From 0a7fef0368b10701737d0f54f50fd1b4ed5d46f6 Mon Sep 17 00:00:00 2001
From: Tam Nhu Tran <kaitran.ntt@gmail.com>
Date: Fri, 27 Mar 2026 14:26:21 -0400
Subject: [PATCH] =?UTF-8?q?hotfix(ci):=20fix=20AI=20review=20performance?=
 =?UTF-8?q?=20=E2=80=94=20bypass=20permissions,=20cap=20turns,=20reduce=20?=
 =?UTF-8?q?thinking?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Add --permission-mode bypassPermissions to eliminate 16+ permission denials per review
- Add --max-turns 20 to prevent runaway 41+ turn sessions
- Replace ultrathink with think (32K→16K thinking tokens) — sufficient for read-only review
- Expand --allowedTools with commonly-tried tools (wc, head, tail, find, git show)
- Remove unnecessary tools (Edit, LS — review shouldn't edit files)
- Reduce timeout from 20 to 15 minutes for faster failure detection

Evidence from run #23659037151: 11.6 min, 41 turns, 16 permission denials, $1.95, failed to write review.

Closes #818
---
 .github/workflows/ai-review.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index c300cb9d..b7096215 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -127,7 +127,7 @@ jobs:
     name: Claude Code Review
     needs: prepare
     if: needs.prepare.result == 'success'
-    timeout-minutes: 20
+    timeout-minutes: 15
     runs-on: ${{ fromJSON(needs.prepare.outputs.runs_on) }}
     permissions:
       contents: read
@@ -147,7 +147,7 @@ jobs:
       DISABLE_ERROR_REPORTING: '1'
       DISABLE_TELEMETRY: '1'
       CLAUDE_CODE_MAX_OUTPUT_TOKENS: '64000'
-      MAX_THINKING_TOKENS: '32000'
+      MAX_THINKING_TOKENS: '16000'
       REVIEW_OUTPUT_FILE: pr_review.md
       REVIEW_COMMENT_FILE: .ccs-ai-review-comment.md
 
@@ -226,7 +226,7 @@ jobs:
           show_full_output: true # Visible logs for debugging slow/failing reviews
           track_progress: false # Disabled - no progress comments, just final review
           prompt: |
-            ultrathink
+            think
 
             REPO: ${{ github.repository }}
             PR NUMBER: ${{ needs.prepare.outputs.pr_number }}
@@ -257,7 +257,9 @@ jobs:
           claude_args: |
             --bare
             --model ${{ env.REVIEW_MODEL }}
-            --allowedTools "Edit,Glob,Grep,LS,Read,Write,Bash(gh pr diff *),Bash(gh pr view *),Bash(gh issue view *),Bash(git diff *),Bash(git log *),Bash(git status *),Bash(cat *),Bash(ls *)"
+            --permission-mode bypassPermissions
+            --max-turns 20
+            --allowedTools "Glob,Grep,Read,Write,Bash(gh pr diff *),Bash(gh pr view *),Bash(git diff *),Bash(git log *),Bash(git show *),Bash(cat *),Bash(ls *),Bash(wc *),Bash(head *),Bash(tail *),Bash(find *)"
 
       # Fallback: if Claude didn't write the review file, extract from execution output
       - name: Extract review from execution output (fallback)