[mikepitre]

What & why

• verify-attach.yml failed to publish evidence on fix(repo): stop naming SDK versions in the Expo verify skill and publish evidence past a requested team javascript#10489 with GraphQL: Resource not accessible by personal access token (repository.pullRequest.reviewRequests.nodes.0.requestedReviewer). gh pr edit always reads the pull request's review requests, and VERIFY_EVIDENCE_TOKEN cannot read a team that is requested as a reviewer. In this repository CODEOWNERS requests @clerk/team-mobile on some paths, so the evidence of those pull requests could never be published.
• The publish script now writes the description with gh issue edit, which reads only the body fields and updates a pull request through updatePullRequest. It takes the same --body-file and --attach flags, in the pinned gh 2.102.0 too.
• The alternative was to give the token permission to read the organization's teams. That needs an owner to change the token, and it widens what the token can read.

What to focus on

• The new test in verify-attach.test.mjs fails every gh pr call with the error above. It fails on the old script and passes on the new one, so a change back to gh pr edit fails CI.

Testing

• node --test .github/scripts/verify-attach.test.mjs: 199 of 199 pass.
• GH_DEBUG=api gh issue edit on a pull request sends only id, number, title, body, and url, while gh pr edit also asks for reviewRequests.
• The workflow runs only from the default branch, so this change takes effect after merge.

Risk

• This touches .github/scripts/ and .github/workflows/, which are in CODEOWNERS. Only the evidence publish job changes.

How to revert

• A plain revert.

Screenshots / video

• None: the app does not change.

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Automatic approval policy

Commit: 7b48f13cea7b.

Setting	Effective value	Source
Automatic approvals	Enabled	Global configuration
Merge risk	Moderate	Global configuration
Security risk	Not set	Global configuration

Not set means no limit was configured after inheritance. Use @coderabbitai configuration to inspect the resolved settings and their sources.

Run configuration

• Source mode: Auto
• Repository: clerk/clerk-android
• Branch: mike/determined-faraday-kgx9v8
• File: .coderabbit.yaml
• Commit: 7b48f13
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Team
• Run ID: 6d3e045c-b63c-41a9-a947-4851ffdd47e5

Commits

Reviewing files that changed from the base of the PR and between ce120db and 7b48f13.

Files selected for processing: 4

• .claude/skills/verify-clerk-android/references/remote.md
• .github/scripts/verify-attach.mjs
• .github/scripts/verify-attach.test.mjs
• .github/workflows/verify-attach.yml

Included review availability: This review used your included allowance. 1 included review remains after this review. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

Before this change, the evidence publishing script used gh pr edit to update the pull request description and file layout. That command can read review requests, including team reviewers that the evidence token cannot access. The script now uses gh issue edit for those updates, and the workflow description and tests reflect the command change. Reviewers should look first at publishStep in .github/scripts/verify-attach.mjs and its tests in .github/scripts/verify-attach.test.mjs.

Walkthrough

The verification evidence publisher now uses gh issue edit instead of gh pr edit to update descriptions and attach files. The workflow description and publishing tests reflect the command change, including a test for a pull-request reviewer permission error.

Changes

Verification evidence publishing

Layer / File(s)	Summary
Switch publishing to gh issue edit .github/scripts/verify-attach.mjs, .github/scripts/verify-attach.test.mjs, .github/workflows/verify-attach.yml, .claude/skills/verify-clerk-android/references/remote.md	Publishing commands, dry-run output, and failure messages now use gh issue edit. The tests check the updated command and successful publication when gh pr edit returns a reviewer permission error. The workflow step and reference description identify gh issue edit as the command used.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Possibly related PRs

• clerk/clerk-android#1186: Adds CODEOWNERS entries that request team reviewers for workflow and configuration paths; this PR addresses the resulting reviewer access error when publishing evidence.

Suggested reviewers: wobsoriano, swolfand

Merge Risk: Minimal · up to 7b48f

Evidence publishing can update pull-request descriptions and attach files without reading reviewer requests. No merge-blocking risk remains.

Pre-merge checks: 6 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 6 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: using gh issue edit to publish verification evidence when a requested team blocks gh pr edit.
Description check		The description includes all required sections. It explains the cause, implementation, testing, risk, and rollback plan with relevant technical details.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Testing, Risk, And Revert		The PR description includes all three required sections. Testing names the exact test command and reports 199 passing tests. Risk identifies the affected paths and limits the change to the evidence pu…
Device Evidence		The reviewed diff changes four files under .claude/ and .github/. It changes no file under source/api/, source/ui/, or e2e/, so device evidence requirements do not apply.

Full details: Testing, Risk, And Revert

Explanation

The PR description includes all three required sections. Testing names the exact test command and reports 199 passing tests. Risk identifies the affected paths and limits the change to the evidence publish job. How to revert states that a plain revert is sufficient.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 2 functions across 2 files. (2 skipped: 2 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}