christian/claude-playground
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Document branch-and-PR workflow; never write to main #1

Merged
christian merged 5 commits from docs/branch-pr-workflow into main 2026-10-21 00:58:41 +02:00
Conversation 3 Commits 5 Files Changed 1
+54
christian commented 2026-10-21 00:19:26 +02:00
Owner
Copy link
Copy source

Adds a Workflow (required) section to CLAUDE.md: every change goes on a new branch and through a PR. Claude reviews it with /code-review <branch> medium and posts an Approved or Needs fixes comment marked as a self-review, with at most 2 fix rounds. Only a human merges into main. It also documents the Gitea API calls (via --rawfile, with pipefail, curl -f and jq -e).

Merge after #3: this doc refers to the git hooks and the README section that #3 adds.

🤖 Generated with Claude Code

Adds a **Workflow (required)** section to `CLAUDE.md`: every change goes on a new branch and through a PR. Claude reviews it with `/code-review <branch> medium` and posts an **Approved** or **Needs fixes** comment marked as a self-review, with at most 2 fix rounds. Only a human merges into `main`. It also documents the Gitea API calls (via `--rawfile`, with `pipefail`, `curl -f` and `jq -e`). **Merge after #3**: this doc refers to the git hooks and the README section that #3 adds. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
christian added 1 commit 2026-10-21 00:19:26 +02:00
Document branch-and-PR workflow; never write to main 82ba704957 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
christian commented 2026-10-21 00:20:21 +02:00
Author
Owner
Copy link
Copy source

Needs fixes

Automated self-review by Claude (/code-review, medium). The same agent wrote this change, so this is not an independent review.

  1. CLAUDE.md:17 — git switch -c <type>/<name> branches from the current HEAD, not from main, and nothing fetches first. Use git fetch origin && git switch -c <name> origin/main.
  2. CLAUDE.md:20 — /code-review with no target diffs against the just-pushed upstream, so it sees an empty diff and could "approve" unreviewed code. Name the target: /code-review <branch> (diffed against main).
  3. CLAUDE.md:19 — The doc doesn't say how to open a PR or comment on it (no gh/tea). Document the Gitea API via curl + $GITEA_TOKEN (from .claude/settings.local.json), and say to stop and ask the human if the token is missing.
  4. CLAUDE.md:21 — The fix/review loop has no exit other than Approved. Cap it (e.g. 2 rounds, then hand off to the human) and limit the loop to correctness findings.
  5. CLAUDE.md:21 — The loop says "repeat steps 4–5", which skips npm test. It should say "repeat steps 2–5".
  6. CLAUDE.md:21 — An Approved comment from the author agent looks like an independent review. Mark comments as an automated self-review.
  7. CLAUDE.md:16 — "Never write to main" is enforced only by prose. Add Gitea branch protection on main and a deny rule in .claude/settings.json (human action: Claude can't edit settings).
**Needs fixes** _Automated self-review by Claude (`/code-review`, medium). The same agent wrote this change, so this is not an independent review._ 1. `CLAUDE.md:17` — `git switch -c <type>/<name>` branches from the current HEAD, not from main, and nothing fetches first. Use `git fetch origin && git switch -c <name> origin/main`. 2. `CLAUDE.md:20` — `/code-review` with no target diffs against the just-pushed upstream, so it sees an empty diff and could "approve" unreviewed code. Name the target: `/code-review <branch>` (diffed against `main`). 3. `CLAUDE.md:19` — The doc doesn't say *how* to open a PR or comment on it (no `gh`/`tea`). Document the Gitea API via `curl` + `$GITEA_TOKEN` (from `.claude/settings.local.json`), and say to stop and ask the human if the token is missing. 4. `CLAUDE.md:21` — The fix/review loop has no exit other than **Approved**. Cap it (e.g. 2 rounds, then hand off to the human) and limit the loop to correctness findings. 5. `CLAUDE.md:21` — The loop says "repeat steps 4–5", which skips `npm test`. It should say "repeat steps 2–5". 6. `CLAUDE.md:21` — An **Approved** comment from the author agent looks like an independent review. Mark comments as an automated self-review. 7. `CLAUDE.md:16` — "Never write to main" is enforced only by prose. Add Gitea branch protection on `main` and a deny rule in `.claude/settings.json` (human action: Claude can't edit settings).
christian added 1 commit 2026-10-21 00:25:24 +02:00
Address review: fresh base, named review target, round cap, Gitea API 962c1aa9a1 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
christian commented 2026-10-21 00:27:49 +02:00
Author
Owner
Copy link
Copy source

Needs fixes
Automated self-review by Claude; not an independent review.

