docs: document Bash sub-patterns and agent mode allowed_tools fix

- CLAUDE.md: add "Things That Will Bite You" entry about bare Bash
  requiring interactive approval and needing sub-patterns in CI
- docs/forgejo.md: update allowed_tools section with sub-pattern
  examples, agent mode fix note, and common patterns reference

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -35,6 +35,7 @@ Single entrypoint: `src/entrypoints/run.ts` orchestrates everything — prepare
 - **Error phase attribution**: The catch block in `run.ts` uses `prepareCompleted` to distinguish prepare failures from execution failures. The tracking comment shows different messages for each.
 - **`action.yml` outputs reference step IDs**: Outputs like `execution_file`, `branch_name`, `github_token` reference `steps.run.outputs.*`. If you rename the step ID, update the outputs section too.
 - **Integration testing** happens in a separate repo (`install-test`), not here. The tests in this repo are unit tests.
+- **`allowed_tools` needs Bash sub-patterns**: Bare `Bash` in `allowed_tools` makes the tool available but individual commands still require interactive approval (which can't happen in CI). Use sub-patterns like `Bash(git:*)`, `Bash(bun:*)`, `Bash(curl:*)` to pre-approve command families. Tag mode adds `--allowedTools` to `claudeArgs` itself; agent mode relies on `run.ts` passing `ALLOWED_TOOLS_INPUT` as `options.allowedTools` to the SDK.
 
 ## Forgejo Platform Support
 

docs/forgejo.md

@@ -180,16 +180,27 @@ Upstream's `allowed_tools` and `disallowed_tools` inputs are completely broken
 - User tools are merged into the tag-mode tool list
 - `disallowedTools` is passed through to the SDK
 - `WebSearch`/`WebFetch` are removed from the disallowed list when included in `allowed_tools`
+- `run.ts` now passes `ALLOWED_TOOLS_INPUT` as `options.allowedTools` to `runClaude()`, fixing agent mode where tools were silently ignored
 
-**Usage:**
+**Important: Bash sub-patterns are required for CI auto-approval.** Bare `Bash` in `allowed_tools` makes the tool available but individual commands still require interactive approval (which can't happen in CI — there's nobody to click "approve"). Use sub-patterns to pre-approve command families:
 
 ```yaml
 - uses: actions/claude-code-action@main
   with:
-    allowed_tools: "WebSearch,WebFetch"
-    # All other inputs as usual
+    # ❌ WRONG — bare Bash requires interactive approval for every command
+    allowed_tools: "Bash,Read,Write,Edit"
+
+    # ✅ CORRECT — sub-patterns auto-approve specific command families
+    allowed_tools: "Bash(git:*),Bash(bun:*),Bash(curl:*),Read,Write,Edit"
 ```
 
+Common sub-patterns:
+
+- `Bash(git:*)` — all git commands (push, commit, add, etc.)
+- `Bash(bun:*)` — all bun commands (test, run, install, etc.)
+- `Bash(curl:*)` — curl for API calls
+- `Bash(npm test:*)` — specific command with any args
+
 ## Dedicated Bot User (Recommended)
 
 On GitHub, Claude gets its own identity via the GitHub App (`claude[bot]`). On Forgejo, there's no such mechanism — by default the action runs under whatever token you provide, meaning commits and comments appear as the human user.