From ab3751800896e991a46596991b7f237a44171582 Mon Sep 17 00:00:00 2001
From: Henry Park <henrypark133@gmail.com>
Date: Mon, 9 Mar 2026 14:58:15 -0700
Subject: [PATCH] =?UTF-8?q?fix(ci):=20address=20review=20round=202=20?=
 =?UTF-8?q?=E2=80=94=20injection,=20cancellable=20polling,=20concurrency?=
 =?UTF-8?q?=20[skip-regression-check]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. Script injection: use env vars for workflow_dispatch inputs instead
   of ${{ inputs.* }} interpolation in run blocks.

2. Cancellable polling: sleep in 1s increments so GitHub can cancel
   between iterations instead of blocking on a single long sleep.

3. Remove workflow_dispatch from claude-review — fails without PR
   context. Re-trigger by removing/re-adding staging-promotion label.

4. Add concurrency group to claude-review to prevent duplicate
   reviews consuming API credits.

5. Fix dead code in test.yml roll-up (redundant variable init).

6. Add comment explaining --delete-branch safety (GitHub auto-retargets
   chained PRs, verified in ironclaw-ci-test).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/claude-review.yml |  5 ++++-
 .github/workflows/staging-ci.yml    | 12 +++++++++---
 .github/workflows/test.yml          |  1 -
 3 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index f2a3a5bb..4e82edfe 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -3,7 +3,6 @@ name: Claude Code Review
 on:
   pull_request:
     types: [opened, labeled]
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -11,6 +10,10 @@ permissions:
   issues: write
   id-token: write
 
+concurrency:
+  group: claude-review-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 jobs:
   review:
     name: Claude Code Review
diff --git a/.github/workflows/staging-ci.yml b/.github/workflows/staging-ci.yml
index 9aaf05e8..43244447 100644
--- a/.github/workflows/staging-ci.yml
+++ b/.github/workflows/staging-ci.yml
@@ -41,6 +41,8 @@ jobs:
 
       - name: Check for changes since last tested
         id: check
+        env:
+          FORCE_RUN: ${{ inputs.force }}
         run: |
           CURRENT_HEAD=$(git rev-parse HEAD)
           echo "current_head=${CURRENT_HEAD}" >> "$GITHUB_OUTPUT"
@@ -70,7 +72,7 @@ jobs:
           fi
 
           # Force override from workflow_dispatch
-          if [ "${{ inputs.force }}" = "true" ]; then
+          if [ "$FORCE_RUN" = "true" ]; then
             echo "Force run requested"
             HAS_CHANGES=true
             if [ -z "$DIFF_RANGE" ]; then
@@ -273,7 +275,8 @@ jobs:
             fi
 
             echo "Claude review status: ${STATUS} (${ELAPSED}s elapsed)"
-            sleep "$INTERVAL"
+            # Sleep in 1s increments so GitHub can cancel between iterations
+            for _i in $(seq 1 "$INTERVAL"); do sleep 1; done
             ELAPSED=$((ELAPSED + INTERVAL))
           done
 
@@ -371,9 +374,10 @@ jobs:
         id: evaluate
         env:
           PR_NUMBER: ${{ needs.create-promotion-pr.outputs.pr_number }}
+          SKIP_GATE: ${{ inputs.skip_claude_gate }}
         run: |
           HAS_BLOCKING="${{ steps.process-findings.outputs.has_blocking }}"
-          SKIP_INPUT="${{ inputs.skip_claude_gate }}"
+          SKIP_INPUT="$SKIP_GATE"
 
           if [ "$HAS_BLOCKING" = "true" ]; then
             echo "::warning::Claude review found blocking issues (CRITICAL ≥80 confidence)"
@@ -400,6 +404,8 @@ jobs:
         run: |
           if [ -n "$PR_NUMBER" ]; then
             echo "Merging promotion PR #${PR_NUMBER}"
+            # --delete-branch is safe: GitHub auto-retargets any chained PRs
+            # targeting this branch to the next base (verified in ironclaw-ci-test)
             gh pr merge "$PR_NUMBER" --merge --delete-branch
             echo "merged=true" >> "$GITHUB_OUTPUT"
           fi
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 14d10ef3..a37aaf70 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -145,7 +145,6 @@ jobs:
           fi
           # Gated jobs: must pass on promotion PRs / push, skipped on developer PRs
           for job in telegram-tests wasm-wit-compat docker-build windows-build version-check; do
-            result="${{ needs.telegram-tests.result }}"
             case "$job" in
               telegram-tests) result="${{ needs.telegram-tests.result }}" ;;
               wasm-wit-compat) result="${{ needs.wasm-wit-compat.result }}" ;;