Round 2 (after 962c1aa). The round-1 findings are addressed. New findings, most important first:

  1. CLAUDE.md:17 — The doc says a deny rule in .claude/settings.json blocks pushes to main, but that rule doesn't exist yet (human action pending), and Gitea branch protection can't be verified from the repo. Until both are in place, the claim is false.
  2. CLAUDE.md:18 — git switch -c <name> origin/main sets origin/main as the branch's upstream, so git push/git pull target main. Use git switch --no-track -c <name> origin/main and push with git push -u origin HEAD.
  3. CLAUDE.md:18 — git fetch origin && git switch … is a compound command, so it stays sandboxed and the fetch can't reach the remote. Run git fetch origin on its own first; the doc's own note at line 37 already says so.
  4. CLAUDE.md:21 — The explanation in step 4 (why to name the review target) is wrong given the tracking setup above. Keep the instruction and fix the explanation.
  5. CLAUDE.md:32 — curl -s hides HTTP errors (401/404/409). Use curl -fsS or check .number in the response.
  6. CLAUDE.md:34 — comment.md in the repo root can get committed by accident. Write it to $TMPDIR instead.
  7. CLAUDE.md:29 — The snippet relies on $API, $BRANCH, $TITLE, $BODY and $N, but shell state doesn't persist between calls. Say to set them all in the same command.
  8. CLAUDE.md:27 — The token is read only when a session starts. Say that adding it means restarting the session (claude --continue).
  9. CLAUDE.md:23 — It isn't defined whether cleanup-only findings count as "Needs fixes". State that only correctness findings do.

Not applicable: "curl to code.westerkam.org is blocked by the sandbox". The domain is allowed in the git-ignored .claude/settings.local.json, which the reviewer can't read. The doc should still mention that this setup step is needed.

Fix round cap reached for this session: handing off to the human.

**Needs fixes** _Automated self-review by Claude; not an independent review._ Round 2 (after 962c1aa). The round-1 findings are addressed. New findings, most important first: 1. `CLAUDE.md:17` — The doc says a deny rule in `.claude/settings.json` blocks pushes to `main`, but that rule doesn't exist yet (human action pending), and Gitea branch protection can't be verified from the repo. Until both are in place, the claim is false. 2. `CLAUDE.md:18` — `git switch -c <name> origin/main` sets `origin/main` as the branch's upstream, so `git push`/`git pull` target main. Use `git switch --no-track -c <name> origin/main` and push with `git push -u origin HEAD`. 3. `CLAUDE.md:18` — `git fetch origin && git switch …` is a compound command, so it stays sandboxed and the fetch can't reach the remote. Run `git fetch origin` on its own first; the doc's own note at line 37 already says so. 4. `CLAUDE.md:21` — The explanation in step 4 (why to name the review target) is wrong given the tracking setup above. Keep the instruction and fix the explanation. 5. `CLAUDE.md:32` — `curl -s` hides HTTP errors (401/404/409). Use `curl -fsS` or check `.number` in the response. 6. `CLAUDE.md:34` — `comment.md` in the repo root can get committed by accident. Write it to `$TMPDIR` instead. 7. `CLAUDE.md:29` — The snippet relies on `$API`, `$BRANCH`, `$TITLE`, `$BODY` and `$N`, but shell state doesn't persist between calls. Say to set them all in the same command. 8. `CLAUDE.md:27` — The token is read only when a session starts. Say that adding it means restarting the session (`claude --continue`). 9. `CLAUDE.md:23` — It isn't defined whether cleanup-only findings count as "Needs fixes". State that only correctness findings do. Not applicable: "curl to code.westerkam.org is blocked by the sandbox". The domain is allowed in the git-ignored `.claude/settings.local.json`, which the reviewer can't read. The doc should still mention that this setup step is needed. Fix round cap reached for this session: handing off to the human.
christian added 1 commit 2026-10-21 00:32:52 +02:00
Address review round 2: no-track branches, honest enforcement, safer API calls fa45c58c0c 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
christian commented 2026-10-21 00:34:35 +02:00
Author
Owner
Copy link
Copy source

Needs fixes
Automated self-review by Claude; not an independent review.

