Let Claude read the C# source when porting

[ddaspit]

Quick summary

Claude can now read the C# source when it ports a change or answers a follow-up on a port PR. It reads each file as of the source PR's merge commit. Only claude.yml and the port-pr skill change.

Where to look

port-pr reads the C# code from a sibling clone at ../machine. The @claude workflow never created one. On #390, Claude could not check whether C# shares the defects the review found, because its gh api and WebFetch calls were denied.

• claude.yml clones sillsdev/machine to ../machine with full history. The repo is public, so no token is used. It sits outside the workspace, so black . and flake8 . in local_check.sh do not scan it.
• --add-dir ../machine lets Claude read files there. The new allowed tools are git -C ../machine show, log and blame, which only read.
• port-pr now asks for the PR's mergeCommit and reads each C# file with git -C ../machine show <mergeCommit>:<path>. A port PR can cover more than one C# PR, as Convert USFM versification before updating from rows #390 does, so reading by commit works where a single checkout would not.

I did not allow gh api or WebFetch. With the workflow's token, gh api could also write, and WebFetch would let Claude fetch any URL.

The repo is about 31 MB, so the full clone should add only a few seconds. I have not timed it on a runner.

Validation

• Parsed .github/workflows/claude.yml with PyYAML. It parsed.
• git diff --check -- clean.
• I did not run ./local_check.sh. This PR only changes a workflow and a skill.
• None of this can be verified until the workflow runs after merge. Asking Claude on Convert USFM versification before updating from rows #390 to check F1-F4 against the C# source will confirm it.

🤖 Generated with Claude Code

---

This change is 

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.07%. Comparing base (fa9cffb) to head (db028b1).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #394   +/-   ##
=======================================
  Coverage   92.07%   92.07%           
=======================================
  Files         394      394           
  Lines       24896    24896           
=======================================
  Hits        22922    22922           
  Misses       1974     1974           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[claude]

1. Verdict: approve. F1 and F2 are both addressed, and this round found nothing new.
2. What matters most: nothing is open. F1 (.claude/skills/port-pr/SKILL.md:42) is fixed in db028b1, which checks the commit with cat-file -e before reading it.
3. Counts: Critical 0, Important 0, Low 0 open.
4. What I ran:
   • compare 5cbf917...db028b1 returned ahead. git diff 5cbf917 db028b1 shows only the SKILL.md paragraph and one new allowedTools entry changed.
   • git cat-file -e 0123…4567 exited 1 with no output. git cat-file -e fa9cffb exited 0. So the check tells a missing commit apart from a present one, whatever the path.
   • Read the head SKILL.md. The rewrapped lines fit in 90 columns.
5. Could not verify:
   • git -C ../machine fetch is not in allowedTools. CI clones fresh, so the check should pass there and the fetch should never be needed. It matters only for a local run, where prompts apply.
   • Same as earlier rounds: that the prefix rules match git -C ../machine … as intended, the clone time, and a real merge-commit read. The first run after merge will settle these.

Public API / wheel / optional deps / C# parity: None verified. Only CI and skill files change.

Findings: F1 addressed, F2 addressed.

Reviewed at db028b1