anthropics/claude-code-action v1.0.273

v1.0.273 (breaking changes)

on GitHub

What's Changed

⚠️ Breaking changes

• Deny code-running commands on PRs from authors without write access by @mhegazy in #2001
• Run sessions in auto mode by default by @mhegazy in #2004
• Keep the token out of .git/config when bots are allowed by @mhegazy in #2005
• Stop a session from leaving programs for later steps to run by @mhegazy in #2003
• Keep fork branch names away from this repository's branches by @mhegazy in #2007
• Stop forced pushes and file reads through the git allow rules by @mhegazy in #2006
• Only trust text and runs from the person who passed the write check by @mhegazy in #2002

Other changes

• Call out breaking changes in release notes and titles by @mhegazy in #2013

Full Changelog: v1.0.272...v1.0.273

⚠️ Upgrade notes: new security defaults

This release tightens what a Claude session can do, especially on content from people without write access. Workflows on @v1 get these changes automatically. Most keep working as they are, but check the items below if yours runs tests on outside pull requests, uses later steps after the action, or relies on --allowedTools as a strict list.

Sessions start in auto mode

A safety review now decides tool calls that no allow rule covers. Calls that used to be denied can run if the review passes, so --allowedTools is no longer a strict list. Workflows with a prompt can also edit workspace files without an allow rule.

Opt out: set the earlier mode in claude_args: --permission-mode acceptEdits for @claude mentions, or --permission-mode default for workflows with a prompt.

Sessions keep the earlier defaults if you set allowed_non_write_users, allowed_bots, a custom ANTHROPIC_BASE_URL or path_to_claude_code_executable. The same applies if your settings input is a file path, or sets a base URL or another permission mode.

Code-running commands are denied on outside pull requests

If a pull request's author doesn't have write access, common commands such as npm test and bun install are denied, even if claude_args allows them. The run still succeeds, so check the log for a warning.

Opt out: restrict_untrusted_prs: false. This lets code from that pull request run in a job that holds your workflow's tokens.

Only trusted text and runs start a session

• Slash commands and the trusted request come only from text the person who triggered the run wrote. Claude still reads a labeled or assigned issue's body for context.
• Editing or deleting someone else's comment or review no longer starts a run.
• With prompt and track_progress, label_trigger and assignee_trigger now apply.
• workflow_run also checks the owner of the fork the run came from.
• A run started by a bot's activity on a pull request also needs that pull request's author to have write access or be an allowed bot.

Adjust:

• If your workflow filters labels itself, set label_trigger to your label, or to "" to accept any label.
• For workflow_run on outside contributions, add those users to allowed_non_write_users and pass github_token.

There's no opt-out for the rest.

A session can't leave anything behind for later steps

GITHUB_ENV, GITHUB_PATH and git config are restored when the session ends, so a session's changes to them no longer reach later steps. Token revocation also ignores ~/.curlrc, including a proxy set there.

Git hooks are also off from before the checkout on pull requests covered by restrict_untrusted_prs, so a push Claude makes on one of those won't upload Git LFS objects.

Adjust: pass values to later steps with GITHUB_OUTPUT or --json-schema. There's no opt-out.

No token in .git/config when allowed_bots is set

These workflows now use the same credential helper as allowed_non_write_users, and it only answers for your GitHub server.

Adjust: a later step that pushes through origin, or fetches from it on a private repository, needs its own credentials: GH_TOKEN, GIT_ASKPASS, a credential saved for the username x-access-token, or its own remote URL. There's no opt-out.

Stricter git commands in @claude runs

• Commits go through a wrapper that rejects flags outside a short list, including --amend, --no-verify, --author and flags that read a file.
• Pushes can't be forced and only update the branch the session was set up on: a new branch, or the open pull request's branch.
• A deny rule for git commit or git push must be in claude_args to cover these wrappers. One in a settings file doesn't.

Opt out: add your own rule in claude_args, such as Bash(git commit:*) or Bash(git push:*). This brings back what the wrappers block for that workflow.

Signed commits from prompt runs go to their own branch

With use_commit_signing, a run on an issue now commits to issue-N. A run on a pull request commits to its branch, or to pr-N if that branch isn't known to be in this repository. They used to reach the default branch or a branch named by a fork.

Opt out: set CLAUDE_BRANCH in the step's env to choose the branch.