anthropics / anthropics/claude-code-action

Git credentials are overwritten by this action

Open
#1,210 0 comments 0 reactions 0 assignees View on GitHub
area:permissions bug p2 provider:1p
Dominant language
TypeScript
Stars
8.9k
Forks
2.1k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

**Describe the bug**

This action overwrites already set git credentials, making later operations (like `git push`) fail.

**To Reproduce**

The order of these steps matter:

1. Run `actions/checkout@v4` with a GitHub App token that has push access (a bit old, unsure if it matters)
2. Run `claude-code-action@v1`
3. In a later step, run `git push`
1. Push fails with `Authentication failed`

Log excerpt:

```
...

Download action repository 'anthropics/claude-code-action@v1' (SHA:b47fd721da662d48c5680e154ad16a73ed74d2e0)

...

remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/some-org/some-repo.git/'
Error: Process completed with exit code 1.
```

**Expected behavior**

The Claude action shouldn't affect the environment outside its own step. Github actions should use inputs/outputs to communicate.

At least, the observable behavior should be: the environment (including the git credentials) is the same before & after using this action.

**Workflow yml file**

Something like this:

```yaml
steps:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}

- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ github.head_ref }}
token: ${{ steps.app-token.outputs.token }}

- name: Run Claude
uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ steps.app-token.outputs.token }}
prompt: "Read foo.txt and write bar.txt"

- name: Commit and push
run: |
git add -A
git commit -m "update" || true
git push origin HEAD
# FAILS: remote: Invalid username or token.
```

**API Provider**

[x] Anthropic First-Party API (default)
[ ] AWS Bedrock
[ ] GCP Vertex

**Additional context**

Workaround: set `.extraheader` before pushing (`steps.app-token` refers to the example above):

```yaml
- name: Commit and push
env:
APP_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
git config --local http.https://github.com/.extraheader \
"AUTHORIZATION: basic $(echo -n "x-access-token:${APP_TOKEN}" | base64 -w0)"
git push origin HEAD
```

Contributor guide

Open the contributing guide

Research direction

Start with the provided workflow YAML and reproduce the failure by running actions/checkout@v4, claude-code-action@v1, and a later git push. Inspect the claude-code-action entry point for changes to the environment or git credentials. Done means the action leaves credentials unchanged so the later push succeeds without the workaround.

Written by the indexing model from the issue text.

Assessment

Tech stack
git, github-actions, typescript
Domain
authentication, ci-cd, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.