fix: give @claude write access to push commits on PRs by vnv-varun · Pull Request #2483 · inkeep/agents

vnv-varun · 2026-03-03T02:11:59Z

Problem

When someone tags `@claude` on a PR to make a code change, Claude runs, makes the changes locally, but cannot push them back to the branch because `claude.yml` only has `contents: read`.

Claude's own comments confirm this has been silently failing:

PR #2442 — "The changes have been committed locally but I don't have permission to push to the remote repository. You'll need to push the changes yourself."
PR #2442 — "The changes have been committed locally but couldn't be pushed due to GitHub Actions permissions."

This has been a recurring pattern across dozens of PRs — especially `@claude add a changeset` requests (PRs #1702, #1731, #1735, #1738, #1699, #1591, etc.) where Claude would run, report success, but the changeset file was never actually in the branch.

Fix

Three changes to `claude.yml`:

`contents: write` (was `read`) — allows Claude to push files to the branch
`pull-requests: write` (was `read`) — allows Claude to update PR descriptions etc.
App token for checkout + GitHub API calls — uses `INTERNAL_CI_APP_ID` so commits pushed by Claude trigger CI and other workflows (same pattern as `claude-code-review.yml`)

changeset-bot · 2026-03-03T02:12:04Z

⚠️ No Changeset found

Latest commit: b4e1677

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

vercel · 2026-03-03T02:12:05Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agents-api	Ready	Preview, Comment	Mar 3, 2026 3:51am
agents-docs	Ready	Preview, Comment	Mar 3, 2026 3:51am
agents-manage-ui	Ready	Preview, Comment	Mar 3, 2026 3:51am

pullfrog · 2026-03-03T02:12:41Z

Grants the Claude Code GitHub Action write access so it can push commits on PRs (e.g. when addressing review feedback).

.github/workflows/claude.yml — escalates contents, pull-requests, and issues permissions from read to write
.github/workflows/claude.yml — adds a new "Generate app token" step using actions/create-github-app-token@v1 with the internal CI app credentials
.github/workflows/claude.yml — passes the generated app token to both the actions/checkout step and the claude-code-action step via token / github_token

^{｜ View workflow run ｜ Using Claude Code ｜ Triggered by Pullfrog ｜ pullfrog.com ｜ 𝕏}

pullfrog

Permissions escalation is correct and well-scoped. All three write permissions (contents, pull-requests, issues) are required by claude-code-action — contents: write for pushing commits, pull-requests: write for updating PR descriptions, and issues: write for posting comments on issues (the workflow triggers on issues events too). The app token integration mirrors the existing pattern in claude-code-review.yml and is correctly wired into both the checkout step and the github_token input for claude-code-action.

^{｜ View workflow run ｜ pullfrog.com ｜ 𝕏}

claude

PR Review Summary

(2) Total Issues | Risk: High

🔴❗ Critical (1) ❗🔴

Inline Comments:

🔴 Critical: .github/workflows/claude.yml:15-19 Missing author_association check allows external users to trigger write operations

🟠⚠️ Major (1) 🟠⚠️

Inline Comments:

🟠 Major: .github/workflows/claude.yml:41-47 No --allowedTools restriction leaves Claude with unrestricted execution capabilities

💭 Consider (2) 💭

💭 1) .github/workflows/claude.yml:43 Pin claude-code-action to SHA for stability

Issue: The anthropics/claude-code-action@v1 is pinned to a mutable tag while claude-code-review.yml pins to a specific SHA (@01e756b34ef7a1447e9508f674143b07d20c2631).

Why: The SHA pinning in claude-code-review.yml includes a comment citing an AJV validation crash in newer versions (tracking issue #892). For consistency and stability, consider using the same SHA here.

Fix:

uses: anthropics/claude-code-action@01e756b34ef7a1447e9508f674143b07d20c2631  # Pinned for stability

Refs: claude-code-review.yml:724 — SHA pinning with tracking issue

💭 2) .github/workflows/claude.yml:30 Pin actions/create-github-app-token to SHA

Issue: The action is pinned to @v1 instead of a full SHA.

Why: SHA pinning provides stronger supply chain security guarantees. This is a first-party GitHub action so the risk is lower, but other workflows in this repo use the same tag-based approach, so this is consistent with existing patterns.

