Skip to content

fix(ci): give the @claude mention workflow a usable GitHub token #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MaryWylde wants to merge 1 commit into
base: dev
Choose a base branch
from
Open

fix(ci): give the @claude mention workflow a usable GitHub token #182

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,8 +54,10 @@ jobs:
timeout-minutes: 15
permissions:
contents: read

@github-actions github-actions Bot Aug 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

contents stays read here while pull-requests/issues go to write. That's enough for Claude to comment, but this workflow (unlike claude-code-review.yml, which never pushes) is the one that handles implementation requests — the task prompt driving @claude on PRs explicitly instructs pushing via git-push.sh origin HEAD using this same github_token.

git push over the default GITHUB_TOKEN needs contents: write; with contents: read that push will get a 403, so "straightforward"/"complex" implementation requests (as opposed to reviews/Q&A) will still fail after this fix, just later in the flow (at push time instead of at token-mint time).

Worth confirming intentional — if this workflow is meant to stay review/answer-only, fine as is; if it's meant to implement and push (per its own trigger prompt), contents needs to be write too.

Fix this →

pull-requests: read
issues: read
# write, not read: Claude replies by posting comments, so the run's own
# GITHUB_TOKEN needs to be able to write them.
pull-requests: write
issues: write
actions: read # Required for Claude to read CI results on PRs
steps:
- name: Checkout repository
Expand All @@ -69,6 +71,11 @@ jobs:
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}

# Use the run's own token, matching claude-code-review.yml. Without
# this the action falls back to minting one over OIDC, which needs
# `id-token: write` and the Claude GitHub App installed on the org.
github_token: ${{ secrets.GITHUB_TOKEN }}

# This is an optional setting that allows Claude to read CI results on PRs
additional_permissions: |
actions: read
Expand Down
Loading