Ship fixes while you sleep: Brain2Git + Claude Code auto-fix

#!/usr/bin/env bash
# setup-runner.sh — installs a GitHub Actions self-hosted runner on macOS (arm64)
# and the Claude Code CLI it will use to auto-fix issues.
#
# You still need to do two things manually (can't be scripted safely/generically):
#   1. Get YOUR repo-specific registration token from:
#      GitHub repo → Settings → Actions → Runners → New self-hosted runner
#      GitHub shows the exact ./config.sh command with a token embedded —
#      copy that command and run it where this script tells you to.
#   2. Authenticate the claude CLI interactively once (opens a browser).
#
# Usage: ./setup-runner.sh

set -euo pipefail

RUNNER_DIR="$HOME/actions-runner"
RUNNER_VERSION_HINT="Check the latest version number shown on your repo's
  Settings → Actions → Runners → New self-hosted runner page — the download
  URL and checksum are version-specific and change often, so we don't hardcode
  them here."

echo "== 1/3 — GitHub Actions runner =="
echo "$RUNNER_VERSION_HINT"
mkdir -p "$RUNNER_DIR"
cd "$RUNNER_DIR"
echo "→ Now go copy the 'Download' + 'Configure' commands from GitHub's"
echo "  New self-hosted runner page and run them in: $RUNNER_DIR"
echo "  When prompted for labels, add: self-hosted,osx-arm64"
echo ""
read -rp "Press Enter once you've run config.sh and the runner is registered... "

echo "== 2/3 — Install as a background service (always on) =="
sudo ./svc.sh install
sudo ./svc.sh start
./svc.sh status

echo "== 3/3 — Install Claude Code CLI =="
if ! command -v claude &> /dev/null; then
  npm install -g @anthropic-ai/claude-code
fi
echo "→ Run 'claude' once manually to complete browser-based authentication."
echo "  The runner service reuses this login for every job — no API key secret needed."

echo ""
echo "Done. Verify everything with:"
echo "  cd $RUNNER_DIR && ./svc.sh status"
echo "  claude --version"

# .github/workflows/autofix-issue.yml
#
# Auto-fix GitHub issues with the Claude Code CLI, running on a self-hosted
# runner you control. Triggered by the "autofix" label — including when
# Brain2Git creates the issue with the label already attached.
#
# ⚠️  SECURITY: this workflow runs arbitrary code on YOUR machine, driven by
#     GitHub issue content. Read the security section in the blog post before
#     enabling this. Do not use on repos where untrusted people have
#     triage/write access.

name: Auto-fix issue with Claude Code

on:
  issues:
    # Brain2Git (and any tool that sets labels at creation time) fires
    # "opened" — NOT "labeled" — because the label is already attached when
    # the issue is created. GitHub only fires "labeled" when a label is added
    # to an issue that already exists. Listening to both covers every case.
    types: [opened, labeled]

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  auto-fix:
    # Guard on the label being PRESENT, not on which event fired.
    if: contains(github.event.issue.labels.*.name, 'autofix')
    runs-on: [self-hosted, osx-arm64]
    timeout-minutes: 30

    env:
      ISSUE_NUMBER: ${{ github.event.issue.number }}
      BRANCH: fix/issue-${{ github.event.issue.number }}
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

    steps:
      # ── Security gate — must run first, before checkout ─────────────
      # Only proceed if whoever triggered this event (opened the issue, or
      # added the label) has write access to the repo. Self-hosted runners
      # execute code on your machine — never skip this on a repo where
      # triage/write access is handed out loosely.
      - name: Verify sender has write access
        run: |
          SENDER="${{ github.event.sender.login }}"
          PERMISSION=$(gh api "repos/${{ github.repository }}/collaborators/${SENDER}/permission" --jq '.permission')
          echo "Sender: $SENDER — permission: $PERMISSION"
          if [[ "$PERMISSION" != "admin" && "$PERMISSION" != "write" ]]; then
            echo "::error::$SENDER does not have write access. Refusing to run auto-fix."
            exit 1
          fi

      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Create fix branch
        run: git checkout -b "$BRANCH"

      - name: Install dependencies
        run: npm ci

      - name: Run Claude Code agent
        run: |
          claude --allowedTools "Bash,Read,Write,Edit,Grep,Glob" \
                 --model claude-sonnet-4-6 \
                 -p "
          Fix GitHub issue #${ISSUE_NUMBER} in this repository.

          ## Step 1 — Read the issue
          Run: gh issue view ${ISSUE_NUMBER} --json title,body,labels,comments

          ## Step 2 — Load context
          1. Read CLAUDE.md at the repo root — your operating manual.
          2. Understand the issue type: copy fix, bug, UX change, or structural change.

          ## Step 3 — Implement
          Make the minimum change that resolves the issue. No scope creep.

          ## Step 4 — Verify
          Run this project's type-check, test, and lint commands (see CLAUDE.md
          or package.json scripts). Fix any failures before finishing.

          ## Non-negotiables
          - Fix ONLY what the issue describes.
          - No hardcoded secrets.
          - Follow the existing code style — don't introduce new patterns.

          If the issue needs something you can't verify (e.g. a schema migration
          you can't test), or is too ambiguous, comment on the issue explaining
          why and stop. Do not guess and ship broken code.
          "

      - name: Check for changes
        id: changes
        run: |
          git add -A
          if git diff --cached --quiet && [ "$(git rev-list --count origin/main..HEAD)" -eq 0 ]; then
            echo "has_changes=false" >> "$GITHUB_OUTPUT"
          else
            echo "has_changes=true" >> "$GITHUB_OUTPUT"
          fi

      - name: Commit and push
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          if ! git diff --cached --quiet; then
            git commit -m "fix: resolve issue #${ISSUE_NUMBER}

          Co-Authored-By: Claude <noreply@anthropic.com>"
          fi
          git push --force origin "$BRANCH"

      - name: Open PR
        if: steps.changes.outputs.has_changes == 'true'
        run: |
          # Unset GH_TOKEN so 'gh' falls back to the runner's own logged-in
          # account instead of the ephemeral Actions token. PRs opened with
          # GITHUB_TOKEN don't trigger other workflows (a GitHub restriction) —
          # this keeps your normal CI running on the bot's PR.
          unset GH_TOKEN
          ISSUE_TITLE=$(gh issue view "$ISSUE_NUMBER" --json title --jq '.title')
          gh pr create \
            --title "fix: ${ISSUE_TITLE} (closes #${ISSUE_NUMBER})" \
            --body "Automated fix for #${ISSUE_NUMBER}, generated by Claude Code.

          ## Test plan
          - [ ] Type-check passes
          - [ ] Tests pass
          - [ ] Manual verification

          🤖 Generated via the Brain2Git auto-fix workflow" \
            --head "$BRANCH" \
            --base main

      - name: Comment if no changes were made
        if: steps.changes.outputs.has_changes == 'false'
        run: |
          gh issue comment "$ISSUE_NUMBER" \
            --body "🤖 Claude Code looked at this issue but didn't make changes — it may need manual clarification. Check the workflow run for details."

      - name: Clean up runner workspace
        if: always()
        run: |
          rm -rf node_modules .next
          git push origin --delete "$BRANCH" 2>/dev/null || true
          git checkout main 2>/dev/null || true
          git branch -D "$BRANCH" 2>/dev/null || true
          git clean -fd --exclude=node_modules 2>/dev/null || true
          git remote prune origin 2>/dev/null || true