[ci] Make @claude handler auto-open a draft PR (issue→PR autonomy)

[izzywdev]

@claude

Context / why: Right now .github/workflows/claude.yml runs anthropics/claude-code-action@v1 with only anthropic_api_key (default mode), so when you resolve an issue you push a claude/issue-* branch and post a "Create PR" link but never open the PR. That breaks the autonomous issue→PR→merge flow (a human has to click "Create PR"). Confirmed from run logs — no error, it's just the default behavior.

Requested change — make issue→PR autonomous (open a DRAFT PR automatically):
Update .github/workflows/claude.yml so that after the action pushes its branch, a draft PR against main is opened automatically and linked back on the issue. Implement whichever is most reliable for the pinned action version:

• pass a prompt/claude_args that instructs the agent to run gh pr create --draft --fill (and allow the Bash(gh pr create:*) tool), or
• add a follow-up workflow step / a small companion workflow (on: push to claude/**) that runs gh pr create --draft if no PR exists for that branch.

Keep it a draft PR (preserve the human review gate — do not auto-merge). Permissions are already contents/pull-requests/issues: write. Validate with actionlint.

Note (bootstrap): the PR for THIS issue will still need one manual open since the fix isn't live yet — that's expected and one-time.

On completion: open the (draft) PR and post its link here.

[claude]

Claude finished @izzywdev's task in 2m 32s —— View job • Create PR ➔

---

Task: Auto-open a draft PR for claude/** branches

• Read current .github/workflows/claude.yml
• Design the most reliable approach (companion on: push workflow)
• Write the companion workflow
• Review for correctness (YAML + shell logic)
• Attempt commit & push
• ❌ Blocked: GitHub App cannot push to .github/workflows/**

---

⚠️ I can't push this one — and it's a one-time bootstrap, exactly as you predicted

The commit is ready, but the push was rejected by GitHub:

! [remote rejected] refusing to allow a GitHub App to create or update workflow
  `.github/workflows/claude-draft-pr.yml` without `workflows` permission

The claude-code-action GitHub App is intentionally not granted the workflows permission, so I cannot create or modify any file under .github/workflows/. This is the same boundary that requires a human to add the fix for this issue (the bootstrap note in your issue). Once this file is merged by a human, all future claude/** branches will get their draft PR automatically.

✅ The fix — add this file manually

Create .github/workflows/claude-draft-pr.yml with this content:

name: Auto Draft PR for Claude branches

# When @claude (claude-code-action) resolves an issue it pushes a `claude/**`
# branch but stops at a "Create PR" link. This companion workflow closes that
# gap: on every push to a `claude/**` branch it opens a DRAFT PR against main
# (if one does not already exist), preserving the human review gate.
#
# Note: this fires because the branch is pushed using the action's GitHub App
# token (not this workflow's GITHUB_TOKEN), so the `push` event is delivered.
on:
  push:
    branches:
      - 'claude/**'

jobs:
  open-draft-pr:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Open draft PR if none exists
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          BRANCH: ${{ github.ref_name }}
        run: |
          set -euo pipefail

          # Skip if an open PR already exists for this branch.
          existing="$(gh pr list --head "$BRANCH" --state open --json number --jq 'length')"
          if [ "$existing" != "0" ]; then
            echo "An open PR already exists for ${BRANCH}; nothing to do."
            exit 0
          fi

          # Derive a title from the latest commit and link back to the issue
          # when the branch name encodes it (claude/issue-<n>-...).
         
          body="Auto-opened draft PR for \`${BRANCH}\`."
          issue_num="$(printf '%s' "$BRANCH" | grep -oE 'issue-[0-9]+' | grep -oE '[0-9]+' || true)"
          if [ -n "$issue_num" ]; then
            body="${body}"$'\n\n'"Refs #${issue_num}"
          fi

          gh pr create \
            --draft \
            --base main \
            --head "$BRANCH" \
            --title "$title" \
            --body "$body"

Why the companion-workflow approach (vs. the claude_args option)

Both options you listed live under .github/workflows/, so both require a manual bootstrap regardless. I chose the standalone on: push workflow because it is the more reliable of the two:

• Deterministic — it always runs after a push, independent of whether the agent decided to call gh pr create.
• Decoupled — no change to the working claude.yml; no extra tool-allowlist/claude_args surface to maintain.
• Idempotent — the gh pr list --head ... --jq length guard means re-pushes (the common case for @claude follow-ups) never create duplicate PRs.
• Draft-only — opens --draft against main and never merges, preserving your human review gate. It links back to the issue via Refs #<n> parsed from the branch name.

This fires correctly because claude-code-action pushes branches with its GitHub App token, and pushes from App/PAT tokens do trigger on: push workflows (unlike the default GITHUB_TOKEN).

Notes

• I could not run actionlint — the sandbox here blocks network installs and the binary isn't preinstalled. I hand-reviewed the YAML/shell instead. Please run actionlint locally (or rely on the CI lint) before merging; I expect it clean.
• This is the bootstrap case you flagged: I can't open the draft PR for this issue either, since the fix isn't live yet. Please add the file above and open the draft PR manually — after that, the flow is autonomous.

⚠️ The "Create a PR" link above will be empty until the workflow file is committed to this branch by a human (my push was rejected). Easiest path: copy the YAML block into .github/workflows/claude-draft-pr.yml on a new branch/commit yourself and open the draft PR.
· branch claude/issue-32-20260622-0004

[izzywdev]

Resolved — .github/workflows/claude-auto-pr.yml exists and implements the @claude issue→draft-PR autonomy this asked for. (Auto-closing manually: the @claude handler had no issue-closing step and the PR didn't use a Closes #32 keyword — that gap is being addressed separately.)

[claude]

Claude finished @izzywdev's task in 31s —— View job

---

Verified — issue→draft-PR autonomy is in place ✅

Confirmed .github/workflows/claude-auto-pr.yml exists on this branch and implements exactly what this issue asked for. No further changes needed.

• Read current workflow setup (claude.yml)
• Confirm companion workflow claude-auto-pr.yml exists
• Verify it satisfies the issue's requirements

What the workflow does

on:
  push:
    branches:
      - 'claude/**'

On every push to a claude/** branch it opens a draft PR against the repo's default branch when none already exists:

• Draft-only — gh pr create --draft ... --fill, preserving the human review gate (no auto-merge), as the issue required.
• Idempotent — guards with gh pr list --head "$BRANCH" --state open so re-pushes (the common @claude follow-up case) never create duplicate PRs.
• Safe on empty branches — only opens a PR when origin/$BASE..origin/$BRANCH has commits ahead.
• Correct trigger — fires because claude-code-action pushes branches with its GitHub App token, and App-token pushes do deliver on: push events (the default GITHUB_TOKEN would not).
• Right permissions — contents: read, pull-requests: write.

This is a refinement over the YAML originally drafted in the earlier comment (uses --fill for the title/body and default_branch instead of a hardcoded main), and it's already committed, so the bootstrap gap is closed. All future claude/** branches will get their draft PR automatically.

Note on the closure remark: you mentioned the @claude handler has no issue-closing step and the PR didn't use a Closes #32 keyword. That's a separate concern from this issue's scope (auto-opening the draft PR), so I've left it alone here — correctly tracked separately as you noted.
• branch claude/issue-32-20260624-1923