || '')) !== null) {
                refs.push({ ref: match[1], url: '' });
              }

              return refs;
            }

            function uniqueRefs(refs) {
              const seen = new Set();
              return refs.filter((item) => {
                if (!item.ref || seen.has(item.ref)) return false;
                seen.add(item.ref);
                return true;
              });
            }

            function escapeRegExp(value) {
              return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
            }

            function findSection(body, title) {
              const headings = [...String(body || '').matchAll(/^##\s+(.+?)\s*$/gm)];
              const index = headings.findIndex((heading) => heading[1].trim().toLowerCase() === title.toLowerCase());
              if (index === -1) return null;

              const heading = headings[index];
              const headingStart = heading.index;
              const headingEnd = headingStart + heading[0].length;
              let contentStart = headingEnd;

              if (body.slice(contentStart, contentStart + 2) === '\r\n') contentStart += 2;
              else if (body[contentStart] === '\n') contentStart += 1;

              return {
                headingStart,
                contentStart,
                sectionEnd: headings[index + 1]?.index ?? body.length,
              };
            }

            function extractSection(body, title) {
              const section = findSection(body, title);
              return section ? body.slice(section.contentStart, section.sectionEnd).trim() : '';
            }

            function setSection(body, title, content) {
              const rendered = `## ${title}\n\n${String(content || '').trim()}`;
              const section = findSection(body, title);

              if (!section) {
                return [String(body || '').trimEnd(), rendered].filter(Boolean).join('\n\n').concat('\n');
              }

              const before = body.slice(0, section.headingStart);
              const after = body.slice(section.sectionEnd);
              return `${before}${rendered}${after ? `\n\n${after}` : '\n'}`;
            }

            function ensureSummary(body, fallback) {
              if (findSection(body, 'Summary')) return body;

              const value = String(body || '');
              const firstHeading = /^##\s+/m.exec(value);

              if (firstHeading?.index > 0 && value.slice(0, firstHeading.index).trim()) {
                return `## Summary\n\n${value.slice(0, firstHeading.index).trimEnd()}\n\n${value.slice(firstHeading.index)}`;
              }

              if (!firstHeading && value.trim()) return `## Summary\n\n${value.trim()}\n`;
              return `## Summary\n\n${fallback}\n\n${value.trimStart()}`.trimEnd().concat('\n');
            }

            function normalizeChecklist(value, states, preserveExistingExtras) {
              const required = [
                { label: 'Linked to an issue', checked: states.linkedIssue },
                { label: 'Tested', checked: states.tested },
                { label: 'Asked for a review', checked: states.askedForReview },
              ];
              const requiredByLabel = new Map(required.map((item) => [item.label.toLowerCase(), item]));
              const seen = new Set();
              const lines = preserveExistingExtras ? String(value || '').split(/\r?\n/) : [];
              const output = [];

              for (const line of lines) {
                const item = line.trim().match(/^-\s*\[[ xX]\]\s*(Linked to an issue|Tested|Asked for a review)\s*\.?$/i);
                if (!item) {
                  output.push(line);
                  continue;
                }

                const key = item[1].toLowerCase();
                if (seen.has(key)) continue;
                const requiredItem = requiredByLabel.get(key);
                output.push(`- [${requiredItem.checked ? 'x' : ' '}] ${requiredItem.label}`);
                seen.add(key);
              }

              for (const item of required) {
                const key = item.label.toLowerCase();
                if (!seen.has(key)) output.push(`- [${item.checked ? 'x' : ' '}] ${item.label}`);
              }

              return output.join('\n').trim();
            }

            function protectedMediaTokens(value) {
              const patterns = [
                /<picture\b[\s\S]*?<\/picture>/gi,
                /<img\b[^>]*>/gi,
                /!\[[^\]\n]*\]\(\s*(?:<[^>\n]+>|[^)\n]+)\s*\)/g,
                /!\[[^\]\n]*\]\[[^\]\n]*\]/g,
                /^\s*\[[^\]\n]+\]:\s+(?:<[^>\n]+>|\S+).*$/gm,
                /https:\/\/github\.com\/user-attachments\/assets\/[A-Za-z0-9-]+/g,
              ];
              const tokens = [];

