fix(skills): fail-fast on tool permission errors in CI

[worktrunk-bot]

Summary

• Adds explicit guidance to the running-in-ci skill: when a tool call (Edit, Write) is denied by the permission system, do not retry — fall back immediately to git apply, sed, or posting code in a comment.

Evidence

Pattern: Bot retries Edit tool 2-3 times on permission denial before switching to an alternative approach, wasting tool calls.

Occurrences: 4 total across CI sessions (tracked in #1611 as "Repeated Edit failures before sed fallback")

• This run observed the review-reviewers bot (run 23383198006) retry Edit 3 times on SKILL.md before falling back to git apply
• 3 prior occurrences documented in tracking issue review-reviewers tracking: 2026-03 #1611

Gate assessment:

• Evidence level: High (consistent pattern, 4 occurrences)
• Change type: Targeted fix (6-line section addition)
• Both gates pass

Test plan

• Verify the guidance is clear and actionable
• Observe future CI sessions for reduced Edit retries on permission errors

🤖 Generated with Claude Code

[max-sixty]

why is the permission failing? it should have plenty permission for Edit etc — does it not?

[worktrunk-bot]

Good question. Looking at the session log from run 23383198006, the exact error was:

Claude requested permissions to write to /home/runner/work/worktrunk/worktrunk/.claude/skills/running-in-ci/SKILL.md, but you haven't granted it yet.

This happened 3 times before the bot fell back to git apply.

The workflow has Edit in --allowedTools, which makes the tool available, but doesn't pre-approve specific file writes — Claude Code still prompts for per-file write approval, and in CI there's no user to approve. The claude-code-action must be handling this as a denial.

So you're right that the permission should work. The real fix is likely configuring claude-code-action to pre-approve edits (e.g., via --permission-mode or equivalent), rather than adding skill guidance to work around it. I'll close this PR — the guidance is a band-aid for what's actually a configuration gap.

[max-sixty]

ah, this is a new block from Claude Code, which is annoying. Hopefully they fix it. Let's leave this open for a few days

[worktrunk-bot]

Sounds good, will leave it open. If the upstream Claude Code fix lands, we can close this as unnecessary.

[max-sixty]

Superseded by tend extraction (#1676). Target file (.claude/skills/running-in-ci/SKILL.md) no longer exists. Can be filed on tend if the issue recurs.

[worktrunk-bot]

Acknowledged — closing is the right call since the target file moved with the tend extraction. If the permission issue recurs in tend, we can file it there.