Testing strategy

Runs in GitHub Actions on your Claude Pro or Max plan through an OAuth token from claude setup-token. No API credits.

Set up the "Label-driven dev loop: triage → plan → implement → red-team → human merge" GitHub workflow from AgentFlows (https://agentflows.sh/flows/label-driven-dev-loop) so it runs on my Claude Pro or Max subscription instead of API credits.

Install these agent skills first. Download each SKILL.md from its source (respect its license) into .claude/skills/<name>/SKILL.md, or wherever this agent loads skills from:
- Testing strategy: https://github.com/anthropics/knowledge-work-plugins/blob/main/engineering/skills/testing-strategy/SKILL.md (Apache-2.0), notes at https://agentflows.sh/skills/testing-strategy

Save this file as .github/workflows/label-driven-dev-loop.yml:

```yaml
name: Dev Loop
on:
  issues:
    types: [opened, labeled]
  pull_request:
    types: [labeled]
permissions:
  contents: write
  issues: write
  pull-requests: write
  id-token: write
jobs:
  triage:  # new issue -> label triage/planning
    if: github.event_name == 'issues' && github.event.action == 'opened'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: anthropics/claude-code-action@v1
        with:
          claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
          prompt: |
            REPO: ${{ github.repository }}  ISSUE: ${{ github.event.issue.number }}
            Triage this issue. If it is actionable, run:
            gh issue edit ${{ github.event.issue.number }} --add-label planning
            Otherwise comment asking for missing info and add label triage.
          claude_args: |
            --allowedTools "Bash(gh issue view:*),Bash(gh issue edit:*),Bash(gh issue comment:*)"

  plan:  # label planning -> post plan, then label ready (human can veto)
    if: github.event_name == 'issues' && github.event.label.name == 'planning'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          prompt: |
            REPO: ${{ github.repository }}  ISSUE: ${{ github.event.issue.number }}
            Read the code and post an implementation plan as an issue comment (files, steps, tests).
            Do NOT add the ready label; a human adds it to approve the plan.
          claude_args: |
            --allowedTools "Read,Grep,Glob,Bash(gh issue view:*),Bash(gh issue comment:*)"

  implement:  # human adds ready -> Claude implements and opens PR
    if: github.event_name == 'issues' && github.event.label.name == 'ready'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          label_trigger: "ready"
          branch_prefix: "claude/"
          prompt: |
            Implement the approved plan in the issue comments. Run tests.
            Open a PR that says "Closes #${{ github.event.issue.number }}" and add label review-red-team to the PR.

  red_team:  # PR labeled review-red-team -> a DIFFERENT agent attacks it
    if: github.event_name == 'pull_request' && github.event.label.name == 'review-red-team'
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      verdict: ${{ steps.codex.outputs.final-message }}
    steps:
      - uses: actions/checkout@v5
        with:
          ref: refs/pull/${{ github.event.pull_request.number }}/merge
          persist-credentials: false
      - id: codex
        uses: openai/codex-action@v1
        with:
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
          permission-profile: ":read-only"
          prompt: |
            You are a red-team reviewer. Try to break PR #${{ github.event.pull_request.number }}:
            edge cases, security, missing tests, plan drift. End with a line VERDICT: PASS or VERDICT: FAIL.

  hand_off:  # post verdict, move to in-review; a human merges
    needs: red_team
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
    steps:
      - env:
          GH_TOKEN: ${{ github.token }}
          VERDICT: ${{ needs.red_team.outputs.verdict }}
          PR: ${{ github.event.pull_request.number }}
        run: |
          gh pr comment "$PR" -R "${{ github.repository }}" --body "$VERDICT"
          if echo "$VERDICT" | grep -q "VERDICT: PASS"; then
            gh pr edit "$PR" -R "${{ github.repository }}" --remove-label review-red-team --add-label in-review
          fi
          # No auto-merge: a human reviews in-review PRs and merges.
```

It authenticates with CLAUDE_CODE_OAUTH_TOKEN. Tell me to run `claude setup-token` in my own terminal to create it, then run `gh secret set CLAUDE_CODE_OAUTH_TOKEN` and let me paste it. Never write the token into a file.

It runs on: issues/pull_request: labeled. Runs count against my subscription's usage limits, and GitHub Actions minutes still apply.

Show me the diff, then commit on a new branch and open a pull request.