Round 3 (after fa45c58). Round 2's findings are addressed. New findings, most important first:

Correctness

  1. CLAUDE.md:33 — The PR title and body are set as BODY="…" inside double quotes, so backticks and $(…) in markdown get executed. Read the body from a file with --rawfile, as the comment example does.
  2. CLAUDE.md:23 — Step 6 says "repeat steps 2–5", which includes step 3's "open a PR". Re-opening fails with 409. Fix rounds should only push, review and comment.
  3. CLAUDE.md:39 — curl -fsS … | jq -r .html_url has no pipefail/jq -e, so a failed POST still exits 0 and Claude thinks the comment was posted.
  4. CLAUDE.md:17 — The doc refers to deny rules that exist only on chore/deny-push-main (PR #3). Merge #3 first or together with this PR.
  5. CLAUDE.md:20 — git push -u origin HEAD doesn't check that the current branch isn't main. Check git branch --show-current first.

Smaller
6. CLAUDE.md:29 — The snippet sets API on its own line, against its own "same command" rule.
7. CLAUDE.md:33 — BRANCH=fix/x is hard-coded; use $(git branch --show-current).
8. CLAUDE.md:21 — The review effort level isn't pinned (/code-review <branch> medium), so verdicts vary between runs.
9. CLAUDE.md:22 — If any unverified correctness finding blocks approval, Approved is nearly unreachable. Consider blocking only on findings that were verified.
10. CLAUDE.md:18 — Fix rounds never update from main, so long-running PRs go stale.

Fix round cap (2) reached: handing off to the human.

**Needs fixes** _Automated self-review by Claude; not an independent review._ Round 3 (after fa45c58). Round 2's findings are addressed. New findings, most important first: **Correctness** 1. `CLAUDE.md:33` — The PR title and body are set as `BODY="…"` inside double quotes, so backticks and `$(…)` in markdown get *executed*. Read the body from a file with `--rawfile`, as the comment example does. 2. `CLAUDE.md:23` — Step 6 says "repeat steps 2–5", which includes step 3's "open a PR". Re-opening fails with 409. Fix rounds should only push, review and comment. 3. `CLAUDE.md:39` — `curl -fsS … | jq -r .html_url` has no `pipefail`/`jq -e`, so a failed POST still exits 0 and Claude thinks the comment was posted. 4. `CLAUDE.md:17` — The doc refers to deny rules that exist only on `chore/deny-push-main` (PR #3). Merge #3 first or together with this PR. 5. `CLAUDE.md:20` — `git push -u origin HEAD` doesn't check that the current branch isn't `main`. Check `git branch --show-current` first. **Smaller** 6. `CLAUDE.md:29` — The snippet sets `API` on its own line, against its own "same command" rule. 7. `CLAUDE.md:33` — `BRANCH=fix/x` is hard-coded; use `$(git branch --show-current)`. 8. `CLAUDE.md:21` — The review effort level isn't pinned (`/code-review <branch> medium`), so verdicts vary between runs. 9. `CLAUDE.md:22` — If any unverified correctness finding blocks approval, **Approved** is nearly unreachable. Consider blocking only on findings that were verified. 10. `CLAUDE.md:18` — Fix rounds never update from `main`, so long-running PRs go stale. Fix round cap (2) reached: handing off to the human.
christian added 1 commit 2026-10-21 00:52:04 +02:00
Address review round 3: safe API snippets, PR opened once, pinned review ed197eeeb1 
- Titles and bodies go through --rawfile files, never inline shell quotes
- pipefail + curl -f + jq -e so a failed call can't look successful
- Fix rounds merge latest main and skip re-opening the PR
- Check the branch isn't main before pushing; never bypass the hooks
- Review at a pinned level; only correctness findings checked against the
  code block approval

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
christian added 1 commit 2026-10-21 00:57:15 +02:00
Give the PR workflow a hard stop f666bdf6b3 
Only confirmed correctness bugs block approval; everything else is a note.
At most one fix round, then hand off. Don't widen scope to satisfy a
review. Merge main only on conflict or request. The token goes in a
private header file, and PR responses are checked for a number.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
christian merged commit 696049b3b1 into main 2026-10-21 00:58:41 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
christian (Christian Stangerup)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: christian/claude-playground#1