[rishitank]

Why

#15 added branch-cleanup.yml, and merging it deleted its own branch, as intended (run 37871307016: "Deleted branch ci/branch-cleanup."). CodeRabbit then reviewed the same file on sibling repos and raised two valid gaps:

• A branch can be the head of another open PR (the same branch opened against two bases). Deleting it would close that PR.
• If someone pushed to the branch after the merge, deleting the ref throws those commits away.

What changed

• Keeps a branch that is the head of another open PR (gh pr list --head), in addition to the existing base check.
• Deletes only the merged commit. Before deleting, it reads the branch's current SHA (GET git/ref/heads/<ref>, URL-encoded) and keeps the branch, with a notice, when that SHA is no longer pull_request.head.sha. A 404 there means the branch is already gone, which counts as success.
  • Residual risk: REST has no conditional delete, so a push landing in the instant between that read and the DELETE isn't caught. A comment in the workflow says so.
• Each job permission now has a comment saying why it's needed (zizmor undocumented-permissions).
• Unchanged: the trigger, the merged + same-repo condition, the allowlist, {} workflow permissions, env:-only inputs, and 422/404 on DELETE treated as already deleted.

Checks

• actionlint and shellcheck are clean.
• Stub-gh runs pass for every path: allowlist, base PR, head PR, ref already gone, ref moved, 500 on read (fails), delete OK, 422 on delete, 403 on delete (fails).
• Live proof: merging this PR should run the new version and delete ci/branch-cleanup again, this time after the SHA check.

🤖 Generated with Claude Code

https://claude.ai/code/session_012rYJxu978iUSGFZ1UuqTsi

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 42 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 3c05a25b-0f7b-43cb-ac05-1a7f569e7c58

📥 Commits

Reviewing files that changed from the base of the PR and between 36dbd32 and 2e4c00b.

📒 Files selected for processing (1)

• .github/workflows/branch-cleanup.yml

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🧪 Runtime gate

✅ Runtime crawl: no runtime errors

1 page(s) opened in a real browser (desktop + phone), safe controls exercised, forms tried with dummy data, links followed client-side, missing-route probe run. 37s.

Coverage: 1/1 routes · 0/0 controls operated · 0/0 forms submitted · 29.3% of the app's own JavaScript executed

Against the default branch: routes ±0, controls ±0, JS ±0 pts.

No visual changes against the last default-branch run.

Pages visited

Page	Status	ms	Controls operated	Forms submitted	Problems
/	200	8981	0/0	0/0	0

AI explorer not run: no major/framework signal in this PR. Add the ai-explore label to request one.

Screenshots, diffs and the app log: runtime-gate artifact.

[rishitank]

Self-review by Claude. CodeRabbit is rate-limited on this repo right now, so there's no line-by-line review.

What I checked (.github/workflows/branch-cleanup.yml, read in full):

• New inputs. HEAD_SHA comes in through env: from pull_request.head.sha. No ${{ }} inside run:.
• Head-PR check. gh pr list --head, with the same output contract (a count) as the base check. The PR that just merged is closed, so it isn't counted.
• SHA guard. GET git/ref/heads/<encoded> then --jq .object.sha. A 404 means already deleted, so it exits 0. Any other error fails the job and keeps the branch. A mismatch with HEAD_SHA keeps the branch with a notice.
• Delete path. The DELETE handling is unchanged: 422/404 count as success, and anything else fails red.
• Permissions. Each one now has an explanatory comment, and the scope is unchanged.

Tests. actionlint and shellcheck are clean, and actionlint passed in CI. The stub-gh matrix covers every path.

Fixed: nothing beyond the PR's own changes.

Residual, for Rishi: REST has no conditional delete, so the read and the DELETE are separate calls. A push that lands between them, a sub-second window, is not caught.