Fix broken `@claude` handler (claude.yml finishes in 0s) + add workflow-edit guardrails

[izzywdev]

@claude — the repo's @claude handler (.github/workflows/claude.yml, using anthropics/claude-code-action) is BROKEN: it replies to every mention with "Claude finished … in 0s" and does no real work. This blocks cross-repo infra requests (e.g. #166 — provision the mendys DB role). Please investigate, fix, and add guardrails.

Evidence (from the failing run logs)

• Handler fetches the issue comment OK, then its change-detection phase runs GET /compare/main...claude/issue-166-<ts> → 404 "Branch does not exist remotely" → Error checking for changes in branch: HttpError: Not Found (compare two commits). The working branch was never created (Claude produced no commits) and the diff step assumes it exists, so it bails.
• The run also executes stray, irrelevant setup inside the Claude step: cd e2e && npm install && npx playwright install chromium --with-deps && npx playwright test — leftover e2e content in the handler's prompt / base command / loaded CLAUDE.md.
• NOT an Anthropic credit/key problem (step reports success in ~0s).

Phase 1 — Investigate which push broke it

• git log --oneline -30 -- .github/workflows/claude.yml (+ claude-auto-pr.yml, claude-ci-autofix.yml, ci-failure-triage.yml).
• git log -p -- .github/workflows/claude.yml: find when the anthropics/claude-code-action version/ref changed, when the prompt/direct_prompt/override_prompt/claude_args/settings changed, when an e2e/playwright command was introduced, or when trigger/base-branch/use_commit_signing/branch handling changed.
• git blame the lines producing the e2e commands and the branch/diff behavior; correlate commit dates with when the 0s behavior began (issue Provision dedicated mendys Postgres role + Mongo user (MendysRobotics prod blocked) #166 created 2026-07-07, first bad reply minutes later).
• Also check root CLAUDE.md / .github prompt files — the e2e commands may come from a loaded instruction file, not the YAML.
• Report the exact breaking commit + why.

Phase 2 — Fix

Restore a known-good config: correct/pinned action SHA that doesn't 404 on a no-op run, remove e2e/playwright leftovers from the prompt, fix branch handling so a no-change run doesn't crash on compare. Keep secrets as secrets. Minimal, reviewable diff.

Phase 3 — Guardrails (so an edit can't silently break the handler again)

1. actionlint (+ a claude-handler sanity check) as a REQUIRED status check on any PR touching .github/workflows/**.
2. CODEOWNERS requiring review for .github/workflows/** (esp. claude*.yml).
3. Pin third-party actions to full commit SHAs (comment the human-readable version) for the claude handlers.
4. A lightweight smoke check (scheduled/manual) that mentions @claude on a sandbox/labeled test issue and asserts a real, non-"0s" response — catches regressions fast.
5. Short "editing the @claude handlers" runbook (prompt do/don'ts, SHA-pin policy, how to test), consistent with the FuzeSDLC governance baseline.

Phase 4 — Verify & close the loop

• Re-trigger on a test issue / Provision dedicated mendys Postgres role + Mongo user (MendysRobotics prod blocked) #166 and confirm the handler does real work (branch + response, not 0s).
• Then action Provision dedicated mendys Postgres role + Mongo user (MendysRobotics prod blocked) #166: provision the dedicated mendys PostgreSQL role + mendys MongoDB user (mirroring fuzekeys/fuzesocial) and deliver creds to MendysRobotics as GH Actions secrets MENDYS_PG_USERNAME/MENDYS_PG_PASSWORD/MENDYS_MONGO_USERNAME/MENDYS_MONGO_PASSWORD via secure hand-off — never paste raw values.

Ship the handler fix and the guardrails as separate small PRs. Report the breaking commit.

Refs: izzywdev/MendysRobotics#134, FuzeInfra #166.

[claude]

Claude finished @izzywdev's task in 3m 36s —— View job • claude/issue-169-20260707-1311

---

@claude handler — investigation, status & remaining guardrails

Headline: the handler is already fixed and working — this reply is the proof. This run is executing on the corrected action SHA and did real work (checkout, investigation, a commit + branch), not a "0s" no-op.

