feat(claude-autofix): make allowed_bots a caller input defaulting to '*'

[donnfelker]

Description

The autofix reusable workflow hard-coded allowed_bots in the review-feedback job (claude[bot],github-actions[bot],copilot-pull-request-reviewer[bot],Copilot) and omitted it from the check_suite job entirely.

Defect, root-caused in 0xPolygon/polygon-websites: that repo reviews under a dedicated reviewer App (polygon-websites-reviewer[bot], via the REVIEWER_APP_* secrets apps-claude-code-review.yml supports so agent-authored PRs can still receive a required approval). claude-code-action validates the workflow-triggering actor, which for pull_request_review is the reviewer, so its changes-requested verdicts were rejected and the review → fix → approve loop never closed. The check_suite job, with no allowed_bots at all, rejected any CI failure on a bot-pushed commit, including autofix's own [claude-autofix] pushes.

Fix: allowed_bots becomes a workflow_call input wired into both claude-code-action steps. Default is '*' (ruled by @donnfelker): both jobs already refuse fork PRs, so every bot that can reach them is an App the org installed, and a human review body is exactly as injectable as a bot's. Callers that want to spend autofix credit only on named reviewers pass a comma-separated login list; the trigger template shows the override.

Behaviour change for existing callers: bots not on the old list (Dependabot, CodeQL, security scanners that request changes) now trigger autofix. The attempt cap, ai-needs-human label, and denied_paths bound what a run can do regardless of trigger.

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)

Checklist:

• YAML validated (yaml-lint) and prettier --check clean; actionlint not available locally
• Self-review
• Trigger template documents the new input; empty changeset added (CI-only, matches repo convention)
• Real-run proof: pending a consumer bump. Plan: pin polygon-websites' new claude-autofix.yml caller to this SHA and exercise a reviewer-bot changes-requested review.

Additional context

Found while installing the autofix caller in polygon-websites via the install-github-actions skill. Draft until the real-run proof lands.

🤖 Generated with Claude Code