Restore Claude release session reports (#1314)

* Restore Claude release session reports

* Redact credentials from Claude session reports

---------

Co-authored-by: Dan Barr <6922515+danbarr@users.noreply.github.com>

Author: danbarr

.github/workflows/_static-checks.yaml

@@ -32,7 +32,7 @@ jobs:
         run: python3 -m unittest discover -s .github/scripts -p 'test_*.py'
 
       - name: Test release docs helpers
-        run: node --test scripts/upstream-release/render-pr-body.test.mjs scripts/upstream-release/workflow.test.mjs
+        run: node --test scripts/upstream-release/render-pr-body.test.mjs scripts/upstream-release/workflow.test.mjs scripts/upstream-release/post-session-report.test.mjs
 
       - name: Test screenshot summary helpers
         run: node --test scripts/update-pr-screenshot-summary.test.mjs scripts/pr-screenshot-workflow.test.mjs

.github/workflows/upstream-release-docs.yml

@@ -709,8 +709,19 @@ jobs:
           " 2>/dev/null || true)
           echo "dirs=$DIRS" >> "$GITHUB_OUTPUT"
 
+      # Load the reporter from the same trusted revision as this workflow,
+      # before either session can edit files in the PR checkout.
+      - name: Prepare session reporter
+        id: session_reporter
+        env:
+          WORKFLOW_SHA: ${{ github.workflow_sha }}
+        run: |
+          REPORTER=$(mktemp "$RUNNER_TEMP/release-session-report.XXXXXX.mjs")
+          git show "$WORKFLOW_SHA:scripts/upstream-release/post-session-report.mjs" > "$REPORTER"
+          echo "path=$REPORTER" >> "$GITHUB_OUTPUT"
+
       # Dispatch runs do not support Claude's live tracking comments.
-      # Post explicit started/completed comments for reviewers instead.
+      # Publish each final response explicitly after its session finishes.
       - name: Post skill-started comment
         if: github.event_name == 'workflow_dispatch' && steps.eff.outputs.number != ''
         env:
@@ -856,6 +867,20 @@ jobs:
         if: always() && steps.generation_token.outcome == 'success'
         run: git remote set-url origin "https://github.com/$GITHUB_REPOSITORY.git"
 
+      # Publish immediately: editorial overwrites the shared execution file.
+      # Use the job token so reporting does not depend on session credentials.
+      - name: Post generation report
+        if: always() && steps.eff.outputs.number != '' && (steps.skill_gen.outcome == 'success' || steps.skill_gen.outcome == 'failure')
+        continue-on-error: true
+        env:
+          REPORTER: ${{ steps.session_reporter.outputs.path }}
+          EXECUTION_FILE: ${{ steps.skill_gen.outputs.execution_file }}
+          PR_NUMBER: ${{ steps.eff.outputs.number }}
+          SESSION: generation
+          SESSION_OUTCOME: ${{ steps.skill_gen.outcome }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: node "$REPORTER"
+
       # Capture skill_gen's execution stats BEFORE skill_review runs
       # and overwrites the shared execution-output JSON at the
       # canonical claude-code-action location. Lets us report
@@ -909,6 +934,17 @@ jobs:
           identity: upstream-release-docs
           domain: octo-sts.stacklok.dev
 
+      # A failure before editorial starts must not publish generation's
+      # response a second time through the action's fallback file output.
+      - name: Clear previous session output
+        if: always() && steps.skill_gen.conclusion == 'success' && steps.review_token.outcome == 'success'
+        env:
+          EXECUTION_FILE: ${{ steps.skill_gen.outputs.execution_file }}
+        run: |
+          if [ -n "$EXECUTION_FILE" ]; then
+            rm -f -- "$EXECUTION_FILE"
+          fi
+
       - name: Run docs-review on skill output (fresh context)
         id: skill_review
         if: always() && steps.skill_gen.conclusion == 'success' && steps.review_token.outcome == 'success'
@@ -1006,6 +1042,18 @@ jobs:
         if: always() && steps.review_token.outcome == 'success'
         run: git remote set-url origin "https://github.com/$GITHUB_REPOSITORY.git"
 
