Skip to content

ci(claude): surface full SDK output to diagnose @claude auth failure #983

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
BigSimmo wants to merge 4 commits into from
Closed

ci(claude): surface full SDK output to diagnose @claude auth failure #983

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
54037cb
ci(claude): surface full SDK output to diagnose @claude auth failure
claude Jul 20, 2026
8e82a0f
Merge branch 'main' into claude/github-comments-not-solving-2agr0c
BigSimmo Jul 20, 2026
7026037
Merge branch 'main' into claude/github-comments-not-solving-2agr0c
BigSimmo Jul 20, 2026
34fd587
Merge branch 'main' into claude/github-comments-not-solving-2agr0c
BigSimmo Jul 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions .github/workflows/claude.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,3 +69,7 @@ jobs:
# The action's default trigger phrase is "@claude"; it reads the
# triggering comment/review and acts on the current PR head.
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
# Temporary: surface the full SDK output in the job log so an
# authentication/usage error is readable instead of hidden. Remove
# once @claude is confirmed working.
show_full_output: "true"
Comment on lines +72 to +75

@coderabbitai coderabbitai Bot Jul 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Inspect the workflow around the referenced lines and the trigger/permissions context.
git ls-files .github/workflows/claude.yml
wc -l .github/workflows/claude.yml
cat -n .github/workflows/claude.yml | sed -n '1,180p'

# Look for any explicit references to show_full_output or related debugging guidance.
rg -n "show_full_output|claude|pull_request|permissions|github-token|GITHUB_TOKEN" .github/workflows/claude.yml

Repository: BigSimmo/Database

Length of output: 5741

🌐 Web query:

Anthropic claude-code-action show_full_output security documentation

💡 Result:

The show_full_output option in the Claude Code GitHub Action is a configuration setting that controls the verbosity of log outputs, carrying significant security implications [1][2]. Security Overview The show_full_output option is disabled by default (show_full_output: false) to prevent the accidental exposure of sensitive information [1][3][2]. When enabled (show_full_output: true), the action outputs all Claude Code messages, which may include: - Full outputs from tool executions (e.g., system commands, environment variable dumps, file reads) [1][3]. - API responses containing tokens or credentials [1][3]. - Sensitive file contents [1][3]. - System information potentially useful to an attacker [1][3]. Important Considerations - Public Visibility: In public GitHub repositories, these logs are publicly visible [1][3]. Even when set to false, sensitive data might still be present in raw execution logs unless properly managed [4]. - Debug Mode: Full output is automatically enabled if GitHub Actions debug mode is active (e.g., when the ACTIONS_STEP_DEBUG secret is set to true) [1][3][2]. - Risk Mitigation: Anthropic recommends using the default (false) setting and relying on sanitized output, which provides essential information like errors and completion status without exposing sensitive data [1][3]. - Best Practices: Users should only enable full output in private, controlled environments after verifying no secrets will be exposed [1][3]. Always use GitHub Actions secrets for sensitive values like API keys instead of hardcoding them [2][5]. Documentation Reference Detailed security documentation for this action can be found in the official repository under docs/security.md [1][2]. Users are also encouraged to review Anthropic's general security documentation for Claude Code, which covers permissions, credential storage, and sandboxing [5][6].

Citations:

Keep show_full_output disabled by default.

show_full_output can dump tool output, file contents, API responses, and credentials into job logs. This runs on PR interactions with write access, so leave it off unless you’re debugging privately, then remove it.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/claude.yml around lines 72 - 75, Update the workflow
configuration containing show_full_output to disable it by default by setting it
to false, and remove the temporary debugging comment that instructs exposing
full SDK output. Keep the existing workflow behavior unchanged otherwise.

Loading