From 304a3828dafeba200a052055f3fa8ab327c703ac Mon Sep 17 00:00:00 2001 From: Cristian Greco Date: Sat, 10 Oct 2026 14:52:31 +0100 Subject: [PATCH] Fix Claude action pushing with the read-only workflow token actions/checkout@v7 persists the GITHUB_TOKEN header through includeIf.gitdir entries, which claude-code-action does not clear (anthropics/claude-code-action#1721). The header overrides the Claude app token on git push, so pushes fail with a 403 under contents: read. Stop persisting the checkout credentials so the app token is used. --- .github/workflows/claude.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index aa1312855..ca55e2fcf 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -31,6 +31,9 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 1 + # Otherwise the read-only GITHUB_TOKEN overrides the Claude app token on `git push` + # (anthropics/claude-code-action#1721) + persist-credentials: false - name: Run Claude Code id: claude