claude-code-review.yml fails startup_failure: caller missing `actions: read` permission

[d-morrison]

What's broken

Every run of .github/workflows/claude-code-review.yml since #40 merged (repointing gha refs from d-morrison/gha to Morrison-Lab/gha) has failed with conclusion startup_failure and 0 jobs created — on both pull_request and workflow_dispatch triggers:

• https://github.com/Morrison-Lab/psw/actions/runs/30391038300 (pull_request, on the Repoint gha reusable workflows to Morrison-Lab/gha #40 branch itself)
• https://github.com/Morrison-Lab/psw/actions/runs/31343163967 (pull_request)
• https://github.com/Morrison-Lab/psw/actions/runs/31346942434 (workflow_dispatch)

Every run before #40 succeeded. check-links.yml and claude.yml, repointed in the same PR, are unaffected and still run fine.

Root cause

The run page's own error banner for the startup failure:

The nested job 'claude-review' is requesting 'actions: read', but is only allowed 'actions: none'.

Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v1's claude-review job declares:

permissions:
  contents: read
  pull-requests: write
  issues: write
  id-token: write
  actions: read   # lets claude-code-action install its github_ci MCP server

psw's caller job (.github/workflows/claude-code-review.yml) grants:

permissions:
  contents: read
  pull-requests: write
  issues: write
  id-token: write

— no actions: at all, which GitHub Actions treats as none and caps what the reusable workflow's job may request. Since the callee explicitly asks for actions: read, GitHub rejects the run at parse/startup time before any job is created.

check-links.yml's callee never requests actions:, and claude.yml's caller already grants actions: write (a superset of read), which is why those two repointed workflows are unaffected.

Fix

Add actions: read to the caller job's permissions: block. Also worth bumping the pin from @v1 to @v2 while touching this file: gha's own CLAUDE.md documents claude-code-review as one of the capabilities that moved to @v2 (@v1 is meant to be a frozen pre-2.0.0 snapshot), and Morrison-Lab/gha's current examples/claude-code-review.yml at @v2 already includes the same actions: read line verbatim — so the fix and the version bump are the same edit.

[d-morrison]

Working on this --- paws off until I'm done.

---

Generated by Claude Code

[d-morrison]

Fixed and merged in #44 (commit 5996bd3): the caller's permissions: block now grants actions: read, and the reusable workflow pin moved from @v1 to @v2. Verified end-to-end via a workflow_dispatch test on the fix branch before merge --- the callee's claude-review job ran to completion rather than failing startup_failure at graph-build time.

Unclaiming --- paws welcome.

---

Generated by Claude Code