Skip to content

Fail the bump fast on a bad Claude token #298

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Vilin97 merged 1 commit into from
Jul 28, 2026
Merged

Fail the bump fast on a bad Claude token #298

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 33 additions & 1 deletion .github/workflows/mathlib-bump.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,38 @@ jobs:
echo "Target: **$TARGET** (repair fan-out: $REPAIR)" >> "$GITHUB_STEP_SUMMARY"
fi

auth:
needs: detect
# Only gates the paid stage; the free probe runs regardless of the token.
if: needs.detect.outputs.found == 'true' && needs.detect.outputs.repair == 'true'
runs-on: ubuntu-latest
name: Preflight Claude auth
permissions:
contents: read
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
with:
persist-credentials: false

# A trivial round-trip. Without it an invalid or expired token is only
# discovered after the ~40-minute probe, by 99 repair jobs failing
# identically -- which is exactly how the first three runs were spent.
- uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
github_token: ${{ secrets.GITHUB_TOKEN }}
prompt: "Reply with exactly: AUTH_OK"
claude_args: >-
--max-turns 1
--model claude-sonnet-5

- name: Explain a failure
if: failure()
run: |
echo "::error::CLAUDE_CODE_OAUTH_TOKEN is invalid or expired." \
"Regenerate it with \`claude setup-token\` and update the secret," \
"then verify with the Claude auth check workflow."
Comment on lines +152 to +157

@greptile-apps greptile-apps Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Error message assumes auth is always the failure cause

The ::error:: annotation unconditionally tells the operator to regenerate the token, but the claude-code-action step can fail for reasons other than a 401 — for example, a malformed or unrecognised --model value returns a 4xx that is not an auth error. An operator following this message would regenerate a perfectly valid token and still see the same failure. Distinguishing "probable auth error" from a broader "Claude action failed" would make the diagnostic less misleading in those edge cases.


pin:
needs: detect
if: needs.detect.outputs.found == 'true'
Expand Down Expand Up @@ -291,7 +323,7 @@ jobs:
build.log

repair:
needs: [detect, triage]
needs: [detect, auth, triage]
if: needs.detect.outputs.repair == 'true' && needs.triage.outputs.has_breakage == 'true'
runs-on: ubuntu-latest
name: Repair ${{ matrix.project }}
Expand Down
Loading