Fix: If you prefer SHA pinning: uses: actions/create-github-app-token@5fc8f5d139ad38797bca97a3f6d4ba2a64788cf9 # v1.12.0

🚫 REQUEST CHANGES

Summary: The permission elevation to contents: write and pull-requests: write is valid and necessary for the stated goal of allowing Claude to push commits. However, the workflow is missing critical authorization checks that exist in peer workflows. Without author_association guards, any external user who can comment on issues/PRs can trigger Claude with write access — this is a significant security gap. The fix is straightforward: add the same author_association checks used in claude-code-review.yml. Once that's addressed, also consider adding allowed_bots: "claude[bot]" to prevent re-triggering loops.

Discarded (2)

Location	Issue	Reason Discarded
`.github/workflows/claude.yml:28-33`	App token scope may be broader than necessary	Not applicable — the workflow needs current repo write access which is the default behavior. Explicit repository scoping is only needed when accessing OTHER repos (like `team-skills` in `claude-code-review.yml`).
`.github/workflows/claude.yml:21-26`	Permissions elevation is justified	Informational finding confirming the changes are correct — not an issue.

Reviewers (2)

Reviewer	Returned	Consider	Inline Comments	Discarded
`pr-review-security-iam`	3	0	2	1
`pr-review-devops`	5	2	0	3
Total	8	2	2	4

claude · 2026-03-03T02:16:29Z

      - name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          github_token: ${{ steps.app-token.outputs.token }}
          claude_args: '--model claude-opus-4-1-20250805'


🟠 MAJOR: No --allowedTools restriction leaves Claude with unrestricted execution capabilities

Issue: The claude-code-action invocation doesn't specify --allowedTools, giving Claude unrestricted ability to execute arbitrary bash commands, write any file, and push commits.

Why: Combined with the missing author_association check (see above), this creates an open attack surface. While this workflow's purpose is to let Claude make changes, defense-in-depth suggests scoping the tools to what's actually needed. The peer claude-code-review.yml explicitly restricts tools (line 735).

Fix: Consider adding an --allowedTools restriction scoped to code modification operations. At minimum, add allowed_bots to prevent re-triggering loops:

with: anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }} github_token: ${{ steps.app-token.outputs.token }} allowed_bots: "claude[bot]" claude_args: '--model claude-opus-4-1-20250805'

If you want to restrict tools more tightly, consider a pattern like:

claude_args: | --model claude-opus-4-1-20250805 --allowedTools "Read,Grep,Glob,Edit,Write,Bash(git add:*),Bash(git commit:*),Bash(git push:*),Bash(git status:*),Bash(git diff:*),Bash(pnpm:*)"

Refs:

claude-code-review.yml:735 — allowedTools pattern

closed-pr-review-auto-improver.yml:234 — another allowedTools example

issue with this one is that I've seen all types of requests in PRs. "check vercel deploy" etc to bash scripts. Either we restrict features in terms of what you can ask claude or blacklist highest risk function calls.

claude

PR Review Summary

(0) Total Issues | Risk: Low

This is a delta review following the prior review's Critical issue being addressed. The author_association guards have been correctly added to all event conditions, closing the security gap that would have allowed external users to trigger write operations.

🔄 Prior Issues Status

Prior Issue	Status	Notes
🔴 Critical: Missing `author_association` check	✅ Resolved	Commit `a9431db` adds guards to all 4 event types (OWNER/MEMBER/COLLABORATOR only)
🟠 Major: No `--allowedTools` restriction	✅ Reconsidered	Both reviewers agree this is intentional design — see analysis below

Prior Major Issue Analysis: `--allowedTools`

The prior review flagged the lack of --allowedTools as a Major concern. Upon deeper analysis, both specialist reviewers independently concluded this is intentional by design and not a security gap:

Different threat models: claude-code-review.yml runs automatically on all PRs (including from external contributors), requiring strict tool restrictions. claude.yml is a human-triggered mention handler where trusted collaborators explicitly invoke @claude to perform arbitrary tasks.
Authorization is the security boundary: With author_association guards now in place, only OWNER/MEMBER/COLLABORATOR can trigger this workflow. These users already have write access to the repository — giving them unrestricted Claude capabilities doesn't expand the attack surface.
Purpose alignment: The whole point of this workflow is to let trusted collaborators ask Claude to perform ad-hoc tasks (add changesets, make code changes, push commits). Restricting tools would defeat the purpose.

