ci: add claude-review caller workflow - #15
Merged
Conversation
Wire this repo into the ci-workflows claude-review reusable workflow, consistent with the org-wide rollout. pull_request-triggered; passes CLAUDE_CODE_OAUTH_TOKEN explicitly (least privilege). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W4D4GgeYg7k6yU1DSzweij
5 tasks
kyle-sexton
added a commit
that referenced
this pull request
Jul 14, 2026
## What
A new `comment-residue` skill in the **code-tidying** plugin: a
read-only classifier that flags **out-of-context residue** in code
comments and presents Tier 1/2 findings for author-applied deletion.
Mirrors `declutter`'s architecture (`detect.sh` + sourceable shape
library + self-contained `detect.test.sh`), but scans code files and
detects only on the **comment portion** of a line.
**Residue shapes:** `history-narration` ("used to… now…"),
`plan-reference` ("Task 2 replaces the old…", "in this PR"),
`conversational-antecedent` ("per your request") — all Tier 1;
`ticket-pr-residue` ("see PR #45", "JIRA-123") — Tier 2. `TODO(#issue)`
is the sanctioned back-reference and is never flagged.
Bumps code-tidying `0.2.0 → 0.3.0`; documents the skill in the manifest
+ README catalog.
## Why
Agents leak the producing conversation/plan/history into comments — text
that only makes sense inside the chat thread that wrote it. No existing
skill targets this: `declutter` is markdown-only, `compress` excludes
code comments, and `tidy`'s Beck-#15 handles generic restatement, not
the out-of-context residue class. This is the clean-up-afterward
companion to the source-side comment rule (a separate dotfiles-repo
change).
## Design notes
- **Comment-scoped detection** — residue-shaped words in identifiers or
string literals (`previously = load_cache()`, `# encode as UTF-8 /
SHA-256`) are **not** flagged; only the comment text is classified. This
keeps false positives low; anything uncertain lands in Tier 2 (review),
and the skill is read-only so the author confirms every deletion.
- **Placement** — filed under `code-tidying` (subject = code) per the
plan. It's a read-only *classifier* like `declutter` (which lives in
`docs-hygiene`), so a mode-based argument for `docs-hygiene` exists;
flagging for reviewer preference.
## Security review (plugin-acceptance)
Touches **only surface 1** — a read-only, advisory `detect.sh` (spawns
git/find/awk, never mutates, no network, no MCP server, no
`userConfig`/secrets, reads only files under the invoking repo via
`${CLAUDE_PLUGIN_ROOT}` / `git rev-parse`). No surface 2/5/6 trust
decision required.
## Test plan
- [x] `detect.test.sh` — 19/19 (shapes, tiers, opt-out, markdown-skip,
dir + paths-file, and the false-positive guards: code identifier,
`UTF-8`/`SHA-256`, sanctioned `TODO(#123)`)
- [x] shellcheck clean
- [x] shfmt clean (editorconfig-aware)
- [x] markdownlint-cli2 clean (repo config)
- [x] `claude plugin validate --strict .` passed
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Read-only local bash/git scanning with no mutations, secrets, or
network; CI change is a targeted hygiene exclude for test/detector
content.
>
> **Overview**
> Adds **`/code-tidying:comment-residue`**, a read-only skill that
audits **code** comments for four residue shapes (history narration,
plan/session refs, conversational antecedents, ticket/PR back-refs) and
reports **Tier 1/2** findings with treatment guidance—authors apply
deletions; no edits from the skill.
>
> Implementation follows the `declutter`-style split: **`detect.sh`**
(targets, git default, deterministic output),
**`lib/comment-shapes.sh`** (comment-only extraction with string-aware
leaders, shape regexes, sanctioned `TODO(#issue)`,
`comment-residue-ignore`), plus **`detect.test.sh`**, eval fixtures, and
**`evals.json`**. **code-tidying** bumps to **0.3.0**; README and
manifest copy describe comment hygiene alongside `tidy` /
`batch-simplify`.
>
> CI **comment-hygiene** now **excludes** `comment-residue` **scripts**
and **evals** so intentional TODO/PR-shaped test corpus and detector
patterns do not trip the repo ban policy.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
43f7bfa. Bugbot is set up for automated
code reviews on this repo. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
kyle-sexton
added a commit
that referenced
this pull request
Jul 15, 2026
## Summary Restores the eval/test-coverage attrition identified by the salvage sweep (tier-3: items #13, #15–#23 plus the two flagged cosmetic-severity items), recreated genericized and validated against `plugins/skill-quality/reference/evals.schema.json`. Per-plugin version bumps + CHANGELOG entries. | Plugin | Version | Restored coverage | |---|---|---| | songwriting | 0.4.0 | All 13 medley behavioral evals mapped onto the multi-skill split (workflow 3, diagnosis 3, rhyme 2, song-form 2, co-write 2, object-writing 1); zero drops | | ai-briefing | 0.4.0 | 6 engine evals + 3 synthetic fixtures via the audience-defaults seam; the legacy Grok-preload case re-derived as an unreachable-RSS visible-degrade scenario (the flag never shipped; CI contract bans the token) | | event-storming | 0.4.0 | Offline board-export eval (id 8) + 74-line fixture for `--discover-bcs` — disjoint from the live-Miro-required eval, reconciliation noted inline | | codebase-audit | 0.3.0 | Scope-boundary eval: decline settings/MCP/hooks claim-extraction, route to `/claude-config-audit:settings-audit` | | discovery | 0.5.0 | Research floor-scaling ("floors are not targets") + broad-topic doubled-minimums evals, vendor-neutral | | source-control | 0.2.0 | Readiness security-gate eval + genericized fixture, mixed-actor (bot-fix-now vs human-pause) eval, three worktree evals (dry-run report-only, invalid-name rejection, batched-gh status + graceful degrade) | | docs-hygiene | 0.4.0 | Two self-contained fixture-backed cases (compress classification-table, declutter opt-out/section-exemption) — fixtures empirically verified against `detect.sh`; rename-references "add an eval case" clauses | | review-toolkit | 0.6.0 | code-review-fanout evals 6 → 20: dedup/severity-derivation, fix-pass safety fence (correctness never routed to /simplify), run-everything null-reconciliation + priority-ordering; 2 medley cases skipped (fixed-roster counts deliberately generalized away), their surviving assertions folded in | ## Verification - All 8 plugins pass `claude plugin validate`; `scripts/validate-plugin-contracts.mjs` passes (1311 files) - Every evals.json jq-parses and validates against the schema (ajv/check-jsonschema) - markdownlint-cli2 0 errors on new fixtures + CHANGELOGs; coupling grep (medley/consumer refs) clean - Rebased onto main post-#192; per-plugin validate re-run green after rebase 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_011xHkkNc7CR98L8Xz9Mu7ZA --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
.github/workflows/claude-review.yml— a thin caller wiring this repo into theci-workflowsclaude-reviewreusable workflow, consistent with the validated pattern (pilot: melodic-software/standards#49). Triggers onpull_requestonly (fork PRs get no secrets, not reviewed by design); passesCLAUDE_CODE_OAUTH_TOKENexplicitly (least privilege). The introducing PR self-skips via the action's first-add guard and activates on merge.(Supersedes the earlier API-made PR, which was unsigned and blocked by the required-signatures rule; this commit is SSH-signed.)
🤖 Generated with Claude Code