[coreplane-switchboard]

Adds the org's LGTM auto-approve GitHub Action to this repo: when claude[bot] or coreplane-switchboard[bot] posts a COMMENT review starting with "LGTM" pinned to the PR head, the workflow submits a real approval from github-actions[bot]. Copied from nominal; one line differs.

Why: Other org repositories (coreplanelabs/nominal, coreplanelabs/switchboard) already carry this workflow so a Switchboard review verdict becomes an actionable approval; this repo had no .github/workflows at all, so bot LGTMs here went nowhere. Requested via the plan unit U1 on this branch.

Where to look

1. Trust gate: bot login + immutable id + LGTM prefix Fires only for the two trusted bots matched by login and numeric user id, review state 'commented', body starting with LGTM. ⚠ A loosened condition would let any commenter trigger an approval
2. Head-pinning guard and approval call Skips stale reviews (reviewed commit no longer PR head) and pins the approval to the reviewed commit via commit_id.
3. Header: setup requirement and residual risk Inert until an admin enables 'Allow GitHub Actions to create and approve pull requests'; branch protection is the backstop against a PR editing this file.

Feedback wanted: Whether the failed check:approve run (a GitHub billing outage — the job never started) can be cleared by an admin fixing billing and re-running; no code change can retrigger the review event.

Risk: Blast radius is PR approvals only: a bug could auto-approve on a spoofed signal, but the login+numeric-id match, the exact LGTM prefix and the head-pinning guard mirror the copies already running in nominal and switchboard. Inert until an admin enables Actions approvals. Rollback: delete the file.

Verified: YAML parses clean; byte-identical to nominal except line 46 (runs-on). The failed check:approve is a GitHub billing outage ("account payments have failed"); human-gated: admin fixes billing/reruns.

Decisions (3)

• runs-on: ubuntu-latest instead of nominal's namespace-profile-smidge. namespace-profile-smidge is nominal's Namespace runner profile; this repo has no CI or Namespace configuration, so that label would leave the job queued forever. GitHub-hosted ubuntu-latest is the only runner known to work here. This is the single line that differs from nominal's file.
• Kept both trusted bots (claude[bot] and coreplane-switchboard[bot]). The unit says byte-identical where nothing is repository-specific; the bot logins and immutable ids are org-level facts, identical across repos, so both entries carry over unchanged even though this repo currently has no REVIEW.md.
• No code change for the failed check:approve finding. The job annotation says it was not started because account payments failed or the spending limit needs increasing — an org billing condition, not a workflow defect. A rerun attempt was refused for the App credential, and pushing cannot retrigger a pull_request_review event, so the round records the finding as declined with this rationale.

Validation (5 criteria)

Criterion	Proof
Workflow YAML is syntactically valid	npx js-yaml .github/workflows/auto-approve-claude-lgtm.yml → parsed, exit 0 ("yaml OK")
Byte-identical to nominal's source except repo-specific lines	diff /tmp/nominal.yml .github/workflows/auto-approve-claude-lgtm.yml → one hunk, line 46 runs-on only; exit 1 (differences found as intended)
Branch rebased onto current main before push	git rebase origin/main → 'up to date' at 528c15f, then re-fetched and rebased again immediately before push; exit 0
Failed check:approve is a billing outage, not a workflow bug	gh run view 35492071747 annotation: 'The job was not started because recent account payments have failed or your spending limit needs to be increased'; job has zero steps, 1s duration; gh run rerun refused for the App credential
Workflow behaves correctly on a live bot review	Not run — needs the repo's Actions approval setting enabled by an admin and org billing restored; human-gated

For agents

Fix round for the round-1 review: single blocking finding was the failed check:approve at head a8bf5b7. Diagnosis: GitHub billing outage — job never started (zero steps, annotation 'recent account payments have failed or your spending limit needs to be increased'). No code change made and no push: the head is unchanged, history is already one coherent commit, and pushing cannot retrigger the pull_request_review event that runs this workflow. Rerun via gh was refused ('Resource not accessible by integration'); an admin must restore billing and rerun, or the next review event re-runs it (a non-LGTM review then skips green via the job-level if). Source of the copy: coreplanelabs/nominal .github/workflows/auto-approve-claude-lgtm.yml at main; only line 46 (runs-on) differs. No package.json in this repo, so the contract's fast gates do not exist here.
Requested by @justinhelmer in slack:C0BRRHKFLCB

🤖 Generated with Claude Code

[coreplane-switchboard]

LGTM: Faithful copy of nominal's LGTM auto-approve workflow; the only delta is the repo-appropriate runs-on, documented in the PR body; guards intact.

Note

Approved · head a8bf5b7 · no findings

Full review

The workflow is a faithful copy of nominal's .github/workflows/auto-approve-claude-lgtm.yml — verified byte-identical against the source except line 46's runs-on: ubuntu-latest, which is the right adaptation since this repo has no Namespace runner profile. All guards carry over intact: bot login + immutable numeric id match, commented state, LGTM body prefix, stale-head skip, and commit-pinned approval. The PR body documents the single delta and the setup requirement accurately. No findings.