Split author and reviewer tokens

scripts/run-claude.sh

@@ -1,20 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-git config --global user.name bot
-git config --global user.email noreply@capsulizers.com
+. "${ACTION_PATH}/scripts/lib.sh"
 
-COMMENT_FILE="$(mktemp)"
-
-post_comment() {
-  COMMENT_JSON="$(jq -n --rawfile body "${COMMENT_FILE}" '{body: $body}')"
-  curl --fail-with-body --silent --show-error \
-    -X POST \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    -H "Content-Type: application/json" \
-    --data "${COMMENT_JSON}" \
-    "${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}/comments"
-}
+configure_git_author
 
 if [ -z "${BOT_TOKEN:-}" ]; then
   echo 'Run `claude setup-token` locally and set the `bot-token` action input.' > "${COMMENT_FILE}"
@@ -23,14 +12,7 @@ if [ -z "${BOT_TOKEN:-}" ]; then
 fi
 export CLAUDE_CODE_OAUTH_TOKEN="${BOT_TOKEN}"
 
-export ISSUE_COMMENTS="$(
-  curl --fail-with-body --silent --show-error \
-    -H "Authorization: token ${GITEA_TOKEN}" \
-    "${GITEA_API_URL}/repos/${GITEA_REPOSITORY}/issues/${ISSUE_INDEX}/comments?limit=100" \
-    | jq -r '.[] | "## " + .user.login + " at " + .created_at + "\n\n" + .body + "\n"'
-)"
-
-FINAL_PROMPT="$(envsubst < "${ACTION_PATH}/scripts/prompt.md")"
+FINAL_PROMPT="$(render_prompt)"
 
 # Claude refuses --dangerously-skip-permissions as root outside a sandbox.
 export IS_SANDBOX=1
@@ -38,7 +20,9 @@ export IS_SANDBOX=1
 # Stream events so the runner sees output and does not kill the job as a zombie.
 STREAM_FILE="$(mktemp)"
 
-claude --print --dangerously-skip-permissions --model claude-fable-5 \
+# The reviewer token is unset so the agent cannot approve as the bot.
+env -u REVIEWER_TOKEN \
+  claude --print --dangerously-skip-permissions --model claude-fable-5 \
   --output-format stream-json --verbose "${FINAL_PROMPT}" \
   | tee "${STREAM_FILE}" \
   | jq -r --unbuffered '.message.content[]? | .thinking // .text // .name // empty'
@@ -46,4 +30,4 @@ claude --print --dangerously-skip-permissions --model claude-fable-5 \
 jq -r 'select(.type == "result") | .result // ("Bot failed: " + .subtype)' "${STREAM_FILE}" \
   | ansifilter > "${COMMENT_FILE}"
 
-post_comment
+post_result