fix(claude-review): skip cleanly when a commit has no unique open PR (stop red 'main' review runs)

[crowecawcaw]

Summary

The Claude PR-review reviewer is not running on post-merge/main changes — but its Actions runs look like it is, and that is the problem this fixes.

What's actually happening

• Reviews are only ever started by the collect workflow, which triggers on pull_request: [opened, synchronize]. There is no push trigger, so a merge to main cannot start a review.
• The review stage (Stage 2) is a workflow_run workflow. GitHub always runs a workflow_run file from the repo's default branch and labels the run with that branch — so every review run shows up as Claude PR Review · main, regardless of which PR it reviewed. That's cosmetic, not behavioral.
• The PR-resolution guard requires the trusted head SHA to map to exactly one open PR. When it can't (the PR was merged/closed by the time the workflow_run fired — common with dependabot rebasing several branches onto a freshly-merged tip, or force-push/close races), it exited 1.

The result: a stream of red ❌ "Claude PR Review · main" runs that read as broken post-merge reviews, even though the guard was correctly refusing to review anything and posting nothing. (Concrete example: openjd-rs run #28974565722 failed at "Resolve and validate PR from trusted head SHA" with found 0; every downstream step — checkout, Bedrock auth, agent — was skipped.)

The change

Downgrade only the "0 or >1 open PRs" case — an absence of work, not a forged input — to a clean skip:

• set resolved=false, emit a ::notice::, and exit 0;
• gate every downstream step (Collect prior review state, PR-head checkout, symlink strip, base fetch, tooling checkout, Bedrock token install, OIDC creds, token mint, and the agent) on steps.meta.outputs.resolved == 'true'.

The run now finishes green/neutral with nothing posted, instead of red.

Security property unchanged

Nothing is reviewed or posted unless a unique open PR is resolved from the trusted workflow_run payload. This is not a relaxation of the guard:

• a malformed head_sha, or a resolved PR whose pr_number/base_sha fail validation, is a real integrity problem and still hard-fails (exit 1);
• only the benign "no unique open PR to review" case becomes a clean skip.

Testing

• All four branches of the resolution logic simulated locally: count=0 → skip, count=2 → skip, count=1 valid → resolved=true, count=1 with bad base SHA → hard-fail. ✅
• YAML validated; all 8 downstream steps gated, the resolve step itself ungated. ✅

Note

Follow-up (caller-side, in each consuming repo): the collect trigger churn from dependabot rebases is what generates these no-op review runs in the first place. Narrowing that is a separate change in the caller workflows, not this reusable one.

🤖 Drafted with Claude Code