[kyle-sexton]

No related issue: closes a measurement gap found in a GITHUB_TOKEN spend reading; no issue tracks it.

Summary

The hub ranks GITHUB_TOKEN spend by each job's api-calls github-token=N notice. Jobs from the pr-review-cli and pr-require-checks-trust-paths reusables log none. In claude-code-plugins' spend reading for 2026-10-29 17:58Z-18:58Z (.work/gh-monitor/trends/token-spend-2026-10-29T18.md, a local operator file, not committed), notices accounted for 2,918 of about 4,289 calls (68%). About 1,371 calls (32%) had no notice. The file names the pr-review-hosted and pr-review-security-hosted jobs (review-status, key-credit, review-subscription, security-review; 23 runs each) as "the most likely large unmeasured spender". It also lists pr-require-checks-trust-paths (34 runs) among the jobs with no notice.

Fix

• report-api-budget now writes the api-calls notice for each named token, ::notice title=api-calls::github-token=N not-modified=M graphql=K, plus an api-calls ... summary line. It uses the same format and counting method as claude-code-plugins' log-api-budget: api_budget_emit_calls is copied byte for byte, and N counts one per reading the job's own requests left. A job with no reading now logs a count of 0 instead of nothing, as log-api-budget does.
• pr-review-cli.yml: unchanged. All five of its jobs already end with report-api-budget and record one reading per job-token request, so each now logs the notice.
• pr-require-checks-trust-paths.yml had no budget step. Now:
  • the check composite watches its Octokit client through api-budget.cjs;
  • the fallback status step records its one request inline, since it has no checkout to require from, as the review scope step does;
  • the job ends with report-api-budget (if: always(), continue-on-error: true).
• No input, output, secret, permission or token scope changes.
• Not counted, since they are not REST or GraphQL requests: git traffic (checkout at the head SHA, the basic-auth fetches) and artifact upload and download, which use the runtime token.

Verification

• node --test .github/scripts/*.test.cjs: 763 pass, 0 fail.
• New and extended tests:
  • each pr-review-cli run shape's key and status jobs log github-token=<that job's request count>;
  • api_budget_emit_calls counts 304 and GraphQL readings separately;
  • the action logs a count of 0 when the job made no request;
  • the trust-path check, run as shipped through a hooked fake client, makes 6 requests, leaves 6 readings and logs github-token=6;
  • the fallback step records its response and a 403 refusal as api-budget.cjs would;
  • the trust-path job's last step is the budget step, and the composite calls watch before run.
• Mutation check: removing the composite's watch, the fallback hook or the notice line each fails at least one new test.
• The three shared functions are byte-identical to claude-code-plugins' api-budget.bash (diff of each function body).
• zizmor --offline on the four touched workflow and action files: no findings. shellcheck on api-budget.bash: clean. shellcheck on the action's extracted run: block reports only SC2154 for its step env variables. biome check on the touched tests: clean. markdownlint-cli2 README.md: clean.
• actionlint 1.7.12 locally reports only the $/ "ref is missing" finding and the cache-mode key on lines it already flags on main. The new $/ step adds one more of that class.

Related

• After release, claude-code-plugins re-pins pr-review-hosted.yml, pr-review-security-hosted.yml and pr-require-checks-trust-paths.yml to the new tag and adds the matching runner-policy/policy.json keys.

🤖 Generated with Claude Code

[kyle-sexton]

#937 deleted the trust-path hold (.github/workflows/pr-require-checks-trust-paths.yml, .github/actions/pr-require-checks/check-trust-paths/ and .github/scripts/pr-require-checks-trust-paths.test.cjs), so this PR now conflicts. Drop its changes to those files. The report-api-budget and pr-review-cli parts still apply.