Repository navigation
ci(github-action): update action anthropics/claude-code-action ( v1.0.271 ➔ v1.0.275 ) - #436
Conversation
![clanker-claude[bot]](https://avatars.githubusercontent.com/in/2839309?s=60&v=4){kind=small}
There was a problem hiding this comment.
anthropics/claude-code-action: v1.0.271 → v1.0.272
Verdict: Safe to merge
This release is documentation-and-test-only. The single upstream commit — anthropics/claude-code-action PR #1963, "Pass structured output to shell steps through env" (https://togithub.com/anthropics/claude-code-action/pull/1963) — touches only docs/usage.md, one example workflow, the test workflow of the upstream project, and adds a regression test. Verified against the upstream compare for v1.0.271...v1.0.272: no changes to action.yml, base-action/action.yml, package.json (so the bundled @anthropic-ai/claude-agent-sdk dependency is unchanged), or anything under src/. The runtime behavior and input schema of the action are identical to v1.0.271, and the pinned SHA matches the v1.0.272 tag.
Breaking changes:
- None.
Deprecations:
- None.
New features worth adopting:
- None required. The only substance upstream is guidance for consumers of the
structured_outputoutput: pass the value into a shell step viaenv:instead of interpolating it directly into arun:script, since GitHub substitutes a template expression into the script before the shell reads it, and a quote in the Claude answer can break or inject into the script. - Not applicable to this repository:
structured_outputis never used here — there is no--json-schemainclaude_argsand nostructured_output/fromJSONreference anywhere in the repository. The new upstream regression test only scans workflows, examples, and docs maintained by the upstream project, so it imposes nothing on consumers. - Worth remembering if structured output is ever adopted: upstream notes that Linux caps a single environment variable at 128 KiB, so an oversized structured output passed via
env:fails the step with "Argument list too long".
Impact on this repository:
- The only consumer is
.github/workflows/renovate-review.yaml. Every input it passes (settings,github_token,anthropic_api_key,show_full_output,allowed_bots,claude_args,prompt) is unchanged in this release, and the prompt is plain prose with no structured output — the change is inert for this workflow. - The action installs the Claude Code CLI at runtime rather than pinning it inside the action, so this bump carries no CLI version change. The CLI pin managed by mise in
home/dot_config/mise/private_config.tomlis a separate Renovate-managed stream and needs no alignment here.
Sources consulted:
acf7a02 to
7283c0d
Compare
robot-rosey
Bot
changed the title
There was a problem hiding this comment.
anthropics/claude-code-action: v1.0.271 → v1.0.273
Verdict: Safe to merge
v1.0.272 was already covered by the earlier review on this PR; nothing about it changed. v1.0.273 is the substantive release — a security-hardening release that adds new defaults for permission mode, command execution, and credential handling.
This repository has exactly one consumer of the action: .github/workflows/renovate-review.yaml. It runs on pull_request events from the dependency bot, passes a static prompt (so the action runs in agent mode), sets allowed_bots, and points the CLI at a custom Anthropic-compatible base URL on an internal gateway. The bundled @anthropic-ai/claude-agent-sdk is unchanged (^0.3.322 at both tags), so there is no inner CLI/SDK version change riding along.
Every new default was traced to the v1.0.273 source. All of them are either inert for this workflow or apply without removing anything the workflow needs.
Breaking changes:
-
None requiring changes in this repository. The upstream defaults that are live here are covered below so the reasoning is on the record.
-
Sessions start in auto mode by default — not in effect here. Upstream's
defaultsToAutoMode()(src/modes/permission-mode.ts) returnsfalsewhenALLOWED_BOTSorANTHROPIC_BASE_URLis present, anddocs/usage.mddocuments the same two exemptions. This workflow sets both (allowed_bots, plus a custom base URL for the internal gateway), so the session keeps the earlier permission defaults and--allowedToolsremains a strict list. No change needed in.github/workflows/renovate-review.yaml. -
Code-running commands are denied on pull requests from authors without write access — live, but harmless. The new
restrict_untrusted_prsinput defaults totrue, and upstream deliberately treats a bot author as untrusted even when that bot is listed inallowed_bots, so the deny list applies to every run of this workflow. The list covers package managers, test runners, interpreters, shells,git configandgit -c; it does not intersect this workflow's allow rules (gh …,git log,curl), so nothing the review needs is revoked. Expect one advisory log line reporting that 8Bashrules inclaude_argsfall outside the deny list — the run still succeeds. Settingrestrict_untrusted_prs: falsewould disable it, but that is not recommended. -
The token is kept out of
.git/configwhenallowed_botsis set — live, but harmless. Becauseallowed_botsis set, the action now strips the checkout credential and installs a credential helper that reads the token from the environment instead of embedding it in the remote URL. The Claude Code Action is the last step in the job, so no later step needs git credentials; inside the session,gh pr reviewauthenticates through the token already in the environment, andgit logis a local read. -
A session can no longer leave anything behind for later steps — live, but harmless.
GITHUB_ENV,GITHUB_PATHand git config are restored when the session ends. The Claude Code Action is the final step in the job, so there is nothing downstream to be affected. -
Only trusted text and runs start a session — not applicable. The workflow triggers on
pull_requestevents with a staticprompt; it never listens for comments, reviews, issue labels or assignments, so the new comment/label/assignee gating does not apply here. The one path that does touch this workflow — the PR body being eligible as a request — still works: the PR author and the event actor are the same bot account (verified against the workflow run payload), and upstream normalizes the[bot]suffix on both sides before comparing them. -
Stricter
git commit/git pushwrappers, and signed commits landing on their own branch — not applicable.use_commit_signingis not set, and this workflow never asks Claude to commit or push anything. -
label_trigger/assignee_triggernow apply topromptworkflows — not applicable.track_progressis not set, and the workflow listens only topull_requestevents.
-
Deprecations:
- None.
New features worth adopting:
- Pin
--permission-mode defaultinclaude_args— the--allowedToolslist in this workflow is a genuine control (it is what keeps the review bot to read-only inspection plus a fixed set ofgh/curlcalls), and it stays strict only indirectly, via theallowed_botsand base-URL exemptions above. Adding--permission-mode defaulttoclaude_argsin.github/workflows/renovate-review.yamlmakes that guarantee explicit and independent of upstream's opt-out heuristics — which also matters here, since auto mode requires a supported model and this workflow runs a third-party model through a gateway. Behavior is unchanged either way; this is hardening, not a fix. - No other new inputs are needed.
restrict_untrusted_prsalready defaults to the safe value, so there is nothing to pin.
Impact on this repository:
- The only consumer is
.github/workflows/renovate-review.yaml. Every input it passes (settings,github_token,anthropic_api_key,show_full_output,allowed_bots,claude_args,prompt) is unchanged in this release, and the prompt is plain prose with no structured output. - The action installs the Claude Code CLI at runtime rather than pinning it inside the action, so this bump carries no CLI version change. The CLI pin managed by mise is a separate Renovate-managed stream and needs no alignment here.
Sources consulted:
- https://togithub.com/anthropics/claude-code-action/releases/tag/v1.0.273
- https://togithub.com/anthropics/claude-code-action/compare/v1.0.271...v1.0.273
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/src/modes/permission-mode.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/src/github/validation/untrusted-pr.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/src/github/validation/permissions.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/src/github/operations/session-guard.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/src/github/operations/git-config.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/src/modes/agent/index.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/docs/security.md
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.273/docs/usage.md
- Upstream PRs: 2001, 2002, 2003, 2004, 2005, 2006, 2007
7283c0d to
dee0293
Compare
robot-rosey
Bot
changed the title
There was a problem hiding this comment.
anthropics/claude-code-action: v1.0.271 → v1.0.274
Verdict: Changes required before merge
v1.0.272 and v1.0.273 were already reviewed on this PR and have not changed since. This review covers v1.0.274 only.
Breaking changes:
-
The Claude Code CLI the action installs moves from 2.1.322 to 2.1.323. This is the first release in this PR that changes action code: the CLI version is pinned in
base-action/action.ymland insrc/entrypoints/run.ts, and the action installs that version at runtime. The bundled @anthropic-ai/claude-agent-sdk also moves from 0.3.322 to 0.3.323; its own notes are "parity with Claude Code v2.1.323" plus SDK-only additions, and this repository does not use the SDK directly. -
Claude Code now assumes a 1M-token context window for a model ID that it does not recognize, instead of 200K — introduced in CLI v2.1.323. The same release notes spell out the consequence: on a model from another vendor with a smaller window, the session "can fail every turn until
/clear".This affects
.github/workflows/renovate-review.yaml. The review job runs the CLI against a third-party model ID that Claude Code does not recognize, behind a custom Anthropic-compatible base URL on an internal gateway, so the CLI sizes the session against its assumed window rather than the real window of that model. With the assumption now at 1M, the CLI no longer compacts before the actual limit of the gateway; the oversized request is rejected and the session then fails on every following turn until it is cleared, taking the review with it. The prompt of this job pushes the session in that direction — it tells the reviewer to read changelogs and consult documentation sites, and some of those pages are very large.Fix — tell the CLI which window to assume: either the real limit of the model, with
CLAUDE_CODE_MAX_CONTEXT_TOKENS, or the previous 200K, withCLAUDE_CODE_DISABLE_1M_CONTEXT=1. The recommendation from upstream in the 2.1.323 notes is the latter. Either key goes in theenv:block of the "Claude Code Action" step in.github/workflows/renovate-review.yaml, next toANTHROPIC_BASE_URL:env:
ANTHROPIC_BASE_URL: "..."
CLAUDE_CODE_DISABLE_1M_CONTEXT: "1"CLAUDE_CODE_MAX_CONTEXT_TOKENSapplies on its own to an unrecognized ID that does not start withclaude-and carries no 1M suffix, which is the case here. The step-levelenv:block is the environment that starts the CLI; the same key can alternatively go in theenvmap of thesettingsinput of the action, which this workflow already uses for its model variables. (There is alsoCLAUDE_CODE_DISABLE_UNKNOWN_MODEL_WINDOW_ENFORCEMENT=1, which stops Claude Code from compacting against an assumed window at all — but upstream notes that it does not recover when a gateway rewrites the error, so it is not the first choice here.)One caveat: the published model-configuration and environment-variable docs still describe a 200K assumption for unrecognized model IDs. The newest CLI version they reference is 2.1.321, so they predate 2.1.322 and 2.1.323 and the release notes are the newer source. Confirming the assumed window in the first run after this bump would close the loop.
-
The same bump reaches the locally managed CLI.
home/dot_config/mise/private_config.tomlpinsclaude = "2.1.322", andhome/private_dot_claude/private_settings.json.tmplsets the default session model to the same third-party model ID. That pin is a separate Renovate-managed stream, but once it moves to 2.1.323 the same issue applies to interactive sessions; adding the same variable to theenvblock of that template now would cover both.
Deprecations:
- None in
v1.0.274.
New features worth adopting:
- Letting Claude read CI results on outside pull requests — upstream PR #2009 (https://togithub.com/anthropics/claude-code-action/pull/2009) is the headline change of
v1.0.274, but it touches only the workflows and documentation of the upstream project. No action code changed, so consumers get no new behavior from it. - What it does document is worth knowing for this workflow: the
github_ciMCP server (get_ci_status,get_workflow_run_details,download_job_log) is only started in agent mode whenmcp__github_ci…appears in--allowedTools, and upstream recommends denying the two tools that read log and job text on pull requests from authors without write access, because a pull request controls that text. - Not needed here. The workflow already grants
actions: read, but that alone does not start the CI server in agent mode — theclaude_argsallow list has nomcp__github_ci…entry — so that permission currently has no effect for this job. If CI-result reporting is wanted later, the shape recommended by upstream ismcp__github_ci__get_ci_statusin--allowedTools, withmcp__github_ci__download_job_log,mcp__github_ci__get_workflow_run_detailsin--disallowedTools.
Sources consulted:
- https://togithub.com/anthropics/claude-code-action/releases/tag/v1.0.274
- https://togithub.com/anthropics/claude-code-action/compare/v1.0.273...v1.0.274
- https://togithub.com/anthropics/claude-code-action/pull/2009
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.274/base-action/action.yml
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.274/src/entrypoints/run.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.274/src/mcp/install-mcp-server.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.274/src/modes/permission-mode.ts
- https://togithub.com/anthropics/claude-code/blob/v2.1.323/CHANGELOG.md
- https://togithub.com/anthropics/claude-agent-sdk-typescript/blob/main/CHANGELOG.md
- https://code.claude.com/docs/en/model-config
- https://code.claude.com/docs/en/env-vars
- https://code.claude.com/docs/en/settings-reference
dee0293 to
e689087
Compare
robot-rosey
Bot
changed the title
There was a problem hiding this comment.
anthropics/claude-code-action: v1.0.271 → v1.0.275
Verdict: Changes required before merge
v1.0.272, v1.0.273 and v1.0.274 were covered by the earlier reviews on this PR and have not changed since. This review covers v1.0.275 (upstream PR #2018) and confirms the status of the one item the v1.0.274 review left open. v1.0.275 itself introduces nothing new to fix in this repository; the outstanding item is the one already raised.
Breaking changes:
-
None introduced by
v1.0.275. The release is a single upstream commit that makes thegit add/git rm/git commit/git pushwrapper scripts take their settings from files the action writes rather than from the session's environment, and that moves the session's git settings out ofGIT_CONFIG_*environment variables into the repository's own config (plussafe.bareRepository=explicitin the global config for the session).- Not applicable to
.github/workflows/renovate-review.yaml. That workflow'sclaude_argsallow list contains nogit add,git commit,git pushorgit rm; agent mode — which this workflow uses, because it passes a staticprompt— never adds the git wrappers to the allow list (only tag mode does, atsrc/modes/tag/index.ts); and a staticpromptbypasses the action's generated prompt and its commit instructions entirely. The one git command the session can run,git log, is not wrapped. The change is inert here.
- Not applicable to
-
Status of the item left open by the
v1.0.274review — still outstanding.v1.0.275does not change the Claude Code CLI the action installs:base-action/action.ymlpins2.1.323at bothv1.0.274andv1.0.275, and the compare between the two tags touches no version file. So the CLI behaviour thev1.0.274review flagged — an unrecognised model ID being assumed to have a 1M-token window instead of 200K — is still live in this PR, and this workflow is exactly the case it applies to: the job runs a third-party model ID that Claude Code does not recognise, behind a custom Anthropic-compatible base URL on an internal gateway. The branch still carries noCLAUDE_CODE_DISABLE_1M_CONTEXTorCLAUDE_CODE_MAX_CONTEXT_TOKENSsetting, so the session sizes itself against a window the gateway's model does not have.-
Fix: pin the window the CLI assumes, in the
env:block of the "Claude Code Action" step in.github/workflows/renovate-review.yaml, next to the existing base-URL setting:env: ANTHROPIC_BASE_URL: "<unchanged>" CLAUDE_CODE_DISABLE_1M_CONTEXT: "1"
CLAUDE_CODE_DISABLE_1M_CONTEXT=1keeps the previous 200K assumption and is the option upstream's own 2.1.323 notes recommend for other vendors' models.CLAUDE_CODE_MAX_CONTEXT_TOKENSis the alternative if the real limit of the model is known. The same key can alternatively go in theenvmap of the action'ssettingsinput, which this workflow already uses for its model variables — that is the more consistent placement for this repository, since the CLI picks these up the same way it already picks upCLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC.
-
Deprecations:
- None.
New features worth adopting:
- None in
v1.0.275. The upstream change is hardening only: no new action inputs, no new outputs, and no behaviour a consumer can opt into.
Impact on this repository:
- The action's only consumer here is
.github/workflows/renovate-review.yaml. The other two workflows in.github/workflows/do not use it and both run on GitHub-hosted runners. - Every input the workflow passes (
settings,github_token,anthropic_api_key,show_full_output,allowed_bots,claude_args,prompt) is unchanged inv1.0.275. - The action installs the Claude Code CLI at runtime and pins it in
base-action/action.yml; that pin is unchanged at2.1.323inv1.0.275, so this bump carries no CLI version change of its own. The CLI version managed by mise inhome/dot_config/mise/private_config.tomlis a separate Renovate-managed stream and needs no alignment here. - One new, non-blocking side effect of
v1.0.275worth knowing: the action now writessafe.bareRepository=explicitto the runner's global git config for the duration of the session, and upstream's owndocs/security.mdwarns that if the run is cancelled before the restore, that setting stays in the global config of a self-hosted runner that keeps its home directory. This workflow runs on a persistent self-hosted runner with a 30-minute job timeout, and the review step is the one that would be cancelled, so a timed-out run can leave the setting behind on the runner. It is a hardening setting — it only stops git from auto-discovering a bare repository in a plain folder — and none of this repository's workflows work in a bare repository, so there is no practical impact. Worth knowing only so it is not mistaken for a change to the repository itself.
