[cliffhall]

Closes #5337

Description

Removes the @claude mention workflow and everything that existed only because of it:

• Deletes .github/workflows/claude.yml.
• Deletes scripts/claude-workflow.test.mjs, which evaluated that workflow's trusted-author if: per event.
• scripts/verify-action-pins.mjs: the header no longer names claude.yml as a credentialed job. Item 1 now lists only release.yml's publish jobs, and item 2 names sdk-watch.yml's analyze and post (the remaining ANTHROPIC_API_KEY holders). No code path special-cased the file. The guard reads whatever workflows exist.
• AGENTS.md: drops the claude.yml (@claude mentions) tree entry. Under Credentialed workflow jobs it drops claude.yml from the list of credential holders and removes the "a credentialed job that a comment, review or issue can start runs only for a trusted author" bullet. With the workflow gone, no machinery is left for that bullet to describe ("every rule in this file is true of the repository as it stands").
• .github/workflows/sdk-watch.yml: the header comment no longer says ANTHROPIC_API_KEY is "the organization secret claude.yml already uses". The secret stays, since analyze and post still use it.

docs/agent-guidance-inception.md is a historical design record, so its two mentions are left as written, as the issue allows.

Server Details

• Server: none (repository-wide)
• Changes to: a workflow, a script test, a guard's header comment, AGENTS.md

Motivation and Context

See #5337. Almost every run of claude.yml was a skip: any comment without a trusted @claude mention, bot comments included. Those skips cluttered the Actions tab and the PR checks and looked like stalled work during a release. The maintainers do not use the workflow, and it held ANTHROPIC_API_KEY, so removing it also removes credential surface.

Scheduled and event workflows run from main, so the runs stop at the next milestone merge, not when this merges to v2/main.

How Has This Been Tested?

This change has no client-observable surface (workflows, guard comments, docs), so instead of client evidence it carries targeted probes:

• git grep -n -e claude.yml -e claude-workflow now hits only docs/agent-guidance-inception.md (lines 81 and 669), the historical record.
• No remaining workflow listens for issue_comment, pull_request_review or pull_request_review_comment to run Claude: git grep -n -e issue_comment -e pull_request_review -- .github/workflows returns nothing.
• npm run local:gate exits 0. That covers test:scripts, now without the deleted test, and verify:action-pins over the remaining workflows.

Breaking Changes

None. No published package changes, and no client configuration is affected.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Protocol Documentation (not applicable: no protocol surface is touched)
• My changes follow MCP security best practices (removes a job that held ANTHROPIC_API_KEY)
• I have updated the server's README accordingly (not applicable: no server changes)
• I have added a changeset (npm run changeset) if this changes what a TypeScript server publishes (not applicable: no published package changes)
• I have tested this with an LLM client (not applicable: no server-facing change)
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling (not applicable: deletions and comment edits only)
• I have documented all environment variables and configuration options (not applicable: none added or changed)

🤖 Generated with Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 79fe953

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Copilot]

🟢 Approval recommended

No active review issues are reported for the removal of the unused @claude mention workflow.

No open issues 🎉

What changed in this PR

Removes the unused @claude mention workflow for #5337, reducing skipped Actions runs and credential exposure without changing any server package.

Changes:

• Deletes the mention-triggered workflow and its dedicated trusted-author tests.
• Removes obsolete workflow references and guidance; remaining workflow behavior is unchanged.
• Preserves historical documentation and the API secret usage required by SDK Watch.

File	Description
scripts/​verify-action-pins.mjs	Updates header examples of credentialed jobs; guard logic is unchanged.
scripts/​claude-workflow.test.mjs	Deletes tests specific to the removed workflow.
AGENTS.md	Removes the workflow listing and its dedicated trusted-author rule.
.github/​workflows/​sdk-watch.yml	Removes an obsolete cross-reference from the secret’s comment.
.github/​workflows/​claude.yml	Deletes the @claude mention workflow.

_{Review effort: Balanced}

[cliffhall]

Copilot round 1: clean, with no findings and no suppressed comments. The loop stops at this first clean round (the Clean round exit in pr-flow), so no further round was requested.