public/claude-code-action
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: document Bash sub-patterns and agent mode allowed_tools fix

Browse Source 
- CLAUDE.md: add "Things That Will Bite You" entry about bare Bash
  requiring interactive approval and needing sub-patterns in CI
- docs/forgejo.md: update allowed_tools section with sub-pattern
  examples, agent mode fix note, and common patterns reference

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Vlad MocanuandClaude Opus 4.6 committed 2026-02-27 12:59:38 +02:00
1 parent 2978878d82
commit 073ef1e934
2 files changed
+15 -3
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/forgejo.md
+14 -3
View File
@@ -180,16 +180,27 @@ Upstream's `allowed_tools` and `disallowed_tools` inputs are completely broken
- User tools are merged into the tag-mode tool list
- `disallowedTools` is passed through to the SDK
- `WebSearch`/`WebFetch` are removed from the disallowed list when included in `allowed_tools`
- `run.ts` now passes `ALLOWED_TOOLS_INPUT` as `options.allowedTools` to `runClaude()`, fixing agent mode where tools were silently ignored
**Usage:**
**Important: Bash sub-patterns are required for CI auto-approval.** Bare `Bash` in `allowed_tools` makes the tool available but individual commands still require interactive approval (which can't happen in CI — there's nobody to click "approve"). Use sub-patterns to pre-approve command families:
```yaml
- uses: actions/claude-code-action@main
with:
allowed_tools: "WebSearch,WebFetch"
# All other inputs as usual
# ❌ WRONG — bare Bash requires interactive approval for every command
allowed_tools: "Bash,Read,Write,Edit"
# ✅ CORRECT — sub-patterns auto-approve specific command families
allowed_tools: "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit"
```
Common sub-patterns:
- `Bash(git:*)` — all git commands (push, commit, add, etc.)
- `Bash(bun:*)` — all bun commands (test, run, install, etc.)
- `Bash(curl:*)` — curl for API calls
- `Bash(npm test:*)` — specific command with any args
## Dedicated Bot User (Recommended)
On GitHub, Claude gets its own identity via the GitHub App (`claude[bot]`). On Forgejo, there's no such mechanism — by default the action runs under whatever token you provide, meaning commits and comments appear as the human user.