fix(ci): Add github_token to fix OIDC auth error in issue workflows by yamadashy · Pull Request #1011 · yamadashy/repomix

yamadashy · 2025-12-16T14:28:32Z

When external users (without write access) create issues, the OIDC token exchange in claude-code-action fails with:

App token exchange failed: 401 Unauthorized - User does not have write access on this repository

This PR adds explicit github_token: ${{ secrets.GITHUB_TOKEN }} to bypass the OIDC token exchange and use the workflow's built-in token instead.

Affected workflows:

claude-issue-similar.yml
claude-issue-triage.yml

Note: Comments will now be posted as github-actions[bot] instead of claude[bot].

Checklist

Run npm run test (N/A - workflow changes only)
Run npm run lint (N/A - workflow changes only)

When external users (without write access) create issues, the OIDC token exchange fails with "User does not have write access" error. Adding explicit github_token bypasses this authentication flow.

gemini-code-assist · 2025-12-16T14:28:37Z

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

coderabbitai · 2025-12-16T14:28:45Z

Walkthrough

Adds github_token input to two GitHub workflow files invoking anthropics/claude-code-action, passing secrets.GITHUB_TOKEN. Also adds a new JSON Schema file defining Repomix configuration structure with properties for input, output, include, ignore, security, and token count settings.

Changes

Cohort / File(s)	Change Summary
GitHub Workflows `.github/workflows/claude-issue-similar.yml`, `.github/workflows/claude-issue-triage.yml`	Added `github_token: ${{ secrets.GITHUB_TOKEN }}` input parameter to `anthropics/claude-code-action` steps in both workflows
Schema Configuration `website/client/src/public/schemas/1.10.2/schema.json`	New JSON Schema file defining Repomix configuration structure with properties for input (maxFileSize), output (filePath, style, styling options, git settings), include/ignore patterns, security checks, and token counting

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Configuration parameter additions to workflows with no logic changes
New schema file is a declarative JSON structure with no embedded logic

Possibly related PRs

Add Claude Code GitHub Workflow #876 — Both PRs add github_token input to anthropics/claude-code-action steps in the same workflow files
feat(ci): Add Claude issue triage and similar issues workflows #977 — Both PRs modify the same claude-issue-similar.yml and claude-issue-triage.yml workflows, adding inputs to claude-code-action invocations
chore(ci): Separate schema generation into dedicated workflow #799 — Both PRs touch GitHub workflows and add files to website/client/src/public/schemas/, modifying CI automation and schema configuration

Suggested reviewers

yamadashy

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding github_token to fix OIDC auth errors in issue workflows, matching the core intent of the PR.
Description check	✅ Passed	The description covers the problem, solution, affected files, and includes the required checklist with appropriate N/A justification for workflow-only changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/claude-action-oidc-auth

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 2cf0d6a and eb25412.

📒 Files selected for processing (3)

.github/workflows/claude-issue-similar.yml (1 hunks)
.github/workflows/claude-issue-triage.yml (1 hunks)
website/client/src/public/schemas/1.10.2/schema.json (1 hunks)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

GitHub Check: Cloudflare Pages

🔇 Additional comments (3)

.github/workflows/claude-issue-similar.yml (1)

26-26: LGTM! Consistent fix applied.

The addition of github_token mirrors the fix in claude-issue-triage.yml, ensuring both workflows handle external user authentication consistently.

website/client/src/public/schemas/1.10.2/schema.json (1)

1-163: LGTM! Schema structure is valid.

The JSON Schema definition is well-structured and properly formatted. As noted in the PR description, this is an auto-generated schema file added as an ancillary commit, separate from the main OIDC authentication fix.

.github/workflows/claude-issue-triage.yml (1)

26-26: The github_token parameter is valid for custom GitHub app authentication.

The github_token input allows Claude to operate with GitHub when connecting a custom GitHub app of your own. Adding secrets.GITHUB_TOKEN provides an alternative to the official Anthropic Claude GitHub App or direct API key authentication, enabling the action to interact with GitHub when a custom app is configured.

