Include issue_comment in event-gated settingSources default

🏠 Remote-Dev: homespace

base-action/README.md

@@ -112,6 +112,8 @@ Add the following to your workflow file:
 
 \*\*`show_full_output` is automatically enabled when GitHub Actions debug mode is active. See [security documentation](../docs/security.md#️-full-output-security-warning) for important security considerations.
 
+`setting_sources` defaults to `user,project,local` for most events. Under `pull_request_target`, `workflow_run`, and `issue_comment` it defaults to `user` only; set it explicitly if you want project/local settings to load for those events.
+
 ## Outputs
 
 | Output           | Description                                                |

base-action/action.yml

@@ -19,7 +19,7 @@ inputs:
     required: false
     default: ""
   setting_sources:
-    description: "Comma-separated list of setting sources to load (user, project, local). Defaults to 'user,project,local'; under pull_request_target/workflow_run, defaults to 'user' only. Project/local settings additively merge permissions with allowed_tools — set explicitly to control which sources load."
+    description: "Comma-separated list of setting sources to load (user, project, local). Defaults to 'user,project,local'; under pull_request_target/workflow_run/issue_comment, defaults to 'user' only. Project/local settings additively merge permissions with allowed_tools — set explicitly to control which sources load."
     required: false
     default: ""
 

base-action/src/parse-sdk-options.ts

@@ -274,16 +274,17 @@ export function parseSdkOptions(options: ClaudeOptions): ParsedSdkOptions {
     // Setting sources precedence: direct input > --setting-sources in claude_args > default.
     // The default is supplied by the caller (the wrapper action passes
     // ["user","project","local"]); base-action applies an event-gated default of ["user"]
-    // under pull_request_target/workflow_run and ["user","project","local"] otherwise.
+    // under pull_request_target/workflow_run/issue_comment and ["user","project","local"]
-    // Both action.yml files leave the YAML default empty so that --setting-sources in
+    // otherwise. Both action.yml files leave the YAML default empty so that
-    // claude_args is reachable when the input is not set.
+    // --setting-sources in claude_args is reachable when the input is not set.
     settingSources: (options.settingSources
       ? options.settingSources.split(",").map((s) => s.trim())
       : extraArgs["setting-sources"]
         ? extraArgs["setting-sources"].split(",").map((s) => s.trim())
         : (options.defaultSettingSources ??
           (process.env.GITHUB_EVENT_NAME === "pull_request_target" ||
-          process.env.GITHUB_EVENT_NAME === "workflow_run"
+          process.env.GITHUB_EVENT_NAME === "workflow_run" ||
+          process.env.GITHUB_EVENT_NAME === "issue_comment"
             ? ["user"]
             : ["user", "project", "local"]))) as SdkOptions["settingSources"],
   };

base-action/test/parse-sdk-options.test.ts

@@ -458,6 +458,13 @@ describe("parseSdkOptions", () => {
       expect(result.sdkOptions.settingSources).toEqual(["user"]);
     });
 
+    test("should default to ['user'] under issue_comment", () => {
+      process.env.GITHUB_EVENT_NAME = "issue_comment";
+      const result = parseSdkOptions({});
+
+      expect(result.sdkOptions.settingSources).toEqual(["user"]);
+    });
+
     test("should use direct settingSources input when provided", () => {
       const options: ClaudeOptions = {
         settingSources: "user,project,local",