Label-driven dev loop: triage → plan → implement → red-team → human merge

1name: Dev Loop2on:3  issues:4    types: [opened, labeled]5  pull_request:6    types: [labeled]7permissions:8  contents: write9  issues: write10  pull-requests: write11  id-token: write12jobs:13  triage:  # new issue -> label triage/planning14    if: github.event_name == 'issues' && github.event.action == 'opened'15    runs-on: ubuntu-latest16    steps:17      - uses: actions/checkout@v618      - uses: anthropics/claude-code-action@v119        with:20          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}21          prompt: |22            REPO: ${{ github.repository }}  ISSUE: ${{ github.event.issue.number }}23            Triage this issue. If it is actionable, run:24            gh issue edit ${{ github.event.issue.number }} --add-label planning25            Otherwise comment asking for missing info and add label triage.26          claude_args: |27            --allowedTools "Bash(gh issue view:*),Bash(gh issue edit:*),Bash(gh issue comment:*)"2829  plan:  # label planning -> post plan, then label ready (human can veto)30    if: github.event_name == 'issues' && github.event.label.name == 'planning'31    runs-on: ubuntu-latest32    steps:33      - uses: actions/checkout@v634      - uses: anthropics/claude-code-action@v135        with:36          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}37          prompt: |38            REPO: ${{ github.repository }}  ISSUE: ${{ github.event.issue.number }}39            Read the code and post an implementation plan as an issue comment (files, steps, tests).40            Do NOT add the ready label; a human adds it to approve the plan.41          claude_args: |42            --allowedTools "Read,Grep,Glob,Bash(gh issue view:*),Bash(gh issue comment:*)"4344  implement:  # human adds ready -> Claude implements and opens PR45    if: github.event_name == 'issues' && github.event.label.name == 'ready'46    runs-on: ubuntu-latest47    steps:48      - uses: actions/checkout@v649      - uses: anthropics/claude-code-action@v150        with:51          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}52          label_trigger: "ready"53          branch_prefix: "claude/"54          prompt: |55            Implement the approved plan in the issue comments. Run tests.56            Open a PR that says "Closes #${{ github.event.issue.number }}" and add label review-red-team to the PR.5758  red_team:  # PR labeled review-red-team -> a DIFFERENT agent attacks it59    if: github.event_name == 'pull_request' && github.event.label.name == 'review-red-team'60    runs-on: ubuntu-latest61    permissions:62      contents: read63    outputs:64      verdict: ${{ steps.codex.outputs.final-message }}65    steps:66      - uses: actions/checkout@v567        with:68          ref: refs/pull/${{ github.event.pull_request.number }}/merge69          persist-credentials: false70      - id: codex71        uses: openai/codex-action@v172        with:73          openai-api-key: ${{ secrets.OPENAI_API_KEY }}74          permission-profile: ":read-only"75          prompt: |76            You are a red-team reviewer. Try to break PR #${{ github.event.pull_request.number }}:77            edge cases, security, missing tests, plan drift. End with a line VERDICT: PASS or VERDICT: FAIL.7879  hand_off:  # post verdict, move to in-review; a human merges80    needs: red_team81    runs-on: ubuntu-latest82    permissions:83      pull-requests: write84    steps:85      - env:86          GH_TOKEN: ${{ github.token }}87          VERDICT: ${{ needs.red_team.outputs.verdict }}88          PR: ${{ github.event.pull_request.number }}89        run: |90          gh pr comment "$PR" -R "${{ github.repository }}" --body "$VERDICT"91          if echo "$VERDICT" | grep -q "VERDICT: PASS"; then92            gh pr edit "$PR" -R "${{ github.repository }}" --remove-label review-red-team --add-label in-review93          fi94          # No auto-merge: a human reviews in-review PRs and merges.