Sources consulted:
- https://togithub.com/anthropics/claude-code-action/releases/tag/v1.0.275
- https://togithub.com/anthropics/claude-code-action/compare/v1.0.274...v1.0.275
- https://togithub.com/anthropics/claude-code-action/pull/2018
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/base-action/action.yml
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/src/github/operations/session-guard.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/src/entrypoints/run.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/src/modes/agent/index.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/src/modes/agent/parse-tools.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/src/modes/tag/index.ts
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/scripts/git-env.sh
- https://togithub.com/anthropics/claude-code-action/blob/v1.0.275/docs/security.md
- https://togithub.com/anthropics/claude-code/releases/tag/v2.1.323
- https://code.claude.com/docs/en/env-vars
….271 ➔ v1.0.275 )
e689087 to
26494be
Compare
Dismissed at owner request: superseded by owner approval on the current head.
This PR contains the following updates:
v1.0.271→v1.0.275Release Notes
anthropics/claude-code-action
v1.0.275Compare Source
What's Changed
Other changes
Full Changelog: anthropics/claude-code-action@v1.0.274...v1.0.275
v1.0.274Compare Source
What's Changed
Other changes
Full Changelog: anthropics/claude-code-action@v1.0.273...v1.0.274
v1.0.273: (breaking changes)Compare Source
What's Changed
Other changes
Full Changelog: anthropics/claude-code-action@v1.0.272...v1.0.273
This release tightens what a Claude session can do, especially on content from people without write access. Workflows on
@v1get these changes automatically. Most keep working as they are, but check the items below if yours runs tests on outside pull requests, uses later steps after the action, or relies on--allowedToolsas a strict list.Sessions start in auto mode
A safety review now decides tool calls that no allow rule covers. Calls that used to be denied can run if the review passes, so
--allowedToolsis no longer a strict list. Workflows with apromptcan also edit workspace files without an allow rule.Opt out: set the earlier mode in
claude_args:--permission-mode acceptEditsfor@claudementions, or--permission-mode defaultfor workflows with aprompt.Sessions keep the earlier defaults if you set
allowed_non_write_users,allowed_bots, a customANTHROPIC_BASE_URLorpath_to_claude_code_executable. The same applies if yoursettingsinput is a file path, or sets a base URL or another permission mode.Code-running commands are denied on outside pull requests
If a pull request's author doesn't have write access, common commands such as
npm testandbun installare denied, even ifclaude_argsallows them. The run still succeeds, so check the log for a warning.Opt out:
restrict_untrusted_prs: false. This lets code from that pull request run in a job that holds your workflow's tokens.Only trusted text and runs start a session
promptandtrack_progress,label_triggerandassignee_triggernow apply.workflow_runalso checks the owner of the fork the run came from.Adjust:
label_triggerto your label, or to""to accept any label.workflow_runon outside contributions, add those users toallowed_non_write_usersand passgithub_token.There's no opt-out for the rest.
A session can't leave anything behind for later steps
GITHUB_ENV,GITHUB_PATHand git config are restored when the session ends, so a session's changes to them no longer reach later steps. Token revocation also ignores~/.curlrc, including a proxy set there.Git hooks are also off from before the checkout on pull requests covered by
restrict_untrusted_prs, so a push Claude makes on one of those won't upload Git LFS objects.Adjust: pass values to later steps with
GITHUB_OUTPUTor--json-schema. There's no opt-out.No token in
.git/configwhenallowed_botsis setThese workflows now use the same credential helper as
allowed_non_write_users, and it only answers for your GitHub server.Adjust: a later step that pushes through
origin, or fetches from it on a private repository, needs its own credentials:GH_TOKEN,GIT_ASKPASS, a credential saved for the usernamex-access-token, or its own remote URL. There's no opt-out.Stricter git commands in
@clauderuns--amend,--no-verify,--authorand flags that read a file.git commitorgit pushmust be inclaude_argsto cover these wrappers. One in a settings file doesn't.Opt out: add your own rule in
claude_args, such asBash(git commit:*)orBash(git push:*). This brings back what the wrappers block for that workflow.Signed commits from
promptruns go to their own branchWith
use_commit_signing, a run on an issue now commits toissue-N. A run on a pull request commits to its branch, or topr-Nif that branch isn't known to be in this repository. They used to reach the default branch or a branch named by a fork.Opt out: set
CLAUDE_BRANCHin the step'senvto choose the branch.v1.0.272Compare Source
What's Changed
Full Changelog: anthropics/claude-code-action@v1.0.271...v1.0.272
Configuration
📅 Schedule: (in timezone America/Chicago)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.