ci(claude): surface full SDK output to diagnose @claude auth failure#983
ci(claude): surface full SDK output to diagnose @claude auth failure#983BigSimmo wants to merge 4 commits into
Conversation
Add show_full_output: "true" to the Run Claude Code step so the exact authentication/usage error is written to the job log instead of being hidden. The @claude runs currently fail on turn 1 with is_error:true and the action masks the underlying message; this makes it readable. Temporary — to be removed once @claude is confirmed working. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0164nBbEeLzQWWZqBn95o3MW
📝 WalkthroughWalkthroughThe Claude workflow now enables full output from the Claude Code action, making complete action and SDK logs available during job execution. ChangesClaude workflow diagnostics
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
|
This pull request has been ignored for the connected project Preview Branches by Supabase. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/claude.yml:
- Around line 72-75: Update the workflow configuration containing
show_full_output to disable it by default by setting it to false, and remove the
temporary debugging comment that instructs exposing full SDK output. Keep the
existing workflow behavior unchanged otherwise.
🪄 Autofix (Beta)
❌ Autofix failed (check again to retry)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 21ab8af0-1dfe-497d-ba27-9db29f8bb3d2
📒 Files selected for processing (1)
.github/workflows/claude.yml
| # Temporary: surface the full SDK output in the job log so an | ||
| # authentication/usage error is readable instead of hidden. Remove | ||
| # once @claude is confirmed working. | ||
| show_full_output: "true" |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Inspect the workflow around the referenced lines and the trigger/permissions context.
git ls-files .github/workflows/claude.yml
wc -l .github/workflows/claude.yml
cat -n .github/workflows/claude.yml | sed -n '1,180p'
# Look for any explicit references to show_full_output or related debugging guidance.
rg -n "show_full_output|claude|pull_request|permissions|github-token|GITHUB_TOKEN" .github/workflows/claude.ymlRepository: BigSimmo/Database
Length of output: 5741
🌐 Web query:
Anthropic claude-code-action show_full_output security documentation
💡 Result:
The show_full_output option in the Claude Code GitHub Action is a configuration setting that controls the verbosity of log outputs, carrying significant security implications [1][2]. Security Overview The show_full_output option is disabled by default (show_full_output: false) to prevent the accidental exposure of sensitive information [1][3][2]. When enabled (show_full_output: true), the action outputs all Claude Code messages, which may include: - Full outputs from tool executions (e.g., system commands, environment variable dumps, file reads) [1][3]. - API responses containing tokens or credentials [1][3]. - Sensitive file contents [1][3]. - System information potentially useful to an attacker [1][3]. Important Considerations - Public Visibility: In public GitHub repositories, these logs are publicly visible [1][3]. Even when set to false, sensitive data might still be present in raw execution logs unless properly managed [4]. - Debug Mode: Full output is automatically enabled if GitHub Actions debug mode is active (e.g., when the ACTIONS_STEP_DEBUG secret is set to true) [1][3][2]. - Risk Mitigation: Anthropic recommends using the default (false) setting and relying on sanitized output, which provides essential information like errors and completion status without exposing sensitive data [1][3]. - Best Practices: Users should only enable full output in private, controlled environments after verifying no secrets will be exposed [1][3]. Always use GitHub Actions secrets for sensitive values like API keys instead of hardcoding them [2][5]. Documentation Reference Detailed security documentation for this action can be found in the official repository under docs/security.md [1][2]. Users are also encouraged to review Anthropic's general security documentation for Claude Code, which covers permissions, credential storage, and sandboxing [5][6].
Citations:
- 1: https://github.com/anthropics/claude-code-action/blob/refs/heads/main/docs/security.md
- 2: https://github.com/anthropics/claude-code-action/blob/main/base-action/README.md
- 3: https://github.com/anthropics/claude-code-action/blob/main/docs/security.md
- 4: Add show_full_output option to control output verbosity anthropics/claude-code-action#580
- 5: https://code.claude.com/docs/en/github-actions.md
- 6: https://code.claude.com/docs/en/security
Keep show_full_output disabled by default.
show_full_output can dump tool output, file contents, API responses, and credentials into job logs. This runs on PR interactions with write access, so leave it off unless you’re debugging privately, then remove it.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/claude.yml around lines 72 - 75, Update the workflow
configuration containing show_full_output to disable it by default by setting it
to false, and remove the temporary debugging comment that instructs exposing
full SDK output. Keep the existing workflow behavior unchanged otherwise.
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The agent generated fixes only for
Lines 69–75 # The action's default trigger phrase is "`@claude`"; it reads the
# triggering comment/review and acts on the current PR head.
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
- # Temporary: surface the full SDK output in the job log so an
- # authentication/usage error is readable instead of hidden. Remove
- # once `@claude` is confirmed working.
- show_full_output: "true"
+ show_full_output: "false" |
|
Note Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it. The agent generated fixes only for
Lines 69–75 # The action's default trigger phrase is "`@claude`"; it reads the
# triggering comment/review and acts on the current PR head.
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
- # Temporary: surface the full SDK output in the job log so an
- # authentication/usage error is readable instead of hidden. Remove
- # once `@claude` is confirmed working.
- show_full_output: "true"
+ show_full_output: "false" |
|
@claude please can you fix all of these comments and ensure this merges |
|
Hi @BigSimmo — thanks for the @claude mention. Open this in Claude Code on the web to continue here: https://claude.ai/code Context: Automated backlink from the Claude backlink workflow. Claude Code can pick up the mention and push a scoped fix to the branch. |
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
|
@cursoragent please resolve these comments |
|
You need to increase your spend limit or enable usage-based billing to run background agents. Go to Cursor |
|
Closing: this cannot do what it was opened to do.
More importantly, every recent Next step is to diagnose why the job gates out, not to widen its logging. |
Pull request was closed
|
Hi @BigSimmo — thanks for the @claude mention. Open this in Claude Code on the web to continue here: https://claude.ai/code Context: Automated backlink from the Claude backlink workflow. Claude Code can pick up the mention and push a scoped fix to the branch. |
|
Claude encountered an error after 2s —— View job I'll analyze this and get back to you. |
2 participants
Summary
show_full_output: "true"to theRun Claude Codestep in.github/workflows/claude.yml.@clauderun currently fails on turn 1 withis_error:true(verified across 3 runs on PRs docs: repository maturity audit — report, security policy, diagrams, index cleanup #981 and chore(deps-dev): add @typescript/typescript6 for AST tooling; hold typescript at 6.x (TS7 has no JS compiler API) #949), but the action hides the underlying message ("full output hidden for security"). This flag writes the full SDK output to the job log so the exact authentication/usage error is readable, instead of us inferring it. The workflow itself is proven correct — it fires, gates on the trigger, checks out, installs Claude Code, and reads the token; the failure is at the credential/account layer.@claudeis confirmed working.Verification
node scripts/check-github-action-pins.mjs(pass), Prettier--checkon the workflow (pass), YAML parse (valid).Risk and rollout
@clauderuntime behavior.Clinical Governance Preflight
Not applicable — CI configuration only.
Notes
@claudetest will print the real error (e.g.401, an expired-token message, or a usage-limit message), which tells us definitively whether to regenerate the token, change plan/tier, or wait out a usage cap.Generated by Claude Code
Summary by CodeRabbit