Issue/PR comments (#512) and the issue/PR body (#710) are filtered to the
trigger timestamp so content created or edited after an authorized trigger
cannot be injected into Claude's prompt (TOCTOU protection). Reviews and
inline review comments were not: fetchGitHubData returned reviewData filtered
by actor only, and formatReviewComments renders it into the prompt, so a
review submitted or edited after the trigger reached Claude verbatim.
filterReviewsToTriggerTime already existed (added alongside the comment filter
in #512) but was only wired to the image-download list, never to the returned
reviewData.
Filter reviewData.nodes through filterReviewsToTriggerTime and each review's
inline comments through filterCommentsToTriggerTime, alongside the existing
actor filter, then build the review image-processing lists from those
already-filtered nodes (removing a now-redundant second filter pass).
Strengthen the two integration tests to assert post-trigger and edited-after
reviews/comments are dropped.
parseAllowedTools (used to decide which GitHub MCP servers to install)
hand-rolled a regex parse of claude_args, while the tools actually
granted to Claude are parsed by parseClaudeArgsToExtraArgs in
base-action/src/parse-sdk-options.ts using shell-quote. The two parsers
diverged on two inputs (#1357):
- Multiple values after a single flag: for
`--allowedTools "Read" "Grep" "mcp__github__get_commit"` the regex
captured only "Read", so the github MCP server was not installed even
though mcp__github__get_commit was granted — tool calls then failed.
- Commented-out lines: the regex counted tools on `#`-prefixed lines
that the SDK parser strips, installing servers that were never used.
Reimplement parseAllowedTools on the same shell-quote tokenizer and the
same "accumulating flag consumes all consecutive non-flag values"
semantics, stripping comment lines first, so the install decision agrees
with the tools that are actually granted. Unquoted glob patterns (e.g.
`mcp__github__*`), which shell-quote yields as glob objects, are
recovered to their literal text to preserve existing behavior.
Closes#1357
Co-authored-by: bymle <229636660+bymle@users.noreply.github.com>
* fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash
shell-quote's parse() tokenizes unquoted `(`, `)` as control operators
and barewords containing `*` as glob ops, all returned as non-string
objects. parseClaudeArgsToExtraArgs filtered those out, so an unquoted
`--allowedTools View,Bash(gh:*),Bash(cat:*)` collapsed to bare `Bash` —
silently widening scoped permission rules to unrestricted Bash(*).
Escape shell control metachars to Unicode private-use placeholders
before parse() and restore after; extract .pattern from glob ops.
Preserves existing quote/whitespace handling.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
* ci: retrigger
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
* Add pr-stamp-sweep review workflow
Adds a reusable workflow script that fans out one reviewer agent per
candidate PR to judge whether it can be approved as-is, then runs an
adversarial verification pass on each approval recommendation before
including it in the final list.
Reviewers read pre-fetched PR dossiers from /tmp/claude/pr-sweep/<n>.md
(metadata, body, comments, full diff) rather than calling gh directly,
and verify diff claims against the local checkout. PR numbers are
passed via args; the script fails fast if none are provided.
* Sharpen security checklist in reviewer prompts
Replace the general security-history note with explicit attack classes
both reviewer stages must check: prompt injection (untrusted content
reaching Claude's context, including via tool output), code execution
(shell commands, eval/spawn, workflow expressions), path traversal,
and credential exposure.
GitHub serves pasted attachments from /user-attachments/assets/<uuid>
with no file extension, so getImageExtension() silently defaulted to
".png". When the bytes are actually JPEG/GIF/WebP the downloaded file is
mislabeled, and the Read tool then sends a base64 image whose declared
media_type doesn't match its magic bytes — which the Anthropic API
rejects with `400 invalid_request_error` ("image was specified using the
image/png media type, but the image appears to be a image/jpeg image").
Sniff the real format from the buffer's magic bytes after download and
only fall back to the URL-based extension when the signature is
unrecognized. Adds a regression test for a JPEG at an extensionless URL.
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
stripHiddenAttributes used the pattern `["'][^"']*["']` for each quoted
attribute, which matches an opening quote of either type and stops at the
first quote of either type. When a value contained the other quote
character — e.g. an apostrophe inside a double-quoted attribute like
`title="We'll do it"` — the match terminated at the apostrophe, so the
wrong span was removed and the surrounding text was corrupted (e.g.
`<Tooltip title="We'll do it" placement="top">` became
`<Tooltipll do it" placement="top">`).
This surfaced via the github_inline_comment MCP tool: suggestion blocks
whose code lines contain quotes were mangled before posting (#1366).
Match each quoted form per quote type (`"[^"]*"` and `'[^']*'`),
mirroring stripMarkdownLinkTitles, so a value may freely contain the
other quote character. The unquoted fallback is unchanged.
Closes#1366
Co-authored-by: bymle <229636660+bymle@users.noreply.github.com>
The formatted_context block sent to the agent omitted labels for both
issues and pull requests, even though the GraphQL queries already
fetched them. This caused agents to incorrectly report "no labels"
when labels existed, breaking any workflow that routes on label state
(e.g., drift-fix routing on drift:* labels in a Drift Watcher pattern).
Changes:
- Add 'PR Labels:' line to PR context output
- Add 'Issue Labels:' line to issue context output
- Both emit 'none' when no labels are present (explicit > omitted)
- Bump labels(first: 1) → labels(first: 100) in both queries; the
previous cap meant only one label would appear even after the
formatter fix
- Update existing tests + add 'with labels' tests for both PR and
issue branches
Discovered while building a GitHub Actions workflow that uses this
action for drift-watcher routing in an internal seed framework
(joshpayne-joby/slim-routines#6). The agent self-diagnosed the gap
by inspecting this action's source — a satisfying full-loop.
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Previously, prompt files at `${RUNNER_TEMP}/claude-prompts/` from a prior
invocation could persist on non-ephemeral self-hosted runners (where the
documented `RUNNER_TEMP` cleanup contract is not reliably honored). In
particular, `claude-user-request.txt` is only written by `create-prompt`
when a user request exists; an `agent`-mode invocation does not overwrite
it, so a stale value left by an earlier mention-mode job in another repo
would leak into a later agent-mode job's effective context on the same
runner agent.
Fix: `rm -rf` the directory before `mkdir` in both write sites
(`src/create-prompt/index.ts`, `src/modes/agent/index.ts`). Idempotent,
safe on hosted runners (where the dir is already empty), and self-heals
on self-hosted runners.
Closes#1287
In some workflow contexts — reliably reproducible for us on
pull_request-triggered runs of this action — the Claude Agent SDK
query() async iterator does not close after the terminal result
message is emitted. The for-await loop in runClaudeWithSdk blocks
indefinitely after Claude has finished its work, until the workflow's
timeout-minutes cap kills the job.
Symptoms observed in production (4× in our scan-reviewer workflow):
- Claude completes successfully: SDK emits { type: "result",
subtype: "success", ... } with the cost / turns / duration set.
- The action then sits with zero log output for the rest of
timeout-minutes (we measured 18-19 min of dead time after result).
- The job is cancelled at timeout. writeExecutionFile is never
called → no claude-execution-output.json → cost-tracker and other
post-steps see nothing.
- Run shows as cancelled, even though Claude did its work and any
verdict it posted via gh tools already landed.
Author-mode (workflow_dispatch) runs from the same codebase
terminate cleanly the same day, so the hang is specific to certain
event triggers.
By SDK contract the result message is terminal — no further messages
follow. Break out of the loop immediately after capturing it,
regardless of whether the upstream iterator ever closes. If the SDK
is later fixed to close cleanly in all contexts, this break becomes
a no-op.
The "Run Claude Code Action" step maps the auth inputs into env
unconditionally:
ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
CLAUDE_CODE_OAUTH_TOKEN: ${{ inputs.claude_code_oauth_token }}
When the input is empty — whether because the caller supplied auth via
the step `env:` block (as reported in #676) or because the `with:` value
resolves empty in some runner/secret configurations — this assignment
overwrites the inherited env value with an empty string. validate-env
then fails with the misleading "Either ANTHROPIC_API_KEY or
CLAUDE_CODE_OAUTH_TOKEN is required" error even though the caller did
provide a token.
Fall back to the inherited env var when the input is empty, mirroring the
existing `${{ env.X }}` pattern already used a few lines below for
ANTHROPIC_BASE_URL / ANTHROPIC_CUSTOM_HEADERS. The input still takes
precedence; nothing changes for workflows that pass auth via `with:`.
