anthropics / anthropics/claude-code-action
Git credentials are overwritten by this action
- Dominant language
- TypeScript
- Stars
- 8.9k
- Forks
- 2.1k
- Avg merge
- 3d 9h
- Merged PRs (30d)
- 10
Description
**Describe the bug**
This action overwrites already set git credentials, making later operations (like `git push`) fail.
**To Reproduce**
The order of these steps matter:
1. Run `actions/checkout@v4` with a GitHub App token that has push access (a bit old, unsure if it matters)
2. Run `claude-code-action@v1`
3. In a later step, run `git push`
1. Push fails with `Authentication failed`
Log excerpt:
```
...
Download action repository 'anthropics/claude-code-action@v1' (SHA:b47fd721da662d48c5680e154ad16a73ed74d2e0)
...
remote: Invalid username or token. Password authentication is not supported for Git operations.
fatal: Authentication failed for 'https://github.com/some-org/some-repo.git/'
Error: Process completed with exit code 1.
```
**Expected behavior**
The Claude action shouldn't affect the environment outside its own step. Github actions should use inputs/outputs to communicate.
At least, the observable behavior should be: the environment (including the git credentials) is the same before & after using this action.
**Workflow yml file**
Something like this:
```yaml
steps:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@v2
with:
app-id: ${{ secrets.APP_ID }}
private-key: ${{ secrets.PRIVATE_KEY }}
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ github.head_ref }}
token: ${{ steps.app-token.outputs.token }}
- name: Run Claude
uses: anthropics/claude-code-action@v1
with:
anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
github_token: ${{ steps.app-token.outputs.token }}
prompt: "Read foo.txt and write bar.txt"
- name: Commit and push
run: |
git add -A
git commit -m "update" || true
git push origin HEAD
# FAILS: remote: Invalid username or token.
```
**API Provider**
[x] Anthropic First-Party API (default)
[ ] AWS Bedrock
[ ] GCP Vertex
**Additional context**
Workaround: set `.extraheader` before pushing (`steps.app-token` refers to the example above):
```yaml
- name: Commit and push
env:
APP_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
git config --local http.https://github.com/.extraheader \
"AUTHORIZATION: basic $(echo -n "x-access-token:${APP_TOKEN}" | base64 -w0)"
git push origin HEAD
```
Contributor guide
Research direction
Start with the provided workflow YAML and reproduce the failure by running actions/checkout@v4, claude-code-action@v1, and a later git push. Inspect the claude-code-action entry point for changes to the environment or git credentials. Done means the action leaves credentials unchanged so the later push succeeds without the workaround.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- git, github-actions, typescript
- Domain
- authentication, ci-cd, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100