anthropics / anthropics/claude-code-action

v1.0.100 breaks environments where claude.ai is unreachable (install.sh silently fails, SDK bundled binary bypassed)

Open
#1,242 1 comment 2 reactions 0 assignees View on GitHub
bug
Dominant language
TypeScript
Stars
8.9k
Forks
2.1k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

**Describe the bug**

v1.0.100 breaks the action on self-hosted runners where `claude.ai` is unreachable (corporate firewall) but npm packages are available via a registry mirror (e.g. AWS CodeArtifact).

The `install.sh` download silently fails (curl SSL error, but `bash` in the pipe exits 0), so the action reports "Claude Code installed successfully". Then v1.0.100's new logic passes the non-existent `$HOME/.local/bin/claude` path to the SDK, which throws:

```
ReferenceError: Claude Code native binary not found at /home/sh-runner/.local/bin/claude
```

Prior to v1.0.100, `pathToClaudeCodeExecutable` was `undefined` when not explicitly set, so the SDK fell back to its **bundled platform binary** (`@anthropic-ai/claude-agent-sdk-linux-x64` installed via `bun install --production` from npm). This worked fine through corporate registry proxies.

The change in PR #1235 was intended to avoid a bun libc resolution bug, but it breaks environments where the native install is impossible and the bundled binary is the only viable path.

**To Reproduce**

1. Run the action on a self-hosted runner where `claude.ai` is not reachable (corporate firewall, no direct internet)
2. Ensure npm packages are available via a registry proxy (e.g. AWS CodeArtifact)
3. Use `anthropics/claude-code-action@v1` (resolves to v1.0.100+)
4. Observe: install.sh curl fails, action reports success, then SDK throws "native binary not found"

CI log from a broken run:

```
Installing Claude Code v2.1.114...
Installation attempt 1...
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to claude.ai:443
Claude Code installed successfully
...
SDK execution error: ReferenceError: Claude Code native binary not found at /home/sh-runner/.local/bin/claude
```

CI log from a working run on v1.0.99 (same environment, same SSL error, but SDK falls back to bundled binary):

```
Installing Claude Code v2.1.111...
Installation attempt 1...
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to claude.ai:443
Claude Code installed successfully
[review completes successfully in 2m59s]
```

**Expected behavior**

When `install.sh` fails to download or install the native binary, the action should detect this and allow the SDK to fall back to its bundled platform binary (from the npm optional dependency). Two sub-issues:

1. The pipe `curl ... | bash` masks curl failures — bash receives no input, exits 0, and the action treats it as a successful install. Consider `set -o pipefail` or verifying the binary exists after install.
2. When the native binary is not available, `pathToClaudeCodeExecutable` should be left as `undefined` rather than pointing to a non-existent file, so the SDK can use its bundled binary.

**Workflow yml file**

```yaml
name: Claude PR Action

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
pull_request_review:
types: [submitted]
pull_request:
types: [opened, reopened, ready_for_review]

permissions:
contents: read
issues: write
pull-requests: write
id-token: write

jobs:
claude:
uses: our-org/shared-github-workflows/.github/workflows/claude-pr-review.yml@master
with:
review_prompt: "/review-pr"
show_full_output: true
secrets:
CLAUDE_APP_ID: ${{ secrets.CLAUDE_APP_ID }}
CLAUDE_APP_PRIVATE_KEY: ${{ secrets.CLAUDE_APP_PRIVATE_KEY }}
CLAUDE_AWS_ROLE_TO_ASSUME: ${{ secrets.CLAUDE_AWS_ROLE_TO_ASSUME }}
```

The shared workflow uses `anthropics/claude-code-action@v1` with `use_bedrock: "true"`.

**API Provider**

[x] AWS Bedrock

**Additional context**

- Self-hosted runners (Linux x64, glibc) behind corporate firewall — `claude.ai` has never been reachable
- npm packages available via AWS CodeArtifact registry proxy — `@anthropic-ai/claude-agent-sdk-linux-x64` installs successfully
- Workaround: pin to `@v1.0.99` which restores `pathToClaudeCodeExecutable: undefined`
- The regression was introduced in v1.0.100 (PR #1235: "fix: pass install.sh binary path to Agent SDK after 0.2.113 bump")
- The v1.0.100 comment says: *"bun may resolve to the wrong libc variant on Linux"* — but in our environment the bundled binary works correctly, and a working bundled binary is better than a non-existent native one

Contributor guide

Open the contributing guide

Research direction

Start with install.sh and the action code that sets pathToClaudeCodeExecutable after the install attempt; compare the v1.0.100 change from PR #1235 with the v1.0.99 behavior. Reproduce using an unreachable claude.ai and an npm registry mirror, then verify failed native installation is detected and the SDK can use its bundled platform binary.

Written by the indexing model from the issue text.

Assessment

Tech stack
bash, typescript
Domain
ci-cd, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.