feat: send additional_permissions in token exchange request by ashwin-ant · Pull Request #859 · anthropics/claude-code-action

ashwin-ant · 2026-01-25T01:10:01Z

Summary

Parse the additional_permissions input and send it as a JSON body in the OIDC token exchange request. The API endpoint already supports this — this change wires up the client side.

Changes

`src/github/token.ts`

Added parseAdditionalPermissions() — reads ADDITIONAL_PERMISSIONS env var, parses the key: value per-line format, and merges with the standard defaults (contents: write, pull_requests: write, issues: write)
Updated exchangeForAppToken() to accept optional permissions param and send JSON body with Content-Type: application/json when provided
Updated setupGitHubToken() to call parseAdditionalPermissions() and pass the result (only in the OIDC path, not when OVERRIDE_GITHUB_TOKEN is set)

`test/parse-permissions.test.ts` (new)

9 unit tests covering: undefined/empty returns, single/multiple permission parsing, default merging, override behavior, whitespace handling, empty lines, and invalid lines.

`docs/configuration.md`

Updated the "Additional Permissions" section to document that any GitHub App permission can be requested (removed the "only actions: read is supported" limitation).

API Contract

POST /api/github/github-app-token-exchange

Header: Authorization: Bearer <oidc_token>
Body (optional): { "permissions": { "actions": "read", "workflows": "write", ... } }
If no body/permissions: defaults to {contents: write, pull_requests: write, issues: write}

Parse the ADDITIONAL_PERMISSIONS env var and send it as a JSON body in the OIDC token exchange request. Permissions are merged on top of the standard defaults (contents: write, pull_requests: write, issues: write).

claude · 2026-01-25T01:12:08Z

src/github/token.ts

-async function exchangeForAppToken(oidcToken: string): Promise<string> {
+const DEFAULT_PERMISSIONS: Record<string, string> = {
+  contents: "write",
+  pull_requests: "write",


Critical Bug: GitHub's API uses pull-requests (with hyphen), not pull_requests (with underscore). This inconsistency is visible throughout the codebase:

action.yml line 11 uses pull-requests: write

All documentation examples use pull-requests: write

All workflow examples use pull-requests: write

When the API receives {"permissions": {"pull_requests": "write"}}, it may not recognize this permission.

Suggested change

pull_requests: "write",

"pull-requests": "write",

The corresponding test expectations in test/parse-permissions.test.ts should also be updated to use "pull-requests" with a hyphen.

claude · 2026-01-25T01:12:15Z

src/github/token.ts

+  for (const line of raw.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    const colonIndex = trimmed.indexOf(":");
+    if (colonIndex === -1) continue;
+    const key = trimmed.slice(0, colonIndex).trim();
+    const value = trimmed.slice(colonIndex + 1).trim();
+    if (key && value) {
+      additional[key] = value;
+    }
+  }


Data Loss Risk: The parser silently skips invalid lines without any warning. If a user makes a typo like actions read (missing colon) or actions: (missing value), the action will proceed without the requested permission, potentially causing hard-to-debug runtime failures.

Consider adding logging for skipped lines:

for (const line of raw.split("\n")) { const trimmed = line.trim(); if (!trimmed) continue; const colonIndex = trimmed.indexOf(":"); if (colonIndex === -1) { console.log(`Warning: Skipping malformed permission line (missing colon): "${trimmed}"`); continue; } const key = trimmed.slice(0, colonIndex).trim(); const value = trimmed.slice(colonIndex + 1).trim(); if (!key || !value) { console.log(`Warning: Skipping permission line with empty key or value: "${trimmed}"`); continue; } additional[key] = value; }

This will help users debug configuration issues quickly.

test/parse-permissions.test.ts

docs/configuration.md

kdy1 · 2026-01-27T05:21:10Z

Can we revert this? This PR caused #863

…859)" This reverts commit 0c70417.

…859)" (#864) This reverts commit 0c70417.

…859)" (#864) This reverts commit 231bd75.