Likely an incorrect or invalid review comment.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cloudflare-workers-and-pages · 2025-12-16T14:28:56Z

Deploying repomix with Cloudflare Pages

Latest commit:	`eb25412`
Status:	✅ Deploy successful!
Preview URL:	https://cef53ef1.repomix.pages.dev
Branch Preview URL:	https://fix-claude-action-oidc-auth.repomix.pages.dev

View logs

claude · 2025-12-16T14:29:41Z

PR Review: fix(ci): Add github_token to fix OIDC auth error in issue workflows

Summary

This PR fixes OIDC authentication failures for external users creating issues by explicitly passing github_token to the claude-code-action. The fix is clean, minimal, and addresses the documented 401 error.

✅ Strengths

Workflow Changes:

Correctly identifies and addresses the OIDC token exchange failure for non-write access users
Minimal, surgical change - adds only what's needed
Proper use of ${{ secrets.GITHUB_TOKEN }} which is available by default in all workflows
Consistent application across both affected workflows (claude-issue-similar.yml and claude-issue-triage.yml)

Documentation:

PR description clearly explains the root cause and impact
Trade-off is properly disclosed (comments will be from github-actions[bot] instead of claude[bot])

📋 Observations

Schema File Addition (Auto-generated)

The website/client/src/public/schemas/1.10.2/schema.json file was auto-generated by a GitHub Actions bot (based on commit eb25412). This appears to be expected CI behavior for schema versioning and is identical to the existing latest/schema.json and 1.10.1/schema.json schemas.

Note: This file is missing a trailing newline at the end (line 163), which differs from other schema files. This is a very minor issue and not blocking.

⚠️ Potential Considerations

Permission Trade-off: Using GITHUB_TOKEN means comments appear as github-actions[bot] rather than claude[bot]. This is acknowledged in the PR description and is an acceptable trade-off for functionality.
No Security Concerns: The change uses the built-in GITHUB_TOKEN which is scoped to the repository and workflow permissions already defined. No new permissions are being granted.

🔍 Premortem Analysis

Scenario	Risk	Mitigation
Token scope insufficient	Low	The workflow already has `issues: write` permission, which `GITHUB_TOKEN` respects
Breaking change for users	None	This is an internal workflow; no public API changes
Schema versioning issues	Low	Auto-generated schema matches existing patterns

Verdict

LGTM ✅ - This is a straightforward fix for a real authentication problem. The change is minimal, well-documented, and follows established patterns.

🤖 Generated with Claude Code

fix(ci): Add github_token to fix OIDC auth error in issue workflows

35de08a

When external users (without write access) create issues, the OIDC token exchange fails with "User does not have write access" error. Adding explicit github_token bypasses this authentication flow.

chore(schema): auto generate schema

eb25412

coderabbitai bot approved these changes Dec 16, 2025

View reviewed changes

yamadashy merged commit e89aa97 into main Dec 16, 2025
3 checks passed

yamadashy deleted the fix/claude-action-oidc-auth branch December 16, 2025 14:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(ci): Add github_token to fix OIDC auth error in issue workflows#1011

fix(ci): Add github_token to fix OIDC auth error in issue workflows#1011
yamadashy merged 2 commits intomainfrom
fix/claude-action-oidc-auth

yamadashy commented Dec 16, 2025

Uh oh!

gemini-code-assist bot commented Dec 16, 2025

Uh oh!

coderabbitai bot commented Dec 16, 2025 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages bot commented Dec 16, 2025 •

edited

Loading

Uh oh!

claude bot commented Dec 16, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

yamadashy commented Dec 16, 2025

Checklist

Uh oh!

gemini-code-assist bot commented Dec 16, 2025

Uh oh!

coderabbitai bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Possibly related PRs

Suggested reviewers

Pre-merge checks and finishing touches

Uh oh!

cloudflare-workers-and-pages bot commented Dec 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying repomix with Cloudflare Pages

Uh oh!

claude bot commented Dec 16, 2025

PR Review: fix(ci): Add github_token to fix OIDC auth error in issue workflows

Summary

✅ Strengths

📋 Observations

⚠️ Potential Considerations

🔍 Premortem Analysis

Verdict

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai bot commented Dec 16, 2025 •

edited

Loading

cloudflare-workers-and-pages bot commented Dec 16, 2025 •

edited

Loading