Skip to content

memory: confirm two documented MCP/gha gotchas recur in Morrison-Lab/psw - #1374

Merged
d-morrison merged 7 commits into
mainfrom
docs/confirm-permission-and-b64-gotchas
Aug 10, 2026
Merged

memory: confirm two documented MCP/gha gotchas recur in Morrison-Lab/psw#1374
d-morrison merged 7 commits into
mainfrom
docs/confirm-permission-and-b64-gotchas

Conversation

@d-morrison

@d-morrison d-morrison commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator

Summary

While debugging a startup_failure on Morrison-Lab/psw's claude-code-review.yml (Morrison-Lab/psw#43/#44), I hit two failures both already documented in this corpus. Rather than add new bullets (which would duplicate existing coverage), this appends a confirming case + new symptom detail to each existing entry:

  • memories/gha-reusable-workflow-permissions.md --- the permissions-cascade startup_failure shape recurred with actions: read (not issues: read/write as in the original d-morrison/qwt#135 case), confirming it isn't repo-specific (this exact gap had also already hit ai-config itself, per ai-config#224 --- so three occurrences now, cross-linked), and confirming a plain WebFetch on the run's html_url reliably surfaces the Annotations panel text.
  • memories/github-mcp-tools.md --- the create_or_update_file base64-content mistake recurred with a different downstream symptom: an inflated size (2310 vs 1710 bytes, the base64 expansion ratio) rather than a truncated one, and a GitHub Actions dispatch-time 422 Workflow does not have 'workflow_dispatch' trigger rather than startup_failure, since the corrupted file parsed as a bare scalar with no on: mapping at all.

A review round (thanks!) caught a real error in the first draft: an "elsewhere in this file" self-reference in github-mcp-tools.md that pointed nowhere, since the shape it named actually lives in the sibling file. Fixed.

While recovering from a self-inflicted third mistake on this same branch (a create_or_update_file call that accidentally sent a placeholder instead of real content --- caught immediately via content.size), I confirmed git push works from a local clone in this session for a non-harness-assigned branch, which sidesteps the whole class of content-parameter mistakes. Recorded as a third case + a generalizable recommendation in github-mcp-tools.md.

Test plan

  • Every edit is a pure addition to existing bullets --- no pre-existing text changed except the one review-flagged self-reference fix.
  • Verified byte-exact via git hash-object against a local clone for every commit on this branch (including the placeholder-mistake recovery, whose final content matched the precomputed hash exactly).
  • No banned punctuation (em-dash/en-dash/curly quotes/multiplication sign) or multi-sentence lines in any added text.

Hit the same startup_failure shape this file already documents (a
caller under-granting a permission the nested job requests), this
time actions: read rather than issues: read/write, in
Morrison-Lab/psw's claude-code-review.yml caller. Confirms the pattern
isn't d-morrison/qwt-specific and that a plain WebFetch on the run's
html_url reliably surfaces the Annotations text.
Hit the already-documented create_or_update_file base64 mistake again
on Morrison-Lab/psw#44, this time producing an inflated size (not a
truncated one) and a different downstream GitHub Actions symptom
(dispatch-time "no workflow_dispatch trigger" plus a generic failure
conclusion, rather than startup_failure). Appends to the existing
bullet rather than duplicating it.
@d-morrison
d-morrison requested a balanced review from Copilot August 10, 2026 02:07

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@d-morrison

Copy link
Copy Markdown
Collaborator Author

@claude reveiw

@d-morrison

Copy link
Copy Markdown
Collaborator Author

@claude review

@github-actions

Copy link
Copy Markdown
Contributor

👀 Picked up by workflow run #31354023902. Setup runs first; Claude itself responds after that.

@github-actions

Copy link
Copy Markdown
Contributor

API Error: Usage credits required for 1M context · turn on usage credits at claude.ai/settings/usage, or use --model to switch to standard context

— posted by @claude post-step from workflow run

@github-actions

Copy link
Copy Markdown
Contributor

👀 Picked up by workflow run #31354030943. Setup runs first; Claude itself responds after that.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

d-morrison and others added 3 commits August 9, 2026 21:16
Review finding: "covered elsewhere in this file" was false --- the
permissions-cascade startup_failure shape is documented in the sibling
file, memories/gha-reusable-workflow-permissions.md, not in this file.
Point at it explicitly, matching this corpus's existing cross-file-link
convention.
The previous commit on this branch replaced this file's entire content
with a literal placeholder string due to a tool-call construction error
--- caught immediately by the response's content.size (21 bytes). This
restores the intended content: the base64-corruption case-record
addition plus the review-requested cross-file-link fix for the false
"covered elsewhere in this file" self-reference.
Optional review suggestion: memories/github-actions.md already documents
an identical actions:read omission (same four granted permissions, same
error shape) from ai-config#224, in ai-config itself rather than a
downstream consumer. Cross-link it so the "confirming this isn't
d-morrison/qwt-specific" framing reflects three occurrences, not two.

Copy link
Copy Markdown
Collaborator Author

Both addressed in 158d311:

  • Finding (github-mcp-tools.md#L393-L396): fixed --- "covered elsewhere in this file" now points at gha-reusable-workflow-permissions.md explicitly, per the suggested diff.
  • Optional observation (gha-reusable-workflow-permissions.md): added --- cross-linked ai-config#224/github-actions.md and corrected the "confirming this isn't d-morrison/qwt-specific" framing to reflect three occurrences (this repo included), not two.

(An earlier commit on this branch briefly replaced github-mcp-tools.md's entire content with a placeholder string due to a tool-call construction slip on my end --- caught immediately via the response's content.size, then fixed. The final diff against main is clean; verified byte-exact via git hash-object against a local clone.)


Generated by Claude Code

… fix

This same session's follow-up correction to the two case records above
sent a literal placeholder string instead of the intended content --- a
plain construction mistake, not an encoding one, caught immediately via
content.size. Record it as a third instance of the family, and note the
generalizable remedy discovered while recovering from it: a local git
clone plus a real `git push` (confirmed working in this session for a
non-harness-assigned branch) avoids the whole class of content-parameter
mistakes, since the pushed content is exactly what git diff/hash-object
show rather than something reconstructed inside a tool-call parameter.
@d-morrison

Copy link
Copy Markdown
Collaborator Author

@claude review

@github-actions

Copy link
Copy Markdown
Contributor

👀 Picked up by workflow run #31359188671. Setup runs first; Claude itself responds after that.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

Review finding: no earlier entry in this file (or anywhere in the
corpus) documents the git-clone-with-sparse-checkout technique this
parenthetical claimed to point at --- the technique was used earlier
in the same debugging session but never actually written down as its
own bullet. Drop the dangling reference; the command is self-explanatory.

Copy link
Copy Markdown
Collaborator Author

Fixed in 6ac1c6b --- dropped the dangling "(the entry above)" parenthetical. You're right that no such entry exists: the git-clone-with-sparse-checkout technique was used earlier in this debugging session but never actually written into the corpus as its own bullet, so the cross-reference pointed at nothing. The command reads fine on its own without it.


Generated by Claude Code

@dem-extra1

Copy link
Copy Markdown
Collaborator

@claude review

@github-actions

Copy link
Copy Markdown
Contributor

👀 Picked up by workflow run #31362985252. Setup runs first; Claude itself responds after that.

@github-actions

Copy link
Copy Markdown
Contributor

Claude finished reviewView run


Code review: #1374

This is a confirming review. I independently re-verified the current PR state (head 6ac1c6b13c80cfbc15f489353286df54def3aec0) rather than trusting the prior rounds' self-reported fixes, and found no new issues.

Both prior rounds' findings are now resolved:

  1. Round 1's finding (false "covered elsewhere in this file" self-reference in memories/github-mcp-tools.md) — fixed in 8e7a2526, confirmed still correct in the current diff: it now points to [gha-reusable-workflow-permissions.md](gha-reusable-workflow-permissions.md), which I verified does contain the startup_failure/permissions-cascade content it claims to.

  2. Round 2's finding (comment, posted 2026-08-10T05:46:42Z) — a dangling "(the entry above)" cross-reference pointing at nothing. This was fixed in the very next commit, 6ac1c6b1 ("fix: drop dangling "(the entry above)" cross-reference", pushed 05:48:35Z, two minutes after that review ran). I confirmed against the current full diff that the parenthetical is gone — the sentence now reads cleanly: `git clone --depth 1 --filter=blob:none --sparse` plus `git push` from that clone worked in this same session, with no dangling pointer.

Fresh verification of content added since round 2's review (commits 158d311d and the d1d02a196ac1c6b1 fix pair):

  • ai-config#224 citation in gha-reusable-workflow-permissions.md: confirmed via gh pr view 224 — merged, titled "Fix claude-review workflow startup_failure: grant actions: read", matches the claimed content exactly.
  • Morrison-Lab/psw#43/#44 citations: confirmed — #43 is a closed issue titled "claude-code-review.yml fails startup_failure: caller missing actions: read permission", #44 is a merged PR titled "Fix claude-code-review.yml startup_failure: grant actions: read, pin @v2" — matches the PR's claims precisely.
  • New [github.md](github.md) citation ("the proxy allows branch creation/push but BLOCKS branch deletion"): confirmed verbatim at memories/github.md:606.
  • New [github-actions.md](github-actions.md) citations ("403 caveat" and "fully READ-ONLY" entries): both confirmed — the "403 caveat" bullet and the "A session can be fully READ-ONLY on a repo" bullet both exist and accurately describe what's cited.
  • The "~50KB file" claim: the live file is 49,426 bytes (≈48.3KB) — a reasonable approximation, and this is evidentiary/session-observational text (what was actually observed), not a config value needing precision.
  • No banned non-ASCII punctuation (em/en-dash, curly quotes, ×) in any added line — scanned directly.
  • Both touched memory files remain well under the 1200-line memories/ size gate.

CI and merge state: validate (both runs) and new-line-breaks / check-new-line-breaks (both runs) all report SUCCESS. mergeStateStatus: CLEAN, mergeable: MERGEABLE. The only formal review on the PR is a Copilot quota refusal ("Copilot was unable to review this pull request because the user who requested the review has reached their quota limit") — not a substantive review, and no CHANGES_REQUESTED state exists anywhere on the PR.

No new findings from this round.

Verdict

Ready for merge — both prior rounds' findings (the false "elsewhere in this file" self-reference, and the dangling "(the entry above)" reference) are fixed and independently re-verified against live content. All new content added since the last review round checks out factually. CI is green and the PR is clean/mergeable.

@github-actions

Copy link
Copy Markdown
Contributor

💰 Cost: $5.9861 (review) — run

@d-morrison
d-morrison merged commit b023123 into main Aug 10, 2026
4 checks passed
@d-morrison
d-morrison deleted the docs/confirm-permission-and-b64-gotchas branch August 10, 2026 06:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants