anthropics / anthropics/claude-code-action

Authentication failure when using Claude Github Actions in combination with Github IP Allow List

Open
#183 4 comments 0 reactions 1 assignee Claimed by @ashwin-ant View on GitHub
bug enhancement p1
Dominant language
TypeScript
Stars
8.9k
Forks
2.1k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

**Describe the bug**
We are working through some experimentation using Claude CLI from within our Github Actions to bolster pull request review. We have a couple of orgs that house the majority of our important code repositories; in order to secure these, we additionally have [IP Allow Lists](https://docs.github.com/en/enterprise-cloud@latest/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/managing-allowed-ip-addresses-for-your-organization) enabled.

We have attempted to add the Anthropic endpoints documented [here](https://docs.anthropic.com/en/api/ip-addresses) to that allow list, but that was unsuccessful and results in the following error. When we temporarily disabled the IP allow list security control we experienced successful interactions with Claude CLI.

Are there alternative IP addresses that we should consider adding to our Allow List configuration? Alternatively, it would be ideal for ourselves and all future Anthropic customers if they chose to implement automatic IP Configuration based on the [Github App Registration](https://docs.github.com/en/apps/maintaining-github-apps/managing-allowed-ip-addresses-for-a-github-app).

**To Reproduce**
Steps to reproduce the behavior:

1. Enable IP Allow List security configuration.
2. Add IP ranges from Anthropics website.
3. Cause Claude to be triggered
4. See error

**Expected behavior**
Claude can successfully connect and run against our IP allow list orgs.

**Screenshots**
```
Run bun run ${GITHUB_ACTION_PATH}/src/entrypoints/prepare.ts
[76](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:80)Requesting OIDC token...
[77](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:81)Attempt 1 of 3...
[78](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:82)OIDC token successfully obtained
[79](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:83)Exchanging OIDC token for app token...
[80](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:84)Attempt 1 of 3...
[81](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:85)App token exchange failed: 401 Unauthorized - Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude
[82](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:86)Attempt 1 failed: Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude
[83](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:87)Retrying in 5 seconds...
[84](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:88)Attempt 2 of 3...
[85](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:89)App token exchange failed: 401 Unauthorized - Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude
[86](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:90)Attempt 2 failed: Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude
[87](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:91)Retrying in 10 seconds...
[88](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:92)Attempt 3 of 3...
[89](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:93)App token exchange failed: 401 Unauthorized - Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude
[90](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:94)Attempt 3 failed: Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude
[91](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:95)Operation failed after 3 attempts
[92](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:96)Error: Failed to setup GitHub token: Error: Claude Code is not installed on this repository. Please install the Claude Code GitHub App at https://github.com/apps/claude.
[93](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:97)
[94](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:98)If you instead wish to use this action with a custom GitHub token or custom GitHub app, provide a `github_token` in the `uses` section of the app in your workflow yml file.
[95](https://github.com/vu-pdt/sw.mcp-server-poc/actions/runs/15742157456/job/44369929036#step:3:99)Error: Process completed with exit code 1.
```

**Workflow yml file**
If it's not sensitive, consider including a paste of your full Claude workflow.yml file.

**API Provider**

[ X] Anthropic First-Party API (default)
[ ] AWS Bedrock
[ ] GCP Vertex

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.