From a74fe8817f7a25bf2348a342adf5f60b8ac66dff Mon Sep 17 00:00:00 2001 From: MaryWylde Date: Wed, 19 Aug 2026 12:14:34 +0200 Subject: [PATCH] fix(ci): give the @claude mention workflow a usable GitHub token The job supplied neither `github_token` nor `id-token: write`, so claude-code-action fell back to minting a token over OIDC and failed all three attempts with "Unable to get ACTIONS_ID_TOKEN_REQUEST_URL". Use the run's own GITHUB_TOKEN, matching claude-code-review.yml in this repo, which avoids depending on the Claude GitHub App being installed on the org. Comment permissions go read -> write so Claude can post replies. Co-Authored-By: Claude Opus 4.7 --- .github/workflows/claude.yml | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index 4f3c8e1..e903fb8 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -54,8 +54,10 @@ jobs: timeout-minutes: 15 permissions: contents: read - pull-requests: read - issues: read + # write, not read: Claude replies by posting comments, so the run's own + # GITHUB_TOKEN needs to be able to write them. + pull-requests: write + issues: write actions: read # Required for Claude to read CI results on PRs steps: - name: Checkout repository @@ -69,6 +71,11 @@ jobs: with: claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} + # Use the run's own token, matching claude-code-review.yml. Without + # this the action falls back to minting one over OIDC, which needs + # `id-token: write` and the Claude GitHub App installed on the org. + github_token: ${{ secrets.GITHUB_TOKEN }} + # This is an optional setting that allows Claude to read CI results on PRs additional_permissions: | actions: read