clud-bug 0.6.23 → 0.6.24

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/package.json +1 -1
  2. package/templates/workflow-py.yml.tmpl +10 -6
  3. package/templates/workflow-ts.yml.tmpl +10 -6
  4. package/templates/workflow.yml.tmpl +20 -13
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "clud-bug",
3
- "version": "0.6.23",
3
+ "version": "0.6.24",
4
4
  "description": "Skill-driven Claude PR review. Ship a brand-voice skill, get brand reviews. Each finding cites the skill that motivated it. CLI installs the workflow + a baseline kit; add more from skills.sh.",
5
5
  "homepage": "https://cludbug.dev",
6
6
  "bugs": "https://github.com/thrillmade/clud-bug/issues",
package/templates/workflow-py.yml.tmpl CHANGED
@@ -28,10 +28,13 @@ jobs:
28
28
  CHANGED=$(gh pr diff "$PR_NUMBER" -R "$REPO" --name-only)
29
29
  MODEL=claude-sonnet-4-6
30
30
  if [ -z "$CHANGED" ]; then
31
- echo "is_workflow_only=false" >> "$GITHUB_OUTPUT"
32
- echo "model=$MODEL" >> "$GITHUB_OUTPUT"
33
31
  # v0.6.23 / §5: max_turns must always be emitted — see workflow.yml.tmpl for design notes.
34
- echo "max_turns=15" >> "$GITHUB_OUTPUT"
32
+ # Grouped redirect (v0.6.24) silences the SC2129 style warning.
33
+ {
34
+ echo "is_workflow_only=false"
35
+ echo "model=$MODEL"
36
+ echo "max_turns=15"
37
+ } >> "$GITHUB_OUTPUT"
35
38
  exit 0
36
39
  fi
37
40
  IS_WORKFLOW_ONLY=true
@@ -105,8 +108,9 @@ jobs:
105
108
  id-token: write
106
109
  # checks: write — composite emits per-skill check-runs (BB.3).
107
110
  checks: write
108
- # actions: read (v0.6.23 / §5) — github_ci MCP server. See workflow.yml.tmpl for design notes.
109
- actions: read
111
+ # v0.6.24: `actions: read` (added in v0.6.23) backed out — broke
112
+ # `pull_request` trigger firing on private consumer repos. See
113
+ # workflow.yml.tmpl for the diagnosis.
110
114
 
111
115
  steps:
112
116
  - uses: actions/checkout@v6
@@ -212,7 +216,7 @@ jobs:
212
216
  # Strict-mode gate — composite action; see workflow.yml.tmpl for design notes.
213
217
  - name: Strict mode — fail check on critical findings
214
218
  if: success()
215
- uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.6.23
219
+ uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.6.24
216
220
  with:
217
221
  github-token: ${{ secrets.GITHUB_TOKEN }}
218
222
  # v0.6.22 / 0.0.O: summary now posted by github-actions[bot].
package/templates/workflow-ts.yml.tmpl CHANGED
@@ -28,10 +28,13 @@ jobs:
28
28
  CHANGED=$(gh pr diff "$PR_NUMBER" -R "$REPO" --name-only)
29
29
  MODEL=claude-sonnet-4-6
30
30
  if [ -z "$CHANGED" ]; then
31
- echo "is_workflow_only=false" >> "$GITHUB_OUTPUT"
32
- echo "model=$MODEL" >> "$GITHUB_OUTPUT"
33
31
  # v0.6.23 / §5: max_turns must always be emitted — see workflow.yml.tmpl for design notes.
34
- echo "max_turns=15" >> "$GITHUB_OUTPUT"
32
+ # Grouped redirect (v0.6.24) silences the SC2129 style warning.
33
+ {
34
+ echo "is_workflow_only=false"
35
+ echo "model=$MODEL"
36
+ echo "max_turns=15"
37
+ } >> "$GITHUB_OUTPUT"
35
38
  exit 0
36
39
  fi
37
40
  IS_WORKFLOW_ONLY=true
@@ -105,8 +108,9 @@ jobs:
105
108
  id-token: write
106
109
  # checks: write — composite emits per-skill check-runs (BB.3).
107
110
  checks: write
108
- # actions: read (v0.6.23 / §5) — github_ci MCP server. See workflow.yml.tmpl for design notes.
109
- actions: read
111
+ # v0.6.24: `actions: read` (added in v0.6.23) backed out — broke
112
+ # `pull_request` trigger firing on private consumer repos. See
113
+ # workflow.yml.tmpl for the diagnosis.
110
114
 
