klaud-candidate.yml

name: Klaud Cold candidate

on:
  workflow_call:
    secrets:
      ANTHROPIC_API_KEY:
        required: true
      AGENT_PAT:
        required: true
      DASH_API_KEY:
        required: true
    inputs:
      tooling-ref:
        type: string
        required: true
      candidate:
        type: string
        required: true

permissions:
  contents: read
  actions: read # Read workflow runs and artifacts.
  pull-requests: read # Read PR metadata.

jobs:
  claude:
    name: Klaud Cold
    if: github.run_attempt == 1
    runs-on: ubuntu-latest
    env:
      # Repair attempts after the initial update; the baseline is already published.
      MAX_REPAIRS: '5'
      KLAUD_BRANCH: klaud/auto-${{ inputs.candidate }}
      KLAUD_TEST_NAME: klaud-${{ github.run_id }}-${{ inputs.candidate }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.tooling-ref }}
          persist-credentials: false
          fetch-depth: 0
      - name: Checkout workflow tooling
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          ref: ${{ inputs.tooling-ref }}
          path: .infx-tooling
          persist-credentials: false
      - name: Select Python project
        run: |
          python_project="$GITHUB_WORKSPACE/.infx-tooling"
          if [[ -f "$python_project/inferencex-e2e/pyproject.toml" ]]; then
            python_project="$python_project/inferencex-e2e"
          fi
          test -f "$python_project/pyproject.toml"
          echo "INFERENCEX_TOOLING_PROJECT=$python_project" >> "$GITHUB_ENV"
      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          python-version: '3.12'
          cache-dependency-glob: |
            .infx-tooling/pyproject.toml
            .infx-tooling/uv.lock
            .infx-tooling/inferencex-e2e/pyproject.toml
            .infx-tooling/inferencex-e2e/uv.lock
      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: klaud-plan
          path: ${{ runner.temp }}/plan
      - name: Prepare candidate context
        id: context
        env:
          CANDIDATE: ${{ inputs.candidate }}
        run: |
          [[ "$CANDIDATE" =~ ^[0-9a-f]{16}-[0-9a-f]{16}$ ]]
          cp -R "$RUNNER_TEMP/plan/$CANDIDATE" "$RUNNER_TEMP/klaud"
          echo "KLAUD_EVIDENCE=$RUNNER_TEMP/klaud" >> "$GITHUB_ENV"
          rm -r "$RUNNER_TEMP/plan"
          outcome_schema=$(uv run --project "$INFERENCEX_TOOLING_PROJECT" --locked python -P -m infx.klaud outcome-schema)
          echo "outcome-schema=$outcome_schema" >> "$GITHUB_OUTPUT"
      - name: Install Claude Code 2.1.282
        id: claude_cli
        run: | # zizmor: ignore[adhoc-packages] Claude CLI and its native packages are pinned to 2.1.282
          claude_cli="$RUNNER_TEMP/claude-code/node_modules/.bin/claude"
          for attempt in 1 2; do
            rm -rf "$RUNNER_TEMP/claude-code"
            npm install --prefix "$RUNNER_TEMP/claude-code" --no-audit --no-fund @anthropic-ai/claude-code@2.1.282 &&
              [ "$("$claude_cli" --version 2>&1)" = "2.1.282 (Claude Code)" ] && break
            [ "$attempt" = 2 ] && exit 1
            sleep 15
          done
          echo "path=$claude_cli" >> "$GITHUB_OUTPUT"
      - name: Let Klaud Cold own the candidate PR
        id: claude
        continue-on-error: true
        uses: anthropics/claude-code-action@9171db3e57d6a3140a37ddc2ba92788584e0ead6 # v1.0.234
        env:
          GH_TOKEN: ${{ secrets.AGENT_PAT }}
        with:
          path_to_claude_code_executable: ${{ steps.claude_cli.outputs.path }}
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          github_token: ${{ secrets.AGENT_PAT }}
          settings: |
            {
              "fastMode": false,
              "hooks": {
                "Stop": [{"hooks": [{
                  "type": "command",
                  "command": "cd \"$GITHUB_WORKSPACE\" && uv run --project \"$INFERENCEX_TOOLING_PROJECT\" --locked python -P -m infx.klaud check-stop"
                }]}]
              }
            }
          claude_args: >-
            --model 'claude-opus-5-5'
            --max-turns 500
            --json-schema '${{ steps.context.outputs.outcome-schema }}'
            --add-dir '${{ runner.temp }}/klaud'
            --allowedTools "Read,Write,Edit,Glob,Grep,Bash,WebFetch,WebSearch"
          prompt: |
            Read .github/klaud-candidate-prompt.md and follow it for the candidate in
            ${{ runner.temp }}/klaud/candidate.json. MAX_REPAIRS, KLAUD_BRANCH,
            KLAUD_TEST_NAME and KLAUD_EVIDENCE are provided in your environment.
      - name: Reconcile agent-owned state
        if: always() && steps.claude.outcome != 'skipped'
        env:
          GH_TOKEN: ${{ secrets.AGENT_PAT }}
        run: uv run --project "$INFERENCEX_TOOLING_PROJECT" --locked python -P -m infx.klaud recover-current
      - name: Save sanitized candidate diagnostics
        id: diagnostics
        if: always()
        continue-on-error: true
        env:
          KLAUD_EXECUTION: ${{ steps.claude.outputs.execution_file }}
          KLAUD_OUTCOME: ${{ steps.claude.outcome }}
          KLAUD_STRUCTURED_OUTCOME: ${{ steps.claude.outputs.structured_output }}
          GH_TOKEN: ${{ github.token }}
        run: |
          printf '%s' "$KLAUD_STRUCTURED_OUTCOME" > "$RUNNER_TEMP/candidate-outcome.json"
          uv run --project "$INFERENCEX_TOOLING_PROJECT" --locked python -P -m infx.klaud diagnostics \
            --execution-file "${KLAUD_EXECUTION:-$RUNNER_TEMP/claude-execution-output.json}" \
            --structured-outcome-file "$RUNNER_TEMP/candidate-outcome.json" \
            --outcome "${KLAUD_OUTCOME:-unknown}" --output "$RUNNER_TEMP/candidate-diagnostics.json"
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: klaud-candidate-${{ inputs.candidate }}
          # Never upload the execution transcript or private API/scratch data.
          path: ${{ runner.temp }}/candidate-diagnostics.json
          retention-days: 14
      - name: Require a verified candidate outcome
        if: always() && steps.diagnostics.outcome == 'failure'
        run: exit 1