fix(review): make execution-log upload non-fatal and short-lived

Author: zfarrell

.github/workflows/claude-pr-review.yml

@@ -159,14 +159,23 @@ jobs:
       # The review step is continue-on-error, so this runs even when it failed and
       # wrote nothing; an empty execution_file would make upload-artifact fail on a
       # missing `path`, hence the output guard rather than if-no-files-found alone.
+      # This step is diagnostic only and gates a required org-wide check, so it must
+      # never turn a passing review red: continue-on-error covers upload failures, and
+      # overwrite covers re-running a job in a run that already uploaded this name
+      # (v4+ artifacts are immutable, so a same-name upload is otherwise a conflict).
       - name: Upload Claude execution log
+        continue-on-error: true
         if: github.event.pull_request.user.login != 'dependabot[bot]' && steps.review.outputs.execution_file != ''
         uses: actions/upload-artifact@v7.0.1
         with:
           name: claude-execution-log-pr-${{ github.event.pull_request.number }}
           path: ${{ steps.review.outputs.execution_file }}
           if-no-files-found: ignore
-          retention-days: 90
+          overwrite: true
+          # Long enough to compare denial rates before and after the allowlist change
+          # (~100 review runs/week org-wide), short enough that a full-conversation log
+          # of every PR in the org is not sitting in billable storage for a quarter.
+          retention-days: 14
 
       - name: Notify on review failure
         if: github.event.pull_request.user.login != 'dependabot[bot]' && (steps.review.outcome == 'failure' || steps.review.outcome == 'cancelled')

README.md

@@ -14,6 +14,11 @@ Automated code review on every pull request using [claude-code-action](https://g
 
 The review prompt lives in [`docs/claude-pr-review-prompt.md`](docs/claude-pr-review-prompt.md).
 
+Each run attaches a `claude-execution-log-pr-<number>` artifact (14-day retention) holding the
+agent's full tool-call record. The job log itself keeps only the start and end of the run, so this
+artifact is the only way to see which tools the reviewer reached for — it exists to diagnose
+permission denials against the workflow's `--allowedTools` list. Upload failures are non-fatal.
+
 ## Setup
 
 Requires: