anthropics / anthropics/claude-code-action

Encountered a "Workflow validation failed" error in a reusable workflow

Open
#443 53 comments 36 reactions 1 assignee Claimed by @ashwin-ant View on GitHub
bug p3
Dominant language
TypeScript
Stars
8.9k
Forks
2.1k
Avg merge
3d 9h
Merged PRs (30d)
10

Description

**Describe the bug**

I am using a Claude code action via a reusable workflow.

Around the execution on or after August 12, 1:00 UTC, I started encountering the following error during `Exchanging OIDC token for app token`: `App token exchange failed: 401 Unauthorized - Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch`.

**To Reproduce**
Steps to reproduce the behavior:

1. Make reusable workflow at `shared_actions` repository
2. Make workflow uses 1. at another repository
3. Run 2. workflow

**Expected behavior**

Successfully Complete execution
(The run on Aug 11, 7:41 UTC completed without issues, as far as I can tell)

**Screenshots**

```
Requesting OIDC token...
Attempt 1 of 3...
OIDC token successfully obtained
Exchanging OIDC token for app token...
Attempt 1 of 3...
App token exchange failed: 401 Unauthorized - Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch.
Attempt 1 failed: Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch.
Retrying in 5 seconds...
Attempt 2 of 3...
App token exchange failed: 401 Unauthorized - Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch.
Retrying in 10 seconds...
Attempt 2 failed: Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch.
Attempt 3 of 3...
App token exchange failed: 401 Unauthorized - Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch.
Attempt 3 failed: Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch.
Error: Failed to setup GitHub token: Error: Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch..

If you instead wish to use this action with a custom GitHub token or custom GitHub app, provide a `github_token` in the `uses` section of the app in your workflow yml file.
Operation failed after 3 attempts
Error: Process completed with exit code 1.
```

**Workflow yml file**

reusable workflow file:

```yml
name: Claude Code

on:
workflow_call:
inputs:
secrets:
anthropic-api-key:
description: 'Anthropic API Key'
required: true
github-app-id:
description: 'GitHub App ID'
required: true
github-app-pem:
description: 'GitHub App PEM'
required: true

jobs:
claude:
if: |
(github.event_name == 'issue_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review_comment' && contains(github.event.comment.body, '@claude')) ||
(github.event_name == 'pull_request_review' && contains(github.event.review.body, '@claude')) ||
(github.event_name == 'issues' && (contains(github.event.issue.body, '@claude') || contains(github.event.issue.title, '@claude')))
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: write
pull-requests: write
issues: write
id-token: write
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: true

- name: Create github app token
uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
id: github_app_token
with:
app-id: ${{ secrets.github-app-id }}
private-key: ${{ secrets.github-app-pem }}
owner: ${{ github.repository_owner }}
repositories: shared-actions
permission-contents: read

- name: Run Claude Code
id: claude
uses: anthropics/claude-code-action@00f9595fb44d49fdc15049286d89247d29a08f2b # beta
with:
anthropic_api_key: ${{ secrets.anthropic-api-key }}
trigger_phrase: '@claude'
```

workflow uses above (I've replaced the organization name with "myrepos" since it is a private repository belonging to my company.):

```yml
name: Claude Code

on:
issue_comment:
types: [created]
pull_request_review_comment:
types: [created]
issues:
types: [opened, assigned]
pull_request_review:
types: [submitted]

jobs:
claude:
uses: myrepos/shared-actions/.github/workflows/claude.yml
secrets:
anthropic-api-key: ${{ secrets.ANTHROPIC_API_KEY }}
github-app-id: ${{ vars.SHARED_ACTION_GITHUB_APP_ID }}
github-app-pem: ${{ secrets.SHARED_ACTION_GITHUB_APP_PEM }}
```

**API Provider**

[x] Anthropic First-Party API (default)
[ ] AWS Bedrock
[ ] GCP Vertex

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.