anthropics / anthropics/claude-code-action

PR review workflow fails on forks from users without upstream write access

Ouverte
#974 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
area:permissions bug p2 provider:bedrock
Langage dominant
TypeScript
Étoiles
8.9k
Forks
2.1k
Merge moyen
3 j 9 h
PR mergées (30 j)
10

Description

**Describe the bug**
When using `claude-code-action` in a **read-only PR review workflow** in fork repos for users without write access to upstream fails when trying to use the github token from Anthropic OIDC, with:

```
Error: Action failed with error: User does not have write access on this repository
```

The workflow only performs code review tasks — reading files, posting PR comments, and leaving inline review comments. It does not need to push commits, create branches, or modify repository contents via the GitHub API.

**To Reproduce**

The action is invoked with tools restricted to read/review operations:

```yaml
- uses: anthropics/claude-code-action@v2
with:
allowed_non_write_users: "*"
claude_args: |
--allowedTools "Read,Glob,Grep,Bash,Write,mcp__github_inline_comment__create_inline_comment"
```

(The `Write` tool here is Claude Code's local filesystem write — used to write a temp file before posting via `gh pr comment --body-file` — not a GitHub API write.)

**Expected behavior**
The GHA should not fail checking for write permission for a Github workflow that will not perform writes on the repository.

**Workaround**
passing `github_token` associated with our runner works, but then actions are not associated with `claude` bot user:

```yaml
- uses: anthropics/claude-code-action@v2
with:
github_token: ${{ github.token }}
allowed_non_write_users: "*"
claude_args: |
--allowedTools "Read,Glob,Grep,Bash,Write,mcp__github_inline_comment__create_inline_comment"
```

**API Provider**

[x] Anthropic First-Party API (default)
[x] AWS Bedrock
[x] GCP Vertex

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.