fix: allow bot actors to invoke claude-code-action (v2.0.2) - #60
Merged
Conversation
claude-code-action@v1 (recent releases) rejects workflow runs when
github.actor is a Bot, unless the bot is listed in allowed_bots.
Downstream callers hit this on:
- dependabot-opened PRs (actor=dependabot[bot])
- synchronize events after a bot push (actor=claude[bot] or
github-actions[bot])
- re-runs of any originally bot-triggered run (actor preserved)
Fix by adding an explicit allowed_bots list inside each reusable
workflow's action step. Authorization is still gated upstream by the
caller's author_association / paths / event-type guards.
claude-assistant.yml: claude[bot],github-actions[bot]
— @claude mentions don't come from dependabot, so that bot is not
listed here.
claude-blocking-review.yml: claude[bot],github-actions[bot],dependabot[bot]
— callers fire on pull_request for every PR, including dependabot's.
No behavioral change for human actors; no widening of trust (no "*").
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced Apr 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
allowed_botsto both reusable workflows so downstream callers don't fail whengithub.actorresolves to a Bot (dependabot/github-actions/claude).claude-assistant.yml:claude[bot],github-actions[bot]claude-blocking-review.yml:claude[bot],github-actions[bot],dependabot[bot]Context
Recent releases of
anthropics/claude-code-action@v1reject workflow runs wheregithub.actoris a Bot unless the bot is explicitly allowed. This bitnightowlstudiollc/kebab-tax-netlifyPR #173 yesterday (changelog-review workflow) when agithub-actions[bot]push produced a synchronize event withgithub.actor = claude[bot]. Fix landed there as a one-off (PR #174); this PR applies the same fix to both reusable workflows so every caller inherits it.Why different lists per file
claude-assistant.ymlfires on@claudementions — dependabot doesn't mention @claude, so it's not listed there.claude-blocking-review.ymlfires onpull_requestevents in callers, which includes dependabot-opened PRs, sodependabot[bot]is required.Why named list, not
*The action's
docs/security.mdwarns that*on public repos lets external GitHub Apps invoke workflows with prompts they control. Explicit list only.Release plan
This is a patch-level change. After merge, please tag
v2.0.2and fast-forward thev2floating tag. Callers pinned to@v2pick it up automatically; callers pinned to@v2.0.1(e.g.,kebab-tax-netlify/.github/workflows/claude-blocking-review.yml) will need a separate bump PR.Test plan
kebab-tax-netlifyfrom@v2.0.1→@v2.0.2and confirm a dependabot PR (or synchronize push) gets a cleanclaude-reviewstatusclaude-blocking-review's own PR-run on this PR — since commita2566efshort-circuits on.github/workflows/*.ymlmodifications, it should skip rather than hit the very bug being fixed🤖 Generated with Claude Code