fix(ci): make the Claude PR review read the diff

[AnnatarHe]

Summary

The automated Claude review was posting the code-review plugin's stock line, No issues found. Checked for bugs and CLAUDE.md compliance., about 30 seconds after a push, without reading the diff. On shelltime/cli#325, run 38401010946 finished in 29s / 11 turns / $0.13 with two permission denials and no inline comments. --allowedTools contained only the inline-comment tool and gh pr comment, so gh pr diff and Read were refused. The plugin's command then posts that fixed sentence whenever it has no high-signal bug. An earlier run on the same PR exited in 6s / 3 turns and posted nothing. CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1 was already set; it stops the action from returning before background subagents finish, and it did not fix a review that was not allowed to read the diff.

The working setup is the built-in /code-review command used by rawback-app/web (attached) and the other repos aligned to it. This workflow now matches that file. The runner stays blacksmith-2vcpu-ubuntu-2404. The one comment change is that Actions logs here are public, so the reference's "repository is private" note is not copied. claude.yml is untouched.

What the reference does differently

• Cancels an in-progress review of the same PR when a new push arrives (claude-review-<number>).
• Skips drafts and bot authors. Drafts are reviewed when marked ready. Release-please and other bots no longer sit in action_required.
• Grants pull-requests: write, issues: write, and read on checks, statuses, and actions, with additional_permissions: actions: read, so the review can post and can read CI.
• Checks out full history (fetch-depth: 0) so git diff, git log, and git blame work against the base.
• Calls the built-in /code-review high <PR#> --comment instead of code-review@claude-code-plugins. On rawback-app/web#654 the plugin's main loop skipped its own subagents, read a slice of a large diff, and posted "No issues found" after 16 seconds. The built-in command takes an effort level and --comment, and it checks findings before posting them.
• Allows Bash(gh:*), Bash(git:*), and the inline-comment tool. The broken allowlist was comment tools only.
• Prints the full Claude transcript (show_full_output).
• Asserts the review ran by reading the execution log: fail when num_turns is 0 and cost is $0; warn when no Agent/Task/Workflow subagent was launched; warn and pass when there is no execution file (expected while this workflow file differs from main).
• Does not set CLAUDE_CODE_DISABLE_BACKGROUND_TASKS. That variable was a workaround for the plugin's background subagents. The built-in command is the path that actually reviews.

Test plan

• The workflow YAML matches rawback-app/web aside from the public-log comment and trailing blank lines.
• After merge, a non-draft human PR runs /code-review high, and the assert step fails only for a 0-turn, $0 run.
• @claude mentions still go through claude.yml, which this PR does not change.

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Flag	Coverage Δ
unittests	86.22% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.