💭 Consider (1)

Inline Comments:

💭 Consider: .github/workflows/claude.yml:43 SHA pinning inconsistency with claude-code-review.yml

✅ APPROVE

Summary: The Critical security issue from the prior review has been properly addressed. The author_association checks are correctly implemented for all event types, matching the pattern used in claude-code-review.yml. The permission elevation (contents: write, pull-requests: write, issues: write) and app token usage are appropriate for the workflow's purpose. Ship it! 🚀

Discarded (1)

Location	Issue	Reason Discarded
`.github/workflows/claude.yml:30`	SHA pinning for `actions/create-github-app-token@v1`	Matches existing patterns across other workflows (`release.yml`, `claude-code-review.yml`, `closed-pr-review-auto-improver.yml`). Consistency with codebase conventions takes precedence over theoretical supply chain hardening.

Reviewers (2)

Reviewer	Returned	Consider	Inline Comments	Discarded
`pr-review-devops`	4	1	1	1
`pr-review-security-iam`	0	0	0	0
Total	4	1	1	1

Note: IAM reviewer confirmed the authorization fix is correct and found no new issues — the empty return indicates the delta successfully addresses all prior security concerns.

claude · 2026-03-03T02:34:36Z


      - name: Run Claude Code
        id: claude
        uses: anthropics/claude-code-action@v1


💭 Consider: SHA pinning inconsistency with peer workflow

Issue: This workflow pins anthropics/claude-code-action to the mutable @v1 tag, while claude-code-review.yml pins the same action to a specific SHA (@01e756b34ef7a1447e9508f674143b07d20c2631) with a comment citing an AJV validation crash in newer versions (tracking issue #892).

Why: For consistency and to avoid the known AJV validation issue, consider using the same SHA pin here.

Fix:

Suggested change

uses: anthropics/claude-code-action@v1

uses: anthropics/claude-code-action@01e756b34ef7a1447e9508f674143b07d20c2631 # Pinned for stability (tracking: #892)

Refs:

claude-code-review.yml:724 — SHA pinning with tracking issue

vnv-varun · 2026-03-03T02:49:40Z

@claude can you add a test comment at the start of the yaml file? We'll undo it in a subsequent request.

…@claude

…@claude

claude

PR Review Summary

(0) Total Issues | Risk: Low

This PR correctly elevates permissions for the claude.yml workflow to enable Claude to push commits when collaborators invoke @claude. The security controls are complete and appropriately implemented.

✅ What's Good

Authorization guards complete: All 4 event types (issue_comment, pull_request_review_comment, pull_request_review, issues) require OWNER/MEMBER/COLLABORATOR association
Permission scope appropriate: contents: write for pushing commits, pull-requests: write for updating PRs, issues: write for posting comments — all required by claude-code-action
App token pattern correct: Uses INTERNAL_CI_APP_ID matching established patterns in release.yml, claude-code-review.yml, and closed-pr-review-auto-improver.yml
Different security model than auto-review is intentional: Trusted collaborators already have write access; unrestricted Claude tools doesn't expand the attack surface

🕐 Pending Recommendations (1)

💭 .github/workflows/claude.yml:43 SHA pinning inconsistency with claude-code-review.yml

✅ APPROVE

Summary: All prior Critical and Major issues have been addressed. The author_association guards are correctly implemented, the permission elevation is justified for the use case, and the app token usage follows established repository patterns. The only open item is a minor "Consider" about SHA pinning for consistency with claude-code-review.yml (already raised in prior review). Ship it! 🚀

Discarded (2)

Location	Issue	Reason Discarded
`.github/workflows/claude.yml:30`	SHA pinning for `actions/create-github-app-token@v1`	Consistent with codebase conventions (`release.yml`, `claude-code-review.yml`, `closed-pr-review-auto-improver.yml` all use `@v1`).
`.github/workflows/claude.yml`	No `--allowedTools` restriction	Addressed in prior review — intentional by design for human-triggered ad-hoc automation.

