claude-code-action

mirror of https://github.com/anthropics/claude-code-action.git synced 2026-08-03 17:58:30 +08:00

History

Disable auto-approval of project MCP servers when .mcp.json changes in PR

When a PR modifies .mcp.json, the checked-out working directory contains a
version that may differ from the base branch. Blindly setting
enableAllProjectMcpServers=true in that context auto-approves those MCP
servers without the user having reviewed them.

Fix: before calling setupClaudeCodeSettings, check whether .mcp.json changed
in the triggering PR using the GitHub REST API (pulls.listFiles). If it did,
pass mcpJsonChanged=true to suppress the enableAllProjectMcpServers=true
override. When .mcp.json is unmodified (the common case), behaviour is
unchanged.

- Add mcpJsonChanged parameter to setupClaudeCodeSettings
- Add PR file-list check in src/entrypoints/run.ts
- Update tests: update existing override test, add two new mcpJsonChanged=true tests

2026-02-15 12:39:01 -08:00

mcp-test

fix: resolve high vulnerability CVE-2025-66414 (#792 )

2026-01-07 12:53:45 +05:30

install-plugins.test.ts

feat: support local plugin marketplace paths (#761 )

2026-01-05 16:13:32 +05:30

parse-sdk-options.test.ts

fix: pass OpenTelemetry environment variables to Claude Code subprocess (#886 )

2026-02-01 14:01:29 -08:00

parse-shell-args.test.ts

feat: implement Claude Code GitHub Action v1.0 with auto-detection and slash commands (#421 )