Bug Description

The shell-quote library used in base-action/src/parse-sdk-options.ts treats # as a shell comment character. When users include shell-style comments in their claude_args, all content after the # is swallowed, including subsequent flags on new lines.

Reproduction

# In workflow file
claude_args: |
  --model 'claude-haiku-4-5'
  # This is a comment
  --allowed-tools 'mcp__github_inline_comment__create_inline_comment'

The --allowed-tools flag is never parsed because shell-quote treats everything after # as a comment.

Evidence

import { parse as parseShellArgs } from "shell-quote";

const input = `--model 'claude-haiku'
# This is a comment
--allowed-tools 'Edit'`;

console.log(parseShellArgs(input));
// Output:
// [
//   "--model",
//   "claude-haiku", 
//   { comment: " This is a comment\n--allowed-tools 'Edit'" }
//   //         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
//   //         The --allowed-tools flag is INSIDE the comment object!
// ]

Impact

• Users cannot add documentation comments to their claude_args
• Any # character (even in comments explaining workarounds) breaks subsequent flag parsing
• This affects all flags after the comment, not just --allowed-tools

Related

This bug was discovered while investigating why the workaround for #800 wasn't working. Users adding explanatory comments about the workaround inadvertently broke their configuration.

Proposed Fix

Strip shell-style comment lines before parsing with shell-quote:

function stripShellComments(input: string): string {
  return input
    .split("\n")
    .filter((line) => !line.trim().startsWith("#"))
    .join("\n");
}

I have a fix ready with tests and can submit a PR.