Fixes#676
The "Why won't Claude rebase my branch?" FAQ told users they could
enable rebasing by passing `--allowedTools "Bash(git rebase:*)"` via
claude_args. This does not work: the system prompt built in
src/create-prompt/index.ts unconditionally instructs Claude that it
cannot merge, rebase, or perform branch operations beyond creating and
pushing commits, so Claude declines rebase requests regardless of the
allowed tools.
Update the FAQ to describe the actual behavior and point users to the
real workaround (rebase locally or via the Claude Code CLI).
Closes#1286
Co-authored-by: bymle <229636660+bymle@users.noreply.github.com>
* test: add unit tests for parseGitHubContext and context type guards
Covers all supported webhook event types (entity and automation),
the pull_request_target normalization, isPR detection for comments
on pull requests, env-derived input defaults and parsing, and the
nine type guard functions. Raises src/github/context.ts line
coverage from 26.5% to 100%.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test: assert all env-derived inputs to close mutation testing gaps
Mutation testing (StrykerJS, 138 mutants) showed 22 surviving mutants
in the env input parsing of parseGitHubContext: fields like
trackProgress, includeFixLinks, allowedBots and the comment actor
filters were never asserted. Asserting every input field in both the
defaults and the explicit-values tests, plus covering the optional
chaining on payload.repository, brings the mutation score for
src/github/context.ts from 84.06% to 100%.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* Drop --tsconfig-override from Bun invocations to avoid runtime crash
Passing --tsconfig-override to `bun run` triggers a Bun runtime bug
("Internal error: directory mismatch for directory .../tsconfig.json")
that aborts the action with exit code 1 before any work is done.
Bun already auto-discovers the action's own tsconfig.json by walking up
the directory tree from the entry file, so the override is redundant —
the workspace's tsconfig is never an ancestor of the action checkout.
Dropping the flag preserves tsconfig resolution while avoiding the crash.
Refs: oven-sh/bun#25730https://claude.ai/code/session_01L763e4S7zBnzDqmYYEJS1A
* Fix prettier formatting in create-prompt/index.ts
Removes redundant outer parentheses that were tripping format:check.
Pre-existing on main; unrelated to the action.yml change but needed
to keep CI green on this branch.
https://claude.ai/code/session_01L763e4S7zBnzDqmYYEJS1A
---------
Co-authored-by: Claude <noreply@anthropic.com>
actions/checkout v4 and oven-sh/setup-bun v2.0.2 run on the deprecated
Node 20 action runtime and emit a deprecation warning on every run.
Bump to checkout v6.0.2 and setup-bun v2.2.0 (both Node 24).
Co-authored-by: ant-kurt <209710463+ant-kurt@users.noreply.github.com>
* chore: bump actions/setup-node from v4.4.0 to v6.4.0 (Node.js 24)
setup-node v4 runs on the deprecated Node.js 20 action runtime, producing
a deprecation warning on every workflow run that uses base-action. v6 runs
on Node 24. This only changes the action's own runtime — the node-version
it installs for user code is unaffected.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Disable setup-node v5+ automatic package-manager caching
Preserves v4 behavior: caching only when use_node_cache=true.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---------
Co-authored-by: ant-kurt <209710463+ant-kurt@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
* Add workload identity federation support to base-action
Move the workload identity module into base-action so the standalone
action can fetch and refresh the GitHub OIDC identity token itself, and
expose the same federation inputs as the outer action. Switch the
base-action test workflows from the anthropic_api_key secret to the
federation repo variables and grant them id-token: write.
* Verify MCP test tool invocation instead of init connection status
MCP servers can connect asynchronously, so the init event may report a
server as pending. Check that the server is registered at init, then
assert the test tool was actually called and returned its response.
Also pass the MCP config through claude_args --mcp-config, replacing the
removed mcp_config input.
Switch claude.yml, claude-review.yml, and issue-triage.yml from the
anthropic_api_key secret to the workload identity federation inputs.
The federation rule, organization, and service account IDs are read
from repository variables; issue-triage.yml additionally gains the
id-token: write permission required to request the OIDC token.
