tmp

Implement time-based filtering for GitHub comments and reviews to prevent
malicious actors from editing existing comments after Claude is triggered
to inject harmful content.

Changes:
- Add updatedAt and lastEditedAt fields to GraphQL queries
- Update GitHubComment and GitHubReview types with timestamp fields
- Implement filterCommentsToTriggerTime() and filterReviewsToTriggerTime()
- Add extractTriggerTimestamp() to extract trigger time from webhooks
- Update tag and review modes to pass trigger timestamp to data fetcher

Security benefits:
- Prevents comment injection attacks via post-trigger edits
- Maintains chronological integrity of conversation context
- Ensures only comments in their final state before trigger are processed
- Backward compatible with graceful degradation

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/issue-triage.yml

@@ -78,7 +78,7 @@ jobs:
           4. Select appropriate labels from the available labels list provided above:
              - Choose labels that accurately reflect the issue's nature
              - Be specific but comprehensive
-             - IMPORTANT: Add a priority label (P1, P2, or P3) based on the label descriptions from gh label list
+             - Select priority labels if you can determine urgency (high-priority, med-priority, or low-priority)
              - Consider platform labels (android, ios) if applicable
              - If you find similar issues using mcp__github__search_issues, consider using a "duplicate" label if appropriate. Only do so if the issue is a duplicate of another OPEN issue.
 
@@ -97,12 +97,10 @@ jobs:
           EOF
 
       - name: Run Claude Code for Issue Triage
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-base-action@v1
         with:
           prompt: $(cat /tmp/claude-prompts/triage-prompt.txt)
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          allowed_non_write_users: "*"
           claude_args: |
             --allowedTools Bash(gh label list),mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues
             --mcp-config /tmp/mcp-config/mcp-servers.json

README.md

@@ -31,25 +31,8 @@ This command will guide you through setting up the GitHub app and required secre
 - You must be a repository admin to install the GitHub app and add secrets
 - This quickstart method is only available for direct Anthropic API users. For AWS Bedrock or Google Vertex AI setup, see [docs/cloud-providers.md](./docs/cloud-providers.md).
 
-## 📚 Solutions & Use Cases
-
-Looking for specific automation patterns? Check our **[Solutions Guide](./docs/solutions.md)** for complete working examples including:
-
-- **🔍 Automatic PR Code Review** - Full review automation
-- **📂 Path-Specific Reviews** - Trigger on critical file changes
-- **👥 External Contributor Reviews** - Special handling for new contributors
-- **📝 Custom Review Checklists** - Enforce team standards
-- **🔄 Scheduled Maintenance** - Automated repository health checks
-- **🏷️ Issue Triage & Labeling** - Automatic categorization
-- **📖 Documentation Sync** - Keep docs updated with code changes
-- **🔒 Security-Focused Reviews** - OWASP-aligned security analysis
-- **📊 DIY Progress Tracking** - Create tracking comments in automation mode
-
-Each solution includes complete working examples, configuration details, and expected outcomes.
-
 ## Documentation
 
-- **[Solutions Guide](./docs/solutions.md)** - **🎯 Ready-to-use automation patterns**
 - **[Migration Guide](./docs/migration-guide.md)** - **⭐ Upgrading from v0.x to v1.0**
 - [Setup Guide](./docs/setup.md) - Manual setup, custom GitHub apps, and security best practices
 - [Usage Guide](./docs/usage.md) - Basic usage, workflow configuration, and input parameters

action.yml

@@ -27,10 +27,6 @@ inputs:
     description: "Comma-separated list of allowed bot usernames, or '*' to allow all bots. Empty string (default) allows no bots."
     required: false
     default: ""
-  allowed_non_write_users:
-    description: "Comma-separated list of usernames to allow without write permissions, or '*' to allow all users. Only works when github_token input is provided. WARNING: Use with extreme caution - this bypasses security checks and should only be used for workflows with very limited permissions (e.g., issue labeling)."
-    required: false
-    default: ""
 
   # Claude Code configuration
   prompt:
@@ -77,14 +73,6 @@ inputs:
     description: "Enable commit signing using GitHub's commit signature verification. When false, Claude uses standard git commands"
     required: false
     default: "false"
-  bot_id:
-    description: "GitHub user ID to use for git operations (defaults to Claude's bot ID)"
-    required: false
-    default: "41898282" # Claude's bot ID - see src/github/constants.ts
-  bot_name:
-    description: "GitHub username to use for git operations (defaults to Claude's bot name)"
-    required: false
-    default: "claude[bot]"
   track_progress:
     description: "Force tag mode with tracking comments for pull_request and issue events. Only applicable to pull_request (opened, synchronize, ready_for_review, reopened) and issue (opened, edited, labeled, assigned) events."
     required: false
@@ -152,13 +140,10 @@ runs:
         BRANCH_PREFIX: ${{ inputs.branch_prefix }}
         OVERRIDE_GITHUB_TOKEN: ${{ inputs.github_token }}
         ALLOWED_BOTS: ${{ inputs.allowed_bots }}
-        ALLOWED_NON_WRITE_USERS: ${{ inputs.allowed_non_write_users }}
         GITHUB_RUN_ID: ${{ github.run_id }}
         USE_STICKY_COMMENT: ${{ inputs.use_sticky_comment }}
         DEFAULT_WORKFLOW_TOKEN: ${{ github.token }}
         USE_COMMIT_SIGNING: ${{ inputs.use_commit_signing }}
-        BOT_ID: ${{ inputs.bot_id }}
-        BOT_NAME: ${{ inputs.bot_name }}
         TRACK_PROGRESS: ${{ inputs.track_progress }}
         ADDITIONAL_PERMISSIONS: ${{ inputs.additional_permissions }}
         CLAUDE_ARGS: ${{ inputs.claude_args }}
@@ -177,7 +162,7 @@ runs:
         # Install Claude Code if no custom executable is provided
         if [ -z "${{ inputs.path_to_claude_code_executable }}" ]; then
           echo "Installing Claude Code..."
-          curl -fsSL https://claude.ai/install.sh | bash -s 1.0.108
+          curl -fsSL https://claude.ai/install.sh | bash -s 1.0.96
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
         else
           echo "Using custom Claude Code executable: ${{ inputs.path_to_claude_code_executable }}"

base-action/action.yml

@@ -99,7 +99,7 @@ runs:
       run: |
         if [ -z "${{ inputs.path_to_claude_code_executable }}" ]; then
           echo "Installing Claude Code..."
-          curl -fsSL https://claude.ai/install.sh | bash -s 1.0.108
+          curl -fsSL https://claude.ai/install.sh | bash -s 1.0.96
         else
           echo "Using custom Claude Code executable: ${{ inputs.path_to_claude_code_executable }}"
           # Add the directory containing the custom executable to PATH

docs/custom-automations.md

@@ -2,15 +2,6 @@
 
 These examples show how to configure Claude to act automatically based on GitHub events. When you provide a `prompt` input, the action automatically runs in agent mode without requiring manual @mentions. Without a `prompt`, it runs in interactive mode, responding to @claude mentions.
 
-## Mode Detection & Tracking Comments
-
-The action automatically detects which mode to use based on your configuration:
-
-- **Interactive Mode** (no `prompt` input): Responds to @claude mentions, creates tracking comments with progress indicators
-- **Automation Mode** (with `prompt` input): Executes immediately, **does not create tracking comments**
-
-> **Note**: In v1, automation mode intentionally does not create tracking comments by default to reduce noise in automated workflows. If you need progress tracking, use the `track_progