From 84b9ce8013dbe6b380a1355add96fb22886176df Mon Sep 17 00:00:00 2001
From: andig <andi@evcc.io>
Date: Wed, 15 Jul 2026 14:37:28 +0200
Subject: [PATCH] CI: add eyes reaction to all command-invokable agents; fix
 claude.yml write perms (#31820)

---
 .github/workflows/claude-issue-agent-run.yml |  8 ++++++
 .github/workflows/claude.yml                 | 30 ++++++++++++++++++--
 2 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/claude-issue-agent-run.yml b/.github/workflows/claude-issue-agent-run.yml
index 26479af16..42c3f1407 100644
--- a/.github/workflows/claude-issue-agent-run.yml
+++ b/.github/workflows/claude-issue-agent-run.yml
@@ -35,6 +35,14 @@ jobs:
     # No permissions block: inherit the caller's grant (triage/fix=write to push
     # fixes, analyze=read). A reusable job can only reduce, never elevate.
     steps:
+      - name: React to invoking comment
+        if: inputs.comment_id != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/issues/comments/${{ inputs.comment_id }}/reactions \
+            -f content=eyes
+
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 580e80a98..966d4c894 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -19,12 +19,36 @@ jobs:
       (github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: read
-      issues: read
+      contents: write # allow Claude to push fixes when asked
+      pull-requests: write # comment + open/edit PRs
+      issues: write # comment + react to the invoking comment/issue
       id-token: write
       actions: read # Required for Claude to read CI results on PRs
     steps:
+      - name: React to invoking comment
+        if: github.event_name == 'issue_comment'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/issues/comments/${{ github.event.comment.id }}/reactions \
+            -f content=eyes
+
+      - name: React to invoking review comment
+        if: github.event_name == 'pull_request_review_comment'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/pulls/comments/${{ github.event.comment.id }}/reactions \
+            -f content=eyes
+
+      - name: React to invoking issue
+        if: github.event_name == 'issues'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh api repos/${{ github.repository }}/issues/${{ github.event.issue.number }}/reactions \
+            -f content=eyes
+
       - name: Checkout repository
         uses: actions/checkout@v7
         with: