ci: migrate Claude PR automation to describe-cli

[wkoutre]

What changed

Replaces the ai-toolkit reusable workflow call with the CLI from Uniswap/internal-tools:

• _generate-pr-metadata.yml -> @uniswap/describe-cli via .github/workflows/describe.yml

Review automation in this repo already runs on review-cli and is untouched by this PR. Same describe shape already running in Uniswap/universe, backend, tjar, uniswap-ai, and ai-toolkit. The CLI installs pinned from GitHub Packages before the PR's code is checked out; the Claude Code binary is version-pinned and GPG-verified.

Why

ai-toolkit is retiring the reusable PR-metadata workflow. describe-cli classifies the description lifecycle (cold / diff-changed / human-edited / stale), writes additively inside its markers, and backs off from human-edited descriptions instead of overwriting them.

Behavior changes

• PR title generation is gone by design — describe-cli writes descriptions only. The old caller ran generation_mode: "description,deferred-title", so titles were already deferred rather than auto-applied; check-pr-title.yaml still enforces conventional-commit titles.
• The old caller's explicit changeset-release/ skip is dropped as redundant: changeset-release/main matches the canonical guard's !contains(github.head_ref, 'release/'). The canonical guard also adds a cursor[bot] and cherry-pick/ skip.

Before merging (repo/org admin)

• Grant this repo read access to the describe-cli package: Uniswap/internal-tools -> Packages -> package settings -> Manage Actions access. Without it the install step fails with a 403 and a self-explanatory error.
• Secrets: existing ANTHROPIC_API_KEY works as-is; CLAUDE_CODE_OAUTH_TOKEN is preferred if available.
• Optional repo vars to roll versions without commits: DESCRIBE_CLI_VERSION, CLAUDE_CODE_VERSION.

Verified

• describe.yml is byte-identical to the canonical file and parses as valid YAML.
• The install step writes its own bunfig and sets BUN_CONFIG_FILE explicitly, so the repo-root bunfig.toml (npmjs registry pin + 3-day minimumReleaseAge) neither blocks nor is bypassed by it; every post-checkout bun call sets BUN_CONFIG_FILE=/dev/null.
• No other file in the repo referenced the deleted workflow, and no ruleset requires it as a status check.

Also in this PR: .claude/review.yml's model pin rolled from claude-opus-4-8 to claude-opus-5 (current Opus generation).

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T23:33:23.599185Z	6eefa72	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

_{● Reviewed · against 4891eef · 2026-08-29 00:46 UTC · 2 reviews · view run ↗}

Note

Approved — one signing-key thread stays open on describe.yml.

Migrates the Claude PR-metadata automation from the retiring ai-toolkit reusable workflow to describe-cli, replacing claude-pr-metadata-update.yml with describe.yml, and rolls the review-agent model pin in .claude/review.yml to claude-opus-5.

Assessment

The migration preserves the behaviors that matter: the dropped changeset-release/ skip is covered by the canonical guard's !contains(github.head_ref, 'release/') (matches changeset-release/main), title generation was already deferred rather than auto-applied and stays enforced by check-pr-title.yaml, and registry isolation holds via explicit BUN_CONFIG_FILE handling on both sides of checkout. The job gates on head.repo.full_name == github.repository, so fork code never sees secrets, and the Claude Code binary is checksummed against a GPG-verified manifest before it executes. The model pin does take effect — the bundled agents' frontmatter model: sonnet is treated as unpinned, so model.default selects; the cost ceiling stays enforced by agent_budget_usd: 10.0 rather than by turn count. The admin follow-ups (package read access, secrets, optional version vars) are deployment steps, not code concerns.

Iteration history · 2 reviews

2026-08-29 00:46 UTC · ✅ approved · 0 findings · 4891eef · run ↗

_{(no findings)}

2026-08-28 23:34 UTC · ✅ approved · 0 findings · 6eefa72 · run ↗

_{(no findings)}

Tip

Teach the reviewer. React 👍 on findings that helped, 👎 on false positives. Reply to push back or add context — we aggregate this weekly to tune the bot.

Comment @request-claude-review to re-run.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6eefa729de

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bind manifest verification to the pinned signing key

When the downloaded key bundle contains both the pinned Anthropic public key and another key, the preceding fingerprint check passes, but this bare gpg --verify accepts a valid signature from any imported key. An attacker controlling the release and key downloads could therefore sign a forged manifest with the additional key, pass the binary checksum, and reach the credentialed posting step. Verify the signer fingerprint itself, for example with --assert-signer, using an isolated keyring.

Useful? React with 👍 / 👎.

[github-actions]

Note

✅ Approved — see full review in the sticky comment ↑

[graphite-app]

Graphite Automations

"Request reviewers once CI passes on sdks monorepo" took an action on this PR • (08/28/26)

1 assignee was added and 3 reviewers were added to this PR based on Siyu Jiang (See-You John)'s automation.