Reviewers (2)

Reviewer	Returned	Pending Recs	Discarded
`pr-review-devops`	4	1	2
`pr-review-security-iam`	0	0	0
Total	4	1	2

Note: IAM reviewer confirmed all security controls are appropriate — empty return indicates no security gaps.

vercel Bot deployed to Preview – agents-api March 3, 2026 02:13 View deployment

pullfrog Bot approved these changes Mar 3, 2026

View reviewed changes

vercel Bot deployed to Preview – agents-docs March 3, 2026 02:14 View deployment

vercel Bot deployed to Preview – agents-manage-ui March 3, 2026 02:15 View deployment

claude Bot reviewed Mar 3, 2026

View reviewed changes

github-actions Bot deleted a comment from claude Bot Mar 3, 2026

claude Bot reviewed Mar 3, 2026

View reviewed changes

github-actions Bot deleted a comment from claude Bot Mar 3, 2026

vercel Bot deployed to Preview – agents-api March 3, 2026 02:57 View deployment

vercel Bot deployed to Preview – agents-docs March 3, 2026 02:58 View deployment

vercel Bot deployed to Preview – agents-manage-ui March 3, 2026 02:58 View deployment

vnv-varun mentioned this pull request Mar 3, 2026

ci: upgrade Claude model to Opus for both workflows #2485

Merged

vnv-varun added 2 commits March 2, 2026 22:49

fix: give @claude write access to push commits on PRs

74e581e

fix: add author_association guard to prevent external users triggering …

b4e1677

…@claude

vnv-varun force-pushed the fix/claude-write-permissions branch from 51c9657 to b4e1677 Compare March 3, 2026 03:49

vercel Bot deployed to Preview – agents-api March 3, 2026 03:51 View deployment

vercel Bot deployed to Preview – agents-docs March 3, 2026 03:51 View deployment

vercel Bot deployed to Preview – agents-manage-ui March 3, 2026 03:51 View deployment

claude Bot reviewed Mar 3, 2026

View reviewed changes

github-actions Bot deleted a comment from claude Bot Mar 3, 2026

robert-inkeep self-requested a review March 3, 2026 04:01

robert-inkeep approved these changes Mar 3, 2026

View reviewed changes

robert-inkeep merged commit a7635fa into main Mar 3, 2026
12 of 13 checks passed

robert-inkeep deleted the fix/claude-write-permissions branch March 3, 2026 04:03

claude Bot mentioned this pull request Mar 3, 2026

feat(agents-api) pass cron timezone to agent in scheduled trigger execution #2487

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: give @claude write access to push commits on PRs#2483

fix: give @claude write access to push commits on PRs#2483
robert-inkeep merged 2 commits intomainfrom
fix/claude-write-permissions

vnv-varun commented Mar 3, 2026

Uh oh!

changeset-bot Bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Mar 3, 2026 •

edited

Loading

Uh oh!

pullfrog Bot commented Mar 3, 2026

Uh oh!

pullfrog Bot left a comment •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot Mar 3, 2026

Uh oh!

vnv-varun Mar 3, 2026 •

edited

Loading

Uh oh!

claude Bot left a comment

Uh oh!

claude Bot Mar 3, 2026

Uh oh!

vnv-varun commented Mar 3, 2026

Uh oh!

claude Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	uses: anthropics/claude-code-action@v1
	uses: anthropics/claude-code-action@01e756b34ef7a1447e9508f674143b07d20c2631 # Pinned for stability (tracking: #892)

Conversation

vnv-varun commented Mar 3, 2026

Problem

Fix

Uh oh!

changeset-bot Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

vercel Bot commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pullfrog Bot commented Mar 3, 2026

Uh oh!

pullfrog Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

🔴❗ Critical (1) ❗🔴

🟠⚠️ Major (1) 🟠⚠️

💭 Consider (2) 💭

🚫 REQUEST CHANGES

Uh oh!

claude Bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

vnv-varun Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

🔄 Prior Issues Status

Prior Major Issue Analysis: --allowedTools

💭 Consider (1)

✅ APPROVE

Uh oh!

claude Bot Mar 3, 2026

Choose a reason for hiding this comment

Uh oh!

vnv-varun commented Mar 3, 2026

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

PR Review Summary

✅ What's Good

🕐 Pending Recommendations (1)

✅ APPROVE

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented Mar 3, 2026 •

edited

Loading

vercel Bot commented Mar 3, 2026 •

edited

Loading

pullfrog Bot left a comment •

edited

Loading

vnv-varun Mar 3, 2026 •

edited

Loading

Prior Major Issue Analysis: `--allowedTools`