fix(claude-assistant): remove actions: read from GITHUB_TOKEN permissions - #12
Merged
twistedmelonman merged 2 commits intoMar 9, 2026
Merged
Conversation
…ions The actions: read permission is not included in the default read-only GITHUB_TOKEN scope even when default_workflow_permissions is 'read'. When a reusable workflow requests a permission the caller cannot provide through its inherited defaults, GitHub fails the entire workflow run with startup_failure before creating any jobs. Removing actions: read from the permissions block fixes startup_failure across all consumer repos without requiring changes to any caller. Claude can still read CI results via the claude-code-action's own authentication (additional_permissions: actions: read remains, which the action handles through its own auth, not the GITHUB_TOKEN). Fixes: consistent startup_failure on all Claude Code workflow triggers AI review: pending pre-commit hook
Add permissions block to claude.yml (the github-workflows repo's own thin caller) and update the usage comment in claude-assistant.yml to show callers should include it. Explicit permissions are required because: - GitHub Actions security scanner flags callers without explicit scopes - id-token: write is needed by claude-code-action for internal auth - Without it, the caller inherits default read-only scopes but without the explicit declaration that makes the security scanner happy Addresses security/code-scanning alert #1 (actions/missing-workflow-permissions).
twistedmelonman
deleted the
claude/fix-actions-read-startup-failure-20260309
branch
March 9, 2026 16:53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Root cause
claude-assistant.ymlrequestedactions: readin itspermissions:block. This permission is not included in GitHub's default read-only GITHUB_TOKEN scope. When a reusable workflow requests a scope the caller cannot provide, GitHub fails the entire run withstartup_failurebefore creating any jobs — producing zero check runs and no log output.This affected every consumer repo that deployed the thin caller (all 9 repos), causing all
Claude Codeworkflow runs to fail silently withstartup_failure.Changes
claude-assistant.ymlactions: readfrompermissions:— this was the root cause ofstartup_failureadditional_permissions: actions: readpassed toclaude-code-action, which handles it through the action's own authentication, not GITHUB_TOKENpermissions:blockclaude.yml(this repo's own thin caller)permissions:block — addresses security/code-scanning alert Add Claude Code GitHub Workflow #1 (actions/missing-workflow-permissions)id-token: writerequired byclaude-code-actionfor internal authenticationAfter merge
v1tag to HEAD — all consumer repos pick up the fix automatically via@v1claude.ymlthin callers to add thepermissions:block (addresses the same scanner finding across all repos)🤖 Generated with Claude Code