• Read claude.yml + full workflow history
• Identify the breaking commit
• Confirm the fix is live
• Audit guardrails: done vs. remaining
• Ship the remaining guardrails I'm permitted to
• Report #166 status

---

Phase 1 — the breaking commit

Breaking commit: f6b7f10 — harden(ci): pin actions to SHAs + OS-level destructive-op guard shims.

It replaced the floating tag with a wrong SHA:

- uses: anthropics/claude-code-action@v1
+ uses: anthropics/claude-code-action@428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d # v1

428971d… was a dev/test commit in the action's own repo, not the v1.0.166 release. At that commit the action runs its own e2e Playwright suite inside the Claude step — that's the source of the stray cd e2e && npm install && npx playwright … test you saw; it came from the action's code at that SHA, not from this repo's prompt or CLAUDE.md. Result: Claude "finished in 0s", created no branch, and the downstream GET /compare/main...claude/issue-166-<ts> then 404'd because the branch never existed. Not a credit/key problem — exactly as you diagnosed.

Phase 2 — the fix (already merged)

Fixed in a5a007c (#167):

- uses: anthropics/claude-code-action@428971d2ecd6e3a7cb0ee0da2a3a8b33fdb3678d # v1
+ uses: anthropics/claude-code-action@f87768c6d25f92ae6efa7175e223ef77d4cbf97f # v1.0.166

f87768c… is the verified SHA that the upstream v1.0.166 tag points to. Applied consistently across all three usages (claude.yml, governance-nightly.yml, nightly-integration.yml). ✅ verified.

Phase 3 — guardrails audit

#	Guardrail	Status
1	actionlint gate on .github/workflows/**	✅ a5a007c — .github/workflows/actionlint.yml
2	CODEOWNERS review for claude*.yml + handlers	✅ a5a007c — CODEOWNERS
3	SHA-pin third-party actions (+ version comment)	✅ already pinned; + this PR adds .github/dependabot.yml so pins can't silently rot back onto a dev/yanked commit
4	Smoke check (mention @claude, assert non-"0s")	⚠️ this PR ships it as a ready-to-commit workflow in the runbook — see note below
5	"Editing the handler" runbook	✅ a5a007c — docs/claude-handler-hardening.md §4

On #4: the smoke check is a workflow file, and the GitHub App backing this handler cannot create/edit anything under .github/workflows/ (same limitation already documented in the runbook §2). So I've committed the full, drop-in claude-smoke.yml into docs/claude-handler-hardening.md §5 — a human just copies it to .github/workflows/claude-smoke.yml and points it at a sandbox issue. It posts @claude and fails if the reply is empty or matches finished … in 0s.

This PR (0f22435) adds — no workflow-file edits, so it's within my permissions:

• .github/dependabot.yml — github-actions weekly (guardrail fix(infra): resolve airflow/kafka-ui port clash and drop unrunnable healthchecks #3 durability; was referenced by workflow comments but missing).
• docs/claude-handler-hardening.md §5 — the smoke-check workflow + Dependabot note.

Phase 4 — verify & #166

• Handler works: demonstrated by this run (real work on SHA f87768c…). ✅
• #166 (mendys DB): already actioned in a5a007c — Postgres mendys_svc/mendys added to serviceDatabases (off by default in values.yaml; enabled:false placeholder in values-contabo.yaml), MongoDB mendys_app init script (docker/mongo/init/01-mendys.js), and MONGODB_PROVISIONING.md registry entry. It's waiting on MendysRobotics to (1) generate passwords, (2) seal mendys-db-credentials for namespace fuzeinfra + commit, (3) set the four MENDYS_PG_*/MENDYS_MONGO_* GH Actions secrets, then (4) flip enabled: true in values-contabo.yaml via PR. Track that on Provision dedicated mendys Postgres role + Mongo user (MendysRobotics prod blocked) #166 / MendysRobotics#134.

Create a PR

---

DONE: breaking commit = f6b7f10 (bad SHA 428971d… → the action's e2e suite ran → 0s). Fixed in a5a007c (#167); handler verified working by this run. Guardrails 1/2/3/5 already merged; #3 hardened + #4 shipped as a human-committable workflow in this PR. #166 already provisioned, awaiting MendysRobotics' sealed secret + secrets. The one item I cannot do is commit the workflow file itself (GitHub App can't modify .github/workflows/**) — hence the ready-to-paste snippet.
· branch claude/issue-169-20260707-1311