fix: Claude Code workflow systematically failing on PR triggers across org

[don-petry]

Summary

The Claude Code Action workflow fails on PR-triggered runs across multiple repos, even after the recent fix (adding checkout step).

Affected Repos

Repo	Failed Run
broodly	24010943408
markets	24010971650
TalkTerm	24010968392
ContentTwin	(multiple)

Context

PRs were recently merged to add a checkout step to the Claude workflow for issue-triggered mode (broodly#70, google-app-scripts#120, markets#54, TalkTerm#49, ContentTwin#31). However, failures persist on PR triggers.

Recommended Actions

1. Review the Claude Code Action workflow configuration in standards/workflows/ or the claude.yml shared workflow
2. Check if the claude GitHub App token has correct permissions for PR operations
3. Verify the anthropics/claude-code-action version compatibility (currently pinned to v1)
4. Test with a fresh PR after investigation

Context

Identified during weekly org CI/Security survey on 2026-04-05.

[claude]

Claude finished @don-petry's task in 10m 47s —— View job • claude/issue-33-20260406-0321 • Create PR ➔

---

Done

Root cause confirmed: The recent org-wide PRs (broodly#70, markets#54, etc.) added a Checkout repository step only to the claude-issue job but left the claude job (PR reviews / @claude mentions) without one. claude-code-action reads CLAUDE.md and AGENTS.md from the working tree — without checkout it errors on every PR-triggered run.

Changes pushed to claude/issue-33-20260406-0321:

• standards/workflows/claude.yml (new): Canonical copy-paste template with checkout in both jobs (claude and claude-issue), matching the other templates in standards/workflows/. Includes a prominent comment noting both jobs need checkout.
• standards/ci-standards.md: Replaced the ~100-line inline YAML block with a reference to the new template file to prevent doc/template drift. Added a visible callout that both jobs must have a checkout step.
• scripts/compliance-audit.sh: New check_claude_workflow_checkout() function detects any repo whose claude job is missing checkout and raises an error finding. Wired into the main audit loop — the weekly scan will now auto-surface affected repos and create labeled issues to drive remediation.

[claude]

Claude finished @don-petry's task in 7m 23s —— View job • claude/issue-33-20260406-0341 • Create PR ➔

---

Fixing Claude Code workflow PR trigger failures

Root cause: The claude job (PR reviews / @claude mentions) was missing the checkout step in affected repos. The recent org-wide PRs only added checkout to claude-issue, not claude. claude-code-action reads CLAUDE.md/AGENTS.md from the working tree — without checkout it errors on every PR-triggered run.

• Gather context and read standards
• Analyze root cause
• Add standards/workflows/claude.yml — canonical template with checkout in both jobs, with REQUIRED annotations
• Add check_claude_workflow_checkout() to scripts/compliance-audit.sh — detects any repo where claude or claude-issue is missing checkout; wired into the main audit loop
• Update standards/ci-standards.md — added callout + pointer to the new template
• Commit, push, create PR
• Self-review — no issues found
• CI green — all checks passing (ShellCheck, Lint, Agent Security Scan, CodeQL, SonarCloud, Dependency audit, Claude Code)

Done

PR #63 is ready for review. No CODEOWNERS file found in this repo — @don-petry please review and merge.

• claude/issue-33-20260406-0341