claude-code-action

History

Strip OIDC token request env vars from Claude session (#1011 )

When id-token: write permission is enabled, ACTIONS_ID_TOKEN_REQUEST_URL
and ACTIONS_ID_TOKEN_REQUEST_TOKEN are passed to the Claude session via
the process.env spread in parseSdkOptions(). This allows Claude to mint
new OIDC tokens, which is an unintended capability.

This commit deletes these two variables from the env object before passing
it to the Claude SDK. The OIDC flow in token.ts reads directly from
process.env and runs before parseSdkOptions(), so it is unaffected.

Fixes #1010

2026-04-04 20:13:05 -07:00

mcp-test

fix: resolve high vulnerability CVE-2025-66414 (#792 )

2026-01-07 12:53:45 +05:30

install-plugins.test.ts

feat: support local plugin marketplace paths (#761 )

2026-01-05 16:13:32 +05:30

parse-sdk-options.test.ts

Strip OIDC token request env vars from Claude session (#1011 )

2026-04-04 20:13:05 -07:00

parse-shell-args.test.ts

feat: implement Claude Code GitHub Action v1.0 with auto-detection and slash commands (#421 )