fix(claude-autofix): run failing-checks fixes via repository_dispatch and cover CI failures (PT-289)

[donnfelker]

Problem

fix-failing-checks in ai-platform-claude-autofix.yml has never run. Ticket: PT-289.

• It ran on check_suite, which claude-code-action rejects before Claude starts (Unsupported event type: check_suite). The action's accepted list at the pin (and on upstream main) is the PR/issue entity events plus workflow_dispatch, repository_dispatch, schedule, workflow_run.
• fix(claude-autofix): present check_suite runs to claude-code-action as workflow_run #70's env: GITHUB_EVENT_NAME: workflow_run could not work. GitHub docs: "You can't overwrite the value of the default environment variables named GITHUB_* and RUNNER_*." The failed ai-analytics run (34645803094) shows the override in the step env and the action still receiving check_suite.
• Second latent blocker: the step set track_progress: true, which the action only allows on PR/issue events (src/modes/detector.ts). A correctly relabelled run would have crashed one check later.
• GitHub never fires check_suite for suites created by Actions, so CI failures (lint/test/typecheck/build) have never reached autofix at all. Only third-party apps such as CodeQL default setup could, and those crashed.

Fix

Split the job so every event the action sees is one it supports, and cover CI failures.

• dispatch-failing-checks runs on check_suite failure (non-Actions check apps) and workflow_run failure (the caller's CI workflows, named in its workflows: filter). It resolves the open PR by SHA, applies the fork, kill-switch label, staleness (PR head still equals the failing SHA), self-exclusion and allowed_bots gates, then raises a repository_dispatch (claude-autofix-failing-checks) with the default token. repository_dispatch is one of the two events GitHub does start runs for when raised with GITHUB_TOKEN.
• fix-failing-checks runs on that dispatch. It re-validates PR state and the failing-check invariant from the live API (anyone with contents: write can raise a dispatch), validates and sanitises the payload before it reaches step outputs or the prompt, then runs the action. The dead override, HACK comment, and track_progress are removed. allowed_bots is dropped from this step because the action skips its actor check on repository_dispatch; the dispatcher enforces the list against the real actor instead.
• Trigger template: adds workflow_run and repository_dispatch triggers, and a concurrency group where both Claude jobs key on PR number (so they serialise) while dispatcher runs use a separate dispatch-<sha> group (so pending-run eviction cannot drop the fixer).
• Failure notification now fires whenever a PR number is known, since a repository_dispatch run leaves no check on the PR commit.

An adversarial subagent review was run on the diff; its findings (inert allowed_bots, missing re-validation across the trust boundary, concurrency eviction, prompt injection via source, invisible fixer failures) are all addressed.

Caller migration (required)

Each consuming repo's trigger file must add workflow_run: { workflows: [<CI workflow name>], types: [completed] } and repository_dispatch: { types: [claude-autofix-failing-checks] } to on:, and adopt the concurrency group from the template. Both new events only fire from the default branch, so merge the caller change before testing. Known callers: ai-analytics (pinned SHA, needs bump in its own PR), polygon-lms (@main), polygon-core-plugins (pinned SHA).

Verification plan

1. Merge this and the ai-analytics caller change.
2. Open a PR in ai-analytics with a deliberate lint error. Expect one workflow_run dispatcher run, then one repository_dispatch run whose log contains Auto-detected mode: agent for event: repository_dispatch and which pushes a [claude-autofix] commit or comments.
3. gh run list --workflow claude-autofix-caller.yml --event repository_dispatch lists the run (these runs are attributed to main, not the PR branch). No run logs Unsupported event type.

🤖 Generated with Claude Code

[github-actions]

Claude autofix run failed while fixing CI (error, not a normal stop). See the run log: https://github.com/0xPolygon/pipelines/actions/runs/34648379163