From 4160c105359dafb09ae0dd1db98c7a04a9afb774 Mon Sep 17 00:00:00 2001 From: Douglas Ezra Morrison Date: Fri, 31 Jul 2026 19:33:41 -0700 Subject: [PATCH] Revert claude-review to the pull_request trigger Anthropic's token-exchange endpoint rejects OIDC tokens minted for pull_request_target events, so every review run since #83 failed with "401 Unauthorized - Invalid OIDC token" before Claude started. Tracked upstream as anthropics/claude-code-action#713, still open. Also drops the untrusted head-ref checkout #83 added, which the action's own security doc warns against for pull_request_target, and restores pull-requests: read. Closes #88 Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01HMmB6db4xpbuqcqaQKArZb --- .github/workflows/claude-code-review.yml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml index facef7d..5e53f65 100644 --- a/.github/workflows/claude-code-review.yml +++ b/.github/workflows/claude-code-review.yml @@ -1,7 +1,12 @@ name: Claude Code Review +# Do not switch this to `pull_request_target`. +# Anthropic's token-exchange endpoint rejects OIDC tokens minted for that +# event, so the job fails with "401 Unauthorized - Invalid OIDC token" +# before Claude ever runs. See +# https://github.com/anthropics/claude-code-action/issues/713 on: - pull_request_target: + pull_request: types: [opened, synchronize, ready_for_review, reopened] # Optional: Only run on specific file changes # paths: @@ -21,7 +26,7 @@ jobs: runs-on: ubuntu-latest permissions: contents: read - pull-requests: write + pull-requests: read issues: read id-token: write @@ -30,7 +35,6 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 1 - ref: ${{ github.event.pull_request.head.sha }} - name: Run Claude Code Review id: claude-review