+      - name: Post editorial report
+        if: always() && steps.eff.outputs.number != '' && (steps.skill_review.outcome == 'success' || steps.skill_review.outcome == 'failure')
+        continue-on-error: true
+        env:
+          REPORTER: ${{ steps.session_reporter.outputs.path }}
+          EXECUTION_FILE: ${{ steps.skill_review.outputs.execution_file }}
+          PR_NUMBER: ${{ steps.eff.outputs.number }}
+          SESSION: editorial
+          SESSION_OUTCOME: ${{ steps.skill_review.outcome }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: node "$REPORTER"
+
       # claude-code-action works in a sibling scratch checkout (the
       # .claude-pr/ dir we gitignore) and pushes commits to origin
       # directly, without advancing the outer workflow checkout's

scripts/upstream-release/post-session-report.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+// SPDX-FileCopyrightText: Copyright 2026 Stacklok, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+
+// Match the credential formats redacted by the pinned claude-code-action's
+// src/github/utils/sanitizer.ts (374f254f5efaf968abfe15d399fd90972e8138b9).
+// Actions log masking does not apply to the GitHub API request body.
+function redactSecrets(content) {
+  return content
+    .replace(/gh[pousr]_[A-Za-z0-9]{36}\b/g, '[REDACTED_GITHUB_TOKEN]')
+    .replace(/github_pat_[A-Za-z0-9_]{11,221}\b/g, '[REDACTED_GITHUB_TOKEN]')
+    .replace(/sk-ant-[A-Za-z0-9_-]{20,}/g, '[REDACTED_ANTHROPIC_KEY]')
+    .replace(
+      /(?:\b|(?<=\\(?:[nrtbf"\\/]|u[0-9a-fA-F]{4}))|(?<=\[[0-9;]*m))(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+      '[REDACTED_AWS_KEY_ID]'
+    )
+    .replace(/xox[abpsr]-[A-Za-z0-9-]{10,}/g, '[REDACTED_SLACK_TOKEN]')
+    .replace(
+      /eyJ[A-Za-z0-9_-]{10,2000}\.eyJ[A-Za-z0-9_-]{10,4000}\.[A-Za-z0-9_-]{10,2000}\b/g,
+      '[REDACTED_JWT]'
+    );
+}
+
+export function renderSessionReport(messages, env) {
+  // Only the SDK's final result is suitable for a PR comment. Assistant
+  // messages can contain intermediate narration; never fall back to them.
+  const results = Array.isArray(messages) ? messages : [messages];
+  const result = results.findLast((message) => message?.type === 'result');
+  const response =
+    typeof result?.result === 'string'
+      ? redactSecrets(result.result.trim())
+      : '';
+  const label = { generation: 'generation', editorial: 'editorial review' }[
+    env.SESSION
+  ];
+  if (!label) throw new Error('Unknown session');
+  const header = `## Claude ${label} report\n\n**Session status:** ${env.SESSION_OUTCOME} · [Workflow run](${env.RUN_URL})\n\n`;
+  if (!response) {
+    return `${header}> Final response unavailable. See the workflow run for session details.\n`;
+  }
+
+  // Leave room below GitHub's comment limit, including for Unicode text.
+  const limit = 60000 - header.length;
+  const suffix =
+    '\n\n> Report truncated. See the workflow run for the full response.';
+  const body =
+    response.length > limit
+      ? response.slice(0, limit - suffix.length) + suffix
+      : response;
+  return header + body + '\n';
+}
+
+export function postSessionReport(env) {
+  if (!/^[1-9][0-9]*$/.test(env.PR_NUMBER ?? ''))
+    throw new Error('PR_NUMBER must be a positive integer');
+  if (!/^[\w.-]+\/[\w.-]+$/.test(env.GITHUB_REPOSITORY ?? ''))
+    throw new Error('GITHUB_REPOSITORY must be owner/repo');
+  let messages;
+  try {
+    messages = JSON.parse(readFileSync(env.EXECUTION_FILE, 'utf8'));
+  } catch {
+    // Missing or malformed output must never cause a transcript dump.
+    messages = [];
+  }
+  const body = renderSessionReport(messages, env);
+  execFileSync(
+    'gh',
+    [
+      'api',
+      '--method',
+      'POST',
+      `repos/${env.GITHUB_REPOSITORY}/issues/${env.PR_NUMBER}/comments`,
+      '--input',
+      '-',
+    ],
+    { input: JSON.stringify({ body }), encoding: 'utf8' }
+  );
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  postSessionReport(process.env);
+}