8dfb31d8a5
Project and local settings additively merge their permissions with whatever
allowed_tools a workflow specifies. A workflow author writing a restrictive
allowlist reasonably expects it to be the complete allow-set, but
.claude/settings.json can silently expand it.
Changes:
- Add setting_sources as a first-class input to both actions (previously
only reachable via --setting-sources in claude_args)
- base-action now defaults to settingSources: ['user'] — workflows that want
project/local settings must opt in explicitly
- Main action defaults to 'user,project,local' since .claude/ is restored
from the PR base branch before execution, so project settings are
maintainer-trusted in that context
- Precedence: setting_sources input > --setting-sources in claude_args > default
Breaking change for base-action: workflows relying on .claude/settings.json
being loaded automatically need to add setting_sources: 'user,project,local'.
🏠 Remote-Dev: homespace
75 lines
2.5 KiB
TypeScript
75 lines
2.5 KiB
TypeScript
#!/usr/bin/env bun
|
|
|
|
import * as core from "@actions/core";
|
|
import { preparePrompt } from "./prepare-prompt";
|
|
import { runClaude } from "./run-claude";
|
|
import { setupClaudeCodeSettings } from "./setup-claude-code-settings";
|
|
import { validateEnvironmentVariables } from "./validate-env";
|
|
import { installPlugins } from "./install-plugins";
|
|
|
|
async function run() {
|
|
try {
|
|
validateEnvironmentVariables();
|
|
|
|
// The composite action's "Install Claude Code" step writes the binary to
|
|
// ~/.local/bin/claude. Pass that path explicitly so the Agent SDK doesn't
|
|
// fall back to its bundled platform package, which bun may resolve to the
|
|
// wrong libc variant on Linux.
|
|
const claudeExecutable =
|
|
process.env.INPUT_PATH_TO_CLAUDE_CODE_EXECUTABLE ||
|
|
`${process.env.HOME}/.local/bin/claude`;
|
|
|
|
await setupClaudeCodeSettings(
|
|
process.env.INPUT_SETTINGS,
|
|
undefined, // homeDir
|
|
);
|
|
|
|
// Install Claude Code plugins if specified
|
|
await installPlugins(
|
|
process.env.INPUT_PLUGIN_MARKETPLACES,
|
|
process.env.INPUT_PLUGINS,
|
|
claudeExecutable,
|
|
);
|
|
|
|
const promptConfig = await preparePrompt({
|
|
prompt: process.env.INPUT_PROMPT || "",
|
|
promptFile: process.env.INPUT_PROMPT_FILE || "",
|
|
});
|
|
|
|
const result = await runClaude(promptConfig.path, {
|
|
claudeArgs: process.env.INPUT_CLAUDE_ARGS,
|
|
allowedTools: process.env.INPUT_ALLOWED_TOOLS,
|
|
disallowedTools: process.env.INPUT_DISALLOWED_TOOLS,
|
|
maxTurns: process.env.INPUT_MAX_TURNS,
|
|
mcpConfig: process.env.INPUT_MCP_CONFIG,
|
|
systemPrompt: process.env.INPUT_SYSTEM_PROMPT,
|
|
appendSystemPrompt: process.env.INPUT_APPEND_SYSTEM_PROMPT,
|
|
fallbackModel: process.env.INPUT_FALLBACK_MODEL,
|
|
model: process.env.ANTHROPIC_MODEL,
|
|
pathToClaudeCodeExecutable: claudeExecutable,
|
|
showFullOutput: process.env.INPUT_SHOW_FULL_OUTPUT,
|
|
settingSources: process.env.INPUT_SETTING_SOURCES,
|
|
});
|
|
|
|
// Set outputs for the standalone base-action
|
|
core.setOutput("conclusion", result.conclusion);
|
|
if (result.executionFile) {
|
|
core.setOutput("execution_file", result.executionFile);
|
|
}
|
|
if (result.sessionId) {
|
|
core.setOutput("session_id", result.sessionId);
|
|
}
|
|
if (result.structuredOutput) {
|
|
core.setOutput("structured_output", result.structuredOutput);
|
|
}
|
|
} catch (error) {
|
|
core.setFailed(`Action failed with error: ${error}`);
|
|
core.setOutput("conclusion", "failure");
|
|
process.exit(1);
|
|
}
|
|
}
|
|
|
|
if (import.meta.main) {
|
|
run();
|
|
}
|