… [skip ci] Bumps [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) from 1.0.34 to 1.0.41. Release notes *Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).* > v1.0.41 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.41> > > v1.0.40 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.40> > > v1.0.39 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.39> > > v1.0.38 > ------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.38> > > v1.0.37 > ------- > > What's Changed > -------------- > > * feat: add actor-based comment filtering to GitHub data fetching by [`@ranyhb`](https://github.com/ranyhb) in [anthropics/claude-code-action#812](https://redirect.github.com/anthropics/claude-code-action/pull/812) > * Revert "Revert "feat: send additional\_permissions in token exchange request"" by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#866](https://redirect.github.com/anthropics/claude-code-action/pull/866) > * Revert "chore: bump Claude Code to 2.1.21 and Agent SDK to 0.2.21" by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#869](https://redirect.github.com/anthropics/claude-code-action/pull/869) > > New Contributors > ---------------- > > * [`@ranyhb`](https://github.com/ranyhb) made their first contribution in [anthropics/claude-code-action#812](https://redirect.github.com/anthropics/claude-code-action/pull/812) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.37> > > v1.0.36 > ------- > > What's Changed > -------------- > > * Revert "feat: send additional\_permissions in token exchange request" by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#864](https://redirect.github.com/anthropics/claude-code-action/pull/864) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.36> > > v1.0.35 > ------- > > What's Changed > -------------- > > * feat: send additional\_permissions in token exchange request by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#859](https://redirect.github.com/anthropics/claude-code-action/pull/859) > * chore: upgrade checkout-action to v6 by [`@arthur-mountain`](https://github.com/arthur-mountain) in [anthropics/claude-code-action#862](https://redirect.github.com/anthropics/claude-code-action/pull/862) > > New Contributors > ---------------- > > * [`@arthur-mountain`](https://github.com/arthur-mountain) made their first contribution in [anthropics/claude-code-action#862](https://redirect.github.com/anthropics/claude-code-action/pull/862) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.35> Commits * [`70e16de`](anthropics/claude-code-action@70e16de) chore: bump Claude Code to 2.1.29 and Agent SDK to 0.2.29 * [`0ed5eea`](anthropics/claude-code-action@0ed5eea) chore: bump Claude Code to 2.1.27 and Agent SDK to 0.2.27 * [`01e756b`](anthropics/claude-code-action@01e756b) chore: bump Claude Code to 2.1.25 and Agent SDK to 0.2.25 * [`ff34ce0`](anthropics/claude-code-action@ff34ce0) chore: bump Claude Code to 2.1.23 and Agent SDK to 0.2.23 * [`2817c54`](anthropics/claude-code-action@2817c54) chore: bump Claude Code to 2.1.22 and Agent SDK to 0.2.22 * [`d01eedd`](anthropics/claude-code-action@d01eedd) Revert "chore: bump Claude Code to 2.1.21 and Agent SDK to 0.2.21" ([#869](https://redirect.github.com/anthropics/claude-code-action/issues/869)) * [`49046e0`](anthropics/claude-code-action@49046e0) chore: bump Claude Code to 2.1.21 and Agent SDK to 0.2.21 * [`32ac726`](anthropics/claude-code-action@32ac726) Revert "Revert "feat: send additional\_permissions in token exchange request (... * [`fe72061`](anthropics/claude-code-action@fe72061) feat: add actor-based comment filtering to GitHub data fetching ([#812](https://redirect.github.com/anthropics/claude-code-action/issues/812)) * [`231bd75`](anthropics/claude-code-action@231bd75) Revert "feat: send additional\_permissions in token exchange request ([#859](https://redirect.github.com/anthropics/claude-code-action/issues/859))" (... * Additional commits viewable in [compare view](anthropics/claude-code-action@f642197...70e16de) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=anthropics/claude-code-action&package-manager=github\_actions&previous-version=1.0.34&new-version=1.0.41)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

feat: send additional_permissions in token exchange request

774d520

Parse the ADDITIONAL_PERMISSIONS env var and send it as a JSON body in the OIDC token exchange request. Permissions are merged on top of the standard defaults (contents: write, pull_requests: write, issues: write).

claude bot reviewed Jan 25, 2026

View reviewed changes

test/parse-permissions.test.ts Show resolved Hide resolved

docs: list specific available additional permissions

ef768ce

claude bot reviewed Jan 25, 2026

View reviewed changes

test/parse-permissions.test.ts Show resolved Hide resolved

claude bot reviewed Jan 25, 2026

View reviewed changes

docs/configuration.md Show resolved Hide resolved

ashwin-ant requested a review from a team January 25, 2026 01:13

bcherny approved these changes Jan 25, 2026

View reviewed changes

ashwin-ant merged commit 0c70417 into main Jan 26, 2026
41 checks passed

ashwin-ant deleted the ashwin/additional-permissions branch January 26, 2026 17:02

ashwin-ant added a commit that referenced this pull request Jan 27, 2026

Revert "feat: send additional_permissions in token exchange request (#…

e109b23

…859)" This reverts commit 0c70417.

ashwin-ant mentioned this pull request Jan 27, 2026

Revert "feat: send additional_permissions in token exchange request" #864

Merged

ashwin-ant added a commit that referenced this pull request Jan 27, 2026

Revert "feat: send additional_permissions in token exchange request (#…

231bd75

…859)" (#864) This reverts commit 0c70417.

ashwin-ant added a commit that referenced this pull request Jan 27, 2026

Reapply "feat: send additional_permissions in token exchange request (#…

d090d03

…859)" (#864) This reverts commit 231bd75.

github-actions bot mentioned this pull request Jan 29, 2026

fix(deps): update anthropics/claude-code-action action to v1.0.53 koki-develop/claude-renovate-review#38

Open

1 task

github-actions bot mentioned this pull request Feb 13, 2026

chore(deps): update anthropics/claude-code-action action to v1.0.51 lacolaco/blog.lacolaco.net#1310

Open

1 task

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: send additional_permissions in token exchange request#859

feat: send additional_permissions in token exchange request#859
ashwin-ant merged 2 commits intomainfrom
ashwin/additional-permissions

ashwin-ant commented Jan 25, 2026

Uh oh!

claude bot Jan 25, 2026

Uh oh!

claude bot Jan 25, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kdy1 commented Jan 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

Conversation

ashwin-ant commented Jan 25, 2026

Summary

Changes

src/github/token.ts

test/parse-permissions.test.ts (new)

docs/configuration.md

API Contract

Uh oh!

claude bot Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

claude bot Jan 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kdy1 commented Jan 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Comments

`src/github/token.ts`

`test/parse-permissions.test.ts` (new)

`docs/configuration.md`