Document OAuth authentication fixes and setup guide

OAUTH_FIXES.md

@@ -0,0 +1,116 @@
+# OAuth Authentication Fixes and Setup Guide
+
+## Summary of Issues and Solutions
+
+### Issues Encountered
+
+1. **Model Parameter Not Being Passed**
+   - The `model` parameter was not being passed to the Claude CLI
+   - Fixed in our fork of claude-code-base-action
+
+2. **Invalid Model Names for OAuth**
+   - Standard API model names (e.g., `claude-3-opus-20240229`) are invalid for OAuth
+   - OAuth API uses different model naming conventions
+
+3. **"Thinking" Feature Conflicts**
+   - Error: `'claude-3-5-sonnet-20241022' does not support thinking.`
+   - OAuth API automatically enables features that aren't supported by all models
+
+### Solution
+
+**DO NOT specify a model parameter when using OAuth authentication.** The OAuth API automatically selects the appropriate model based on your Claude Max subscription.
+
+## Working Configuration
+
+```yaml
+name: Claude Code Review
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  issues:
+    types: [opened, edited]
+  issue_comment:
+    types: [created, edited]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+  id-token: write
+
+jobs:
+  claude-code-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Claude Code Action
+        uses: grll/claude-code-action@beta
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          use_oauth: true
+          claude_access_token: ${{ secrets.CLAUDE_ACCESS_TOKEN }}
+          claude_refresh_token: ${{ secrets.CLAUDE_REFRESH_TOKEN }}
+          claude_expires_at: ${{ secrets.CLAUDE_EXPIRES_AT }}
+          secrets_admin_pat: ${{ secrets.SECRETS_ADMIN_PAT }}
+          trigger_phrase: "@claude"
+          max_turns: 10
+          timeout_minutes: 10
+          # DO NOT include a model parameter
+```
+
+## Required Secrets
+
+Add these as organization secrets or repository secrets:
+
+1. **CLAUDE_ACCESS_TOKEN** - From `~/.claude/.credentials.json`
+2. **CLAUDE_REFRESH_TOKEN** - From `~/.claude/.credentials.json`
+3. **CLAUDE_EXPIRES_AT** - From `~/.claude/.credentials.json`
+4. **SECRETS_ADMIN_PAT** - GitHub Personal Access Token with `repo` and `workflow` scopes
+
+## Getting OAuth Credentials
+
+```bash
+# On the machine where you're logged into Claude Max
+cat ~/.claude/.credentials.json | jq -r '.claudeAiOauth | 
+  "CLAUDE_ACCESS_TOKEN: \(.accessToken)\n" +
+  "CLAUDE_REFRESH_TOKEN: \(.refreshToken)\n" +
+  "CLAUDE_EXPIRES_AT: \(.expiresAt)"'
+```
+
+## Creating SECRETS_ADMIN_PAT
+
+1. Go to https://github.com/settings/tokens/new
+2. Name: `Claude Code Secrets Admin`
+3. Expiration: Your preference
+4. Required scopes:
+   - ✅ `repo` (Full control of private repositories)
+   - ✅ `workflow` (Update GitHub Action workflows)
+5. Generate and copy the token
+
+## Important Notes
+
+- The OAuth API automatically handles model selection
+- Do not attempt to override the model when using OAuth
+- The action must use `grll/claude-code-action@beta`
+- Ensure `id-token: write` permission is included
+
+## Troubleshooting
+
+If you see errors like:
+- `"Invalid model name"` - Remove the model parameter
+- `"does not support thinking"` - Remove the model parameter
+- `"Actor does not have write permissions"` - Check that the comment is from a user with write access, not a bot
+
+## Test Your Setup
+
+1. Create a PR with a code file
+2. Comment: `@claude please review this code`
+3. Check the Actions tab to verify the workflow runs successfully
+4. Claude should respond with a code review