111
115
  steps:
112
116
  - uses: actions/checkout@v6
@@ -212,7 +216,7 @@ jobs:
212
216
  # Strict-mode gate — composite action; see workflow.yml.tmpl for design notes.
213
217
  - name: Strict mode — fail check on critical findings
214
218
  if: success()
215
- uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.6.23
219
+ uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.6.24
216
220
  with:
217
221
  github-token: ${{ secrets.GITHUB_TOKEN }}
218
222
  # v0.6.22 / 0.0.O: summary now posted by github-actions[bot].
package/templates/workflow.yml.tmpl CHANGED
@@ -42,15 +42,18 @@ jobs:
42
42
  CHANGED=$(gh pr diff "$PR_NUMBER" -R "$REPO" --name-only)
43
43
  MODEL=claude-sonnet-4-6 # default
44
44
  if [ -z "$CHANGED" ]; then
45
- echo "is_workflow_only=false" >> "$GITHUB_OUTPUT"
46
- echo "model=$MODEL" >> "$GITHUB_OUTPUT"
47
45
  # v0.6.23 / §5: max_turns must always be emitted because
48
46
  # clud-bug-review runs (is_workflow_only=false). Without
49
- # this, --max-turns ${{ ... }} expands to '--max-turns '
50
- # (empty), failing the CLI invocation. Empty-CHANGED
51
- # fires on gh pr diff auth/network failures + the
52
- # (theoretical) no-changed-files PR.
53
- echo "max_turns=15" >> "$GITHUB_OUTPUT"
47
+ # this, --max-turns $-{{ ... }} expands to '--max-turns '
48
+ # (empty), failing the CLI invocation. Empty-CHANGED fires
49
+ # on gh pr diff auth/network failures + the (theoretical)
50
+ # no-changed-files PR. Grouped redirect (v0.6.24) silences
51
+ # the SC2129 style warning.
52
+ {
53
+ echo "is_workflow_only=false"
54
+ echo "model=$MODEL"
55
+ echo "max_turns=15"
56
+ } >> "$GITHUB_OUTPUT"
54
57
  exit 0
55
58
  fi
56
59
 
@@ -154,11 +157,15 @@ jobs:
154
157
  # the GitHub Checks API for any skill in .clud-bug.json's strictSkills
155
158
  # list (BB.3, v0.5.10+). No-op when strictSkills is unset.
156
159
  checks: write
157
- # actions: read (v0.6.23 / §5) — claude-code-action's bundled
158
- # github_ci MCP server needs this to introspect recent CI runs.
159
- # Per-job GITHUB_TOKEN permissions aren't inherited, so this
160
- # MUST be on the clud-bug-review job, not paths-check.
161
- actions: read
160
+ # v0.6.23 attempted to add `actions: read` here for the github_ci
161
+ # MCP server bundled with claude-code-action. v0.6.24 backed it
162
+ # out: on private consumer repos the `pull_request` trigger
163
+ # silently stopped firing the workflow after the permissions
164
+ # block changed (validated against tokenomics — public agent-skills
165
+ # kept firing, private tokenomics/rezgen did not). claude-code-action
166
+ # warns about the missing `actions: read` but reviews still run
167
+ # correctly. Re-add via a separate path once we understand the
168
+ # private-repo trigger-registration semantics.
162
169
 
163
170
  steps:
164
171
  - uses: actions/checkout@v6
@@ -335,7 +342,7 @@ jobs:
335
342
  # Letting the action's own failure fail the check is louder and right.
336
343
  - name: Strict mode — fail check on critical findings
337
344
  if: success()
338
- uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.6.23
345
+ uses: thrillmade/clud-bug/.github/actions/strict-mode-gate@v0.6.24
339
346
  with:
340
347
  github-token: ${{ secrets.GITHUB_TOKEN }}
341
348
  # v0.6.22 / 0.0.O: the summary is now posted by the workflow