# cc-release-watch — final two fixes

Predicted by the original audit. Now landing them.

## Fix 1 — install the Claude Code CLI

Earlier dispatched runs showed:

    cc-triage: extracting features from 2.1.126...
    claude exit null:
    claude exit null:
    cc-triage: 2.1.126 — both attempts failed; sentinel written.

exit null = no `claude` binary on the runner's PATH. `ubuntu-latest` doesn't ship with it.

Other claude-using workflows in this repo (`claude-health.yml`, `orchestkit-eval.yml`, `ultrareview.yml`) all do this; this one didn't:

    - name: Install Claude Code CLI
      run: npm install -g @anthropic-ai/claude-code@2.1.122 --ignore-scripts

- Pinned to `2.1.122` — matches `MIN_CC_VERSION` in the matrix, so the cron is reproducible.
- `--ignore-scripts` blocks postinstall hooks from running with elevated perms.
- Auth is via `CLAUDE_CODE_OAUTH_TOKEN` env var (already configured at job-level).

## Fix 2 — replace direct main push with PR-based snapshot commit

Earlier runs ended with:

    [main bf9a9afc] chore(cc-watch): snapshot upstream CHANGELOG
    remote: error: GH006: Protected branch update failed for refs/heads/main.
    remote: - Changes must be made through a pull request.
    remote: - 12 of 12 required status checks are expected.
    ##[error]Process completed with exit code 1.

Branch protection rejects the bot. Replace with the same `peter-evans/create-pull-request` pattern used by `cc-support-window-bump.yml`:

    - name: Check for snapshot changes
      id: changes
      if: success()
      run: |
        if [ -n "$(git status --porcelain shared/cc-snapshots/ ...)" ]; then
          echo "has_changes=true" >> "$GITHUB_OUTPUT"
        else
          echo "has_changes=false" >> "$GITHUB_OUTPUT"
        fi

    - name: Open snapshot PR
      if: success() && steps.changes.outputs.has_changes == 'true'
      uses: peter-evans/create-pull-request@5e914681...  # v7.0.5
      with:
        add-paths: |
          shared/cc-snapshots/
          shared/cc-adoption-gaps.json
          shared/gh-issue-args.json
        commit-message: "chore(cc-watch): snapshot upstream CHANGELOG"
        branch: chore/cc-snapshot-${{ github.run_id }}
        title: "chore(cc-watch): snapshot upstream CHANGELOG"
        labels: automation, cc-adoption

- The "Check for snapshot changes" guard prevents creating empty PRs on no-op cron runs.
- Branch name is keyed by `github.run_id` so concurrent firings don't collide on a stale branch.
- `delete-branch: true` cleans up after merge.
- PR is data-only (snapshot files + gap report + milestone title) — safe to auto-merge.

## Cost

$0 incremental.

- GHA runner: free (public repo).
- peter-evans action: free.
- npm install: free.
- `claude -p --bare` calls: bill against your CC subscription cap (already paid for). 8-15 calls/month, well under 1% of any plan.

## Verification

1. This PR merges to main.
2. Manual `gh workflow run "Claude Release Watch"`.
3. The dispatched run executes all 6 steps, including the LLM extraction (now finds `claude`) and the snapshot PR creation (no more 422).
4. An auto-PR appears in the queue with the snapshot data.