              for (const pattern of patterns) {
                for (const match of String(value || '').matchAll(pattern)) tokens.push(match[0].trim());
              }

              return [...new Set(tokens.filter(Boolean))];
            }

            function mediaIdentity(token) {
              const markdown = token.match(/!\[[^\]]*\]\(\s*<?([^>\s)]+)>?/);
              if (markdown?.[1]) return markdown[1];
              const html = token.match(/\bsrc=["']([^"']+)["']/i);
              if (html?.[1]) return html[1];
              const attachment = token.match(/https:\/\/github\.com\/user-attachments\/assets\/[A-Za-z0-9-]+/);
              return attachment?.[0] || token;
            }

            function preserveProtectedMedia(originalBody, body) {
              const existing = new Set(protectedMediaTokens(body).map(mediaIdentity));
              const missing = [];

              for (const token of protectedMediaTokens(originalBody)) {
                const identity = mediaIdentity(token);
                if (existing.has(identity)) continue;
                existing.add(identity);
                missing.push(token);
              }

              if (!missing.length) return body;

              const screenshots = extractSection(body, 'Screenshots');
              return setSection(body, 'Screenshots', [screenshots, ...missing].filter(Boolean).join('\n\n'));
            }

            async function latestDescriptionEditIsHumanSinceCapture() {
              const capturedAt = Date.parse(process.env.DESCRIPTION_CAPTURED_AT || '');
              if (!Number.isFinite(capturedAt)) return false;

              try {
                const result = await github.graphql(`
                  query($owner: String!, $repo: String!, $number: Int!) {
                    repository(owner: $owner, name: $repo) {
                      pullRequest(number: $number) {
                        userContentEdits(last: 100) {
                          nodes {
                            editedAt
                            editor {
                              __typename
                              login
                            }
                          }
                        }
                      }
                    }
                  }
                `, { owner, repo, number: prNumber });
                const latestEdit = (result.repository.pullRequest.userContentEdits.nodes || [])
                  .filter((edit) => Date.parse(edit.editedAt) > capturedAt)
                  .sort((left, right) => new Date(right.editedAt) - new Date(left.editedAt))[0];
                const login = String(latestEdit?.editor?.login || '').toLowerCase();
                const automatedLogin = /(?:^|[-_])(ai|bot|chatgpt|claude|codex|openai)(?:$|[-_\[])/i.test(login);

                return latestEdit?.editor?.__typename === 'User' && !automatedLogin;
              } catch (error) {
                core.warning(`Could not check for a newer human PR description edit: ${error.message}`);
                return false;
              }
            }

            function checked(existingChecklist, label) {
              const expression = new RegExp(`-\\s*\\[[xX]\\]\\s*${escapeRegExp(label)}`, 'i');
              return expression.test(existingChecklist || '');
            }

            function stripGeneratedChangeSummary(value) {
              const expression = new RegExp(`${escapeRegExp(changeSummaryStart)}[\\s\\S]*?${escapeRegExp(changeSummaryEnd)}`, 'g');
              return (value || '').replace(expression, '').trim();
            }

            function cleanSummaryText(value) {
              return stripGeneratedChangeSummary(value)
                .replace(/^\s*(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+((?:[\w.-]+\/[\w.-]+)?#\d+)\s*$/gim, '')
                .replace(/^\s*No linked issue was created automatically\.\s*$/gim, '')
                .replace(/\bDescribe the change\.\s*/gi, '')
                .trim();
            }

            function compactWhitespace(value) {
              return (value || '').replace(/\s+/g, ' ').trim();
            }

            function truncate(value, maxLength) {
              const text = compactWhitespace(value);
              if (text.length <= maxLength) return text;
              return `${text.slice(0, Math.max(0, maxLength - 1)).trimEnd()}...`;
            }

            function firstBodyParagraph(message) {
              return (message || '')
                .split(/\r?\n\r?\n/)
                .map((paragraph) => paragraph
                  .split(/\r?\n/)
                  .map((line) => line.trim())
                  .filter((line) =>
                    line &&
                    !/^Signed-off-by:/i.test(line) &&
                    !/^Co-authored-by:/i.test(line)
                  )
                  .join(' ')
                )
                .find(Boolean) || '';
            }

            function parseCommitMessage(message) {
              const lines = (message || '').split(/\r?\n/);
              const subject = compactWhitespace(lines.shift() || '');
              const body = lines.join('\n').trim();
              return {
                subject,
                reason: firstBodyParagraph(body),
              };
            }

            function isBranchUpdateCommit(subject) {
              return /^(merge (branch|remote-tracking branch|pull request)|update branch|sync (main|master)|chore:?\s*(merge|sync)\b)/i.test(subject || '');
            }

            async function buildCommitChangeSummary() {
              try {
                const commits = await github.paginate(github.rest.pulls.listCommits, {
                  owner,
                  repo,
                  pull_number: prNumber,
                  per_page: 100,
                });

                const parsedCommits = commits
                  .map((commit) => parseCommitMessage(commit.commit?.message || ''))
                  .filter((commit) => commit.subject);
                const reviewCommits = parsedCommits.filter((commit) => !isBranchUpdateCommit(commit.subject));
                const sourceCommits = reviewCommits.length ? reviewCommits : parsedCommits;
                const selectedCommits = sourceCommits.slice(-6);
                const omittedCount = sourceCommits.length - selectedCommits.length;

                if (!selectedCommits.length) return '';

                const bullets = selectedCommits.map((commit) => {
                  const subject = truncate(commit.subject, 140);
                  const reason = truncate(commit.reason, 180);
                  return reason ? `- ${subject} - ${reason}` : `- ${subject}`;
                });

                if (omittedCount > 0) {
                  bullets.push(`- ...and ${omittedCount} earlier commit(s).`);
                }

                return [
                  changeSummaryStart,
                  'Changes:',
                  ...bullets,
                  changeSummaryEnd,
                ].join('\n');
              } catch (error) {
                core.warning(`Could not build commit-based PR summary: ${error.message}`);
                return '';
              }
            }

            async function buildFallbackSummary() {
              const cleanedBody = cleanSummaryText(currentBody);
              if (cleanedBody) return cleanedBody;

              try {
                const files = await github.paginate(github.rest.pulls.listFiles, {
                  owner,
                  repo,
                  pull_number: prNumber,
                  per_page: 100,
                });
                const paths = files.slice(0, 8).map((file) => `- \`${file.filename}\``);
                const omitted = files.length > paths.length ? `\n- ...and ${files.length - paths.length} more file(s)` : '';

                return [
                  pullRequest.title,
                  '',
                  'Changed files:',
                  ...paths,
                  omitted,
                ].filter(Boolean).join('\n');
              } catch (error) {
                core.warning(`Could not list PR files for fallback summary: ${error.message}`);
                return pullRequest.title;
              }
            }

            function fallbackSecurityImplications() {
              return 'Has security impact - described as: This PR is labeled `change: needs review`, but Claude did not provide specific security implications. Reviewers should confirm the actual impact on security, privacy, customer/user data, system stability, or critical functionality.';
            }

            function normalizeSecurityImplications(value) {
              const raw = (value || '').trim();
              if (!raw) return fallbackSecurityImplications();

              const lines = raw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
              const checkedNoImpact = lines.some((line) => /^-\s*\[[xX]\]\s*No security impact\.?$/i.test(line));
              const checkedImpact = lines
                .map((line) => line.match(/^-\s*\[[xX]\]\s*Has security impact - described as:\s*(.+)$/i))
                .find(Boolean);

              if (checkedImpact?.[1]?.trim()) {
                return `Has security impact - described as: ${checkedImpact[1].trim()}`;
              }

              if (checkedNoImpact && !checkedImpact) return 'No security impact';
              if (/^No security impact\.?$/i.test(raw)) return 'No security impact';

              const impact = raw.match(/^Has security impact - described as:\s*([\s\S]+)$/i);
              if (impact?.[1]?.trim()) {
                return `Has security impact - described as: ${compactWhitespace(impact[1])}`;
              }

              const withoutCheckboxes = raw.replace(/^-\s*\[[ xX]\]\s*/gm, '').trim();
              const isPlaceholder = (
                !withoutCheckboxes ||
                /^Has security impact - described as:\s*$/i.test(withoutCheckboxes) ||
                (/No security impact/i.test(withoutCheckboxes) && /Has security impact - described as:\s*$/i.test(withoutCheckboxes))
              );
              if (isPlaceholder) return fallbackSecurityImplications();

              return `Has security impact - described as: ${compactWhitespace(raw)}`;
            }

            function normalizeTesting(value) {
              const raw = (value || '').trim();
              if (!raw || /^Describe how this was tested\.?$/i.test(raw)) {
                return 'Not run by Claude.';
              }

              return raw;
            }

            function testingWasFilled(value) {
              const raw = (value || '').trim();
              return Boolean(raw && !/^Not run by Claude\.?$/i.test(raw) && !/^Describe how this was tested\.?$/i.test(raw));
            }

            function issueDraftFromClaude() {
              try {
                const parsed = JSON.parse(process.env.CLAUDE_ISSUE_DRAFT || '{}');
                const title = compactWhitespace(parsed.issue_title || '').replace(/^Track:\s*/i, '');
                const problem = (parsed.issue_problem || '').trim();
                const suggestedChanges = Array.isArray(parsed.issue_suggested_changes)
                  ? parsed.issue_suggested_changes
                    .map((item) => String(item || '').trim().replace(/^[-*]\s+/, ''))
                    .filter(Boolean)
                  : [];

                if (title && problem && suggestedChanges.length) {
                  return { title, problem, suggestedChanges };
                }

                core.warning('Claude did not return a complete issue draft. Using neutral fallback issue content.');
              } catch (error) {
                core.warning(`Could not parse Claude issue draft: ${error.message}. Using neutral fallback issue content.`);
              }

              return {
                title: compactWhitespace(pullRequest.title).replace(/^Track:\s*/i, ''),
                problem: 'The reported behavior remains unresolved and needs investigation.',
                suggestedChanges: [
                  'Confirm the affected behavior, impact, and underlying cause.',
                  'Define and validate an appropriate solution.',
                ],
              };
            }

            function buildIssueContent(issueDraft) {
              const title = truncate(issueDraft.title, 240);
              const suggestedChanges = issueDraft.suggestedChanges.map((item) => `- ${item}`);
              const body = [
                '## Problem',
                '',
                issueDraft.problem,
                '',
                '## Suggested changes',
                '',
                ...suggestedChanges,
              ].join('\n');

              return { title, body };
            }

            async function createTrackingIssue(targetOwner, targetRepo, issueContent) {
              const { data: issue } = await github.rest.issues.create({
                owner: targetOwner,
                repo: targetRepo,
                title: issueContent.title,
                body: issueContent.body,
              });

              return {
                ref: `${targetOwner}/${targetRepo}` === nameWithOwner ? `#${issue.number}` : `${targetOwner}/${targetRepo}#${issue.number}`,
                url: issue.html_url,
              };
            }

            const currentBody = pullRequest.body || '';
            const originalBody = Buffer.from(process.env.ORIGINAL_PR_BODY_BASE64 || '', 'base64').toString('utf8');
            const humanDescription = process.env.DESCRIPTION_PROVENANCE === 'human';
            const newerHumanDescription = (
              humanDescription &&
              currentBody !== originalBody &&
              await latestDescriptionEditIsHumanSinceCapture()
            );
            const sourceBody = humanDescription && !newerHumanDescription ? originalBody : currentBody;
            const existingIssueRef = (process.env.EXISTING_ISSUE_REF || '').trim();
            const linkedIssues = uniqueRefs([
              ...(existingIssueRef ? [{ ref: existingIssueRef, url: '' }] : []),
              ...(await closingIssueRefsFromGraphql()),
              ...closingIssueRefsFromBody(sourceBody),
              ...closingIssueRefsFromBody(currentBody),
            ]);

            let issueRef = linkedIssues[0]?.ref || '';

            if (!issueRef) {
              const issueContent = buildIssueContent(issueDraftFromClaude());
              const targets = [
                { owner: 'simpleanalytics', repo: 'dashboard' },
                { owner, repo },
              ].filter((target, index, targets) =>
                targets.findIndex((item) => item.owner === target.owner && item.repo === target.repo) === index
              );

              const failures = [];
              for (const target of targets) {
                try {
                  const createdIssue = await createTrackingIssue(target.owner, target.repo, issueContent);
                  issueRef = createdIssue.ref;
                  core.info(`Created review tracking issue ${createdIssue.ref}: ${createdIssue.url}`);
                  break;
                } catch (error) {
                  failures.push(`${target.owner}/${target.repo}: ${error.message}`);
                  core.warning(`Could not create review tracking issue in ${target.owner}/${target.repo}: ${error.message}`);
                }
              }

              if (!issueRef) {
                const suggestedIssue = `# ${issueContent.title}\n\n${issueContent.body}`;
                const comment = [
                  'Could not create a linked tracking issue automatically. Continuing without a linked issue.',
                  '',
                  `<details><summary>Suggested issue content</summary>`,
                  '',
                  '```markdown',
                  suggestedIssue.replace(/```/g, "'''"),
                  '```',
                  '',
                  '</details>',
                  '',
                  `Issue creation failures: ${failures.join('; ')}`,
                ].join('\n');

                try {
                  await github.rest.issues.createComment({
                    owner,
                    repo,
                    issue_number: prNumber,
                    body: comment,
                  });
                } catch (error) {
                  core.warning(`Could not add suggested issue content as a PR comment: ${error.message}`);
                }

                core.warning(`Could not create a linked review tracking issue. Continuing without issue reference. Failures: ${failures.join('; ')}`);
              }
            }

            let nextBody;

            if (humanDescription) {
              nextBody = ensureSummary(sourceBody, pullRequest.title);

              if (issueRef && !closingIssueRefsFromBody(nextBody).length) {
                const summary = extractSection(nextBody, 'Summary');
                nextBody = setSection(nextBody, 'Summary', [`Closes ${issueRef}`, summary].filter(Boolean).join('\n\n'));
              }

              const security = normalizeSecurityImplications(extractSection(nextBody, 'Security implications'));
              const testing = normalizeTesting(extractSection(nextBody, 'Testing'));
              const existingChecklist = extractSection(nextBody, 'Checklist');
              const checklist = normalizeChecklist(existingChecklist, {
                linkedIssue: Boolean(issueRef),
                tested: checked(existingChecklist, 'Tested') || testingWasFilled(testing),
                askedForReview: checked(existingChecklist, 'Asked for a review'),
              }, true);

              nextBody = setSection(nextBody, 'Security implications', security);
              nextBody = setSection(nextBody, 'Testing', testing);
              nextBody = setSection(nextBody, 'Checklist', checklist);
            } else {
              const existingSummary = extractSection(sourceBody, 'Summary');
              const existingSecurity = extractSection(sourceBody, 'Security implications');
              const existingTesting = extractSection(sourceBody, 'Testing');
              const existingChecklist = extractSection(sourceBody, 'Checklist');
              const manualSummary = cleanSummaryText(existingSummary);
              const fallbackSummary = manualSummary ? '' : await buildFallbackSummary();
              const commitChangeSummary = await buildCommitChangeSummary();
              const summary = [
                manualSummary || fallbackSummary,
                commitChangeSummary,
              ].filter(Boolean).join('\n\n').trim();
              const security = normalizeSecurityImplications(existingSecurity);
              const testing = normalizeTesting(existingTesting);
              const closingLine = issueRef ? `Closes ${issueRef}` : 'No linked issue was created automatically.';
              const checklist = normalizeChecklist('', {
                linkedIssue: Boolean(issueRef),
                tested: checked(existingChecklist, 'Tested') || testingWasFilled(testing),
                askedForReview: checked(existingChecklist, 'Asked for a review'),
              }, false);

              nextBody = [
                '## Summary',
                '',
                closingLine,
                '',
                summary,
                '',
                '## Security implications',
                '',
                security,
                '',
                '## Testing',
                '',
                testing,
                '',
                '## Checklist',
                '',
                checklist,
                '',
              ].join('\n');
            }

            nextBody = preserveProtectedMedia(originalBody, nextBody);

            if (nextBody.trim() !== currentBody.trim()) {
              await github.rest.pulls.update({
                owner,
                repo,
                pull_number: prNumber,
                body: nextBody,
              });
              core.info(`Updated ${humanDescription ? 'human-authored' : 'automated'} PR body with required template sections and issue reference ${issueRef}.`);
            } else {
              core.info('PR body already matches the Simple Analytics PR template.');
            }