Fail the bump fast on a bad Claude token

[Vilin97]

The canary from #297 gave a definitive answer in one minute:

Failed to authenticate. API Error: 401 OAuth access token is invalid.

Every one of the 99 repair jobs was failing on that. Discovering it cost a full ~40-minute probe build plus 99 doomed jobs — which is how three consecutive end-to-end runs were spent.

This adds the same one-minute round-trip as a preflight to mathlib-bump.yml. It gates only the paid repair stage and runs in parallel with pin/probe, so a bad token still produces the free per-project breakage report — that half of the workflow doesn't touch Claude at all.

Everything else in the pipeline is now confirmed working end to end: detect → pin → 10 probe shards → triage → assemble, which opened draft #295 with an honest "0 repairs applied" summary.

[greptile-apps]

Error message assumes auth is always the failure cause

The ::error:: annotation unconditionally tells the operator to regenerate the token, but the claude-code-action step can fail for reasons other than a 401 — for example, a malformed or unrecognised --model value returns a 4xx that is not an auth error. An operator following this message would regenerate a perfectly valid token and still see the same failure. Distinguishing "probable auth error" from a broader "Claude action failed" would make the diagnostic less misleading in those edge cases.

[greptile-apps]

Greptile Summary

This PR adds an auth preflight job to mathlib-bump.yml that fires a one-turn Claude round-trip immediately after detect, running in parallel with the free pin/probe stages. The repair job now lists auth in its needs array, so a bad or expired CLAUDE_CODE_OAUTH_TOKEN causes a fast, visible failure (~1 min) instead of being discovered only after the ~40-minute probe completes and all 99 repair jobs fail identically.

• New auth job: checks out the repo, calls anthropics/claude-code-action with --max-turns 1 and a trivial prompt, and emits an ::error:: annotation on failure explaining how to regenerate the token.
• repair dependency updated: needs: [detect, auth, triage] — GitHub Actions' implicit dependency checking ensures repair is skipped automatically when auth fails, without needing an explicit needs.auth.result guard in the if condition.

Confidence Score: 4/5

Safe to merge — the gating logic is correct and the only change is adding a fast preflight that makes existing auth failures surface earlier.

The workflow change is small and well-scoped. The auth → repair dependency chain behaves correctly: a failed auth blocks repair via GitHub Actions' implicit dependency skipping, while a skipped auth (when repair=false) cannot trigger repair because repair's own if condition guards on needs.detect.outputs.repair == 'true'. The one minor issue is that the Explain a failure error annotation unconditionally attributes failures to a bad token, when the action could also fail for other reasons (e.g. an unrecognised model name), potentially sending the operator on a wild-goose chase.

Files Needing Attention: Only .github/workflows/mathlib-bump.yml changed; the failure-annotation message on lines 155–157 is worth a second look.

Important Files Changed

Filename

Overview

.github/workflows/mathlib-bump.yml

Adds an auth preflight job that validates the Claude OAuth token before the costly repair fan-out; repair now lists auth in its needs array so a bad token blocks it immediately. One minor concern: the Explain a failure step's error annotation unconditionally blames a bad/expired token, but the action can also fail for non-auth reasons (e.g. an unrecognised model name), which would produce a misleading diagnostic.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    detect[detect\nIs there a new release?]
    auth[auth\nPreflight Claude auth\nNEW]
    pin[pin\nMove pins & plan shards]
    probe[probe\nBuild shards in parallel]
    triage[triage\nMerge logs → breakage map]
    repair[repair\nOne Claude job per broken project]
    assemble[assemble\nApply patches & open draft PR]

    detect -->|found=true & repair=true| auth
    detect -->|found=true| pin
    detect -->|found=true| probe
    pin --> probe
    probe --> triage
    auth -->|must succeed| repair
    triage -->|has_breakage=true & repair=true| repair
    detect --> repair
    triage --> assemble
    pin --> assemble
    repair --> assemble

    style auth fill:#d4edda,stroke:#28a745,color:#000

Loading

_{Reviews (1): Last reviewed commit: "Fail the bump fast on a bad Claude token" | Re-trigger Greptile}