Skip to content

review: the Claude review calls babel on epyc with the key ci, so it reads no setup token - #60

Merged
rubas-agent[bot] merged 6 commits into
mainfrom
review-on-babel
Oct 26, 2026
Merged

rubas-agent[bot] merged 6 commits into
mainfrom
review-on-babel

Conversation

@rubas-agent

@rubas-agent rubas-agent Bot commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

Before. The Claude review reads the setup tokens in Infisical r-ci-repo prod:/claude-review and tries up to three accounts. One of them, CLAUDE_CODE_OAUTH_TOKEN_2, gets:

403 permission_error: OAuth authentication is currently not allowed for this organization.

Problem. The three <owner>/ci repos moved their reviews to babel on epyc today (rubas/ci#130), so this workflow is the last reader of prod:/claude-review, and those logins are due to go. kagi is public and rubas/ci is private, so kagi cannot call the shared review and keeps its own copy.

After. One Claude review step calls http://epyc.rubas.dev:8787 with the babel key ci and the pool sentinel from prod:/babel, set up as in rubas/ci#130, and babel picks the account. The action moves from v1.0.231 to v1.0.248, the pin of rubas/ci.

Before After
Logins read up to 3 setup tokens 1 babel key
Review steps 3 attempts and a fail step 1
Workflow lines 282 223
Details

classify_inline_comments is off. In v1.0.248, post-buffered-inline-comments.ts sends ANTHROPIC_API_KEY straight to https://api.anthropic.com/v1/messages and ignores ANTHROPIC_BASE_URL, so the classifier would send the babel key to Anthropic. Every inline comment now posts at once, as before the buffering.

The prompt step is gone: it existed so that three attempts could share one prompt. .github/actionlint.yaml names the runner label incus, as in rubas/ci.

The identity ci-review in rubas/ops infisical/review.tf keeps rubas/kagi/.github/workflows/claude-code-review.yml@*, because a PR run's ref is refs/pull/<n>/merge. This PR's own review run is the test.

rubas added 6 commits October 26, 2026 18:50
…y ci, so babel picks the account

The copy stays, because this repo is public and cannot call a workflow or
an action of the private rubas/ci. It now reads BABEL_KEY and
BABEL_POOL_SENTINEL from r-ci-repo prod:/babel, as rubas/ci#130 does, and
no longer reads prod:/claude-review. One review step replaces the three
account attempts and the step that failed the job after them. The action
moves to v1.0.248 and uses the CLI and the Bun of the runner image.
…p the classifier, which would send the babel key to Anthropic
… ended the turn on claude-opus-5 before any request
…0.14.3

wreq-util 0.2.0 needs zstd ^0.13.3, so cargo update cannot reach the fixed
versions. Its calls reach none of the affected functions.
@rubas-agent
rubas-agent Bot merged commit 5bf2509 into main Oct 26, 2026
3 checks passed
@rubas-agent
rubas-agent Bot deleted the review-on-babel branch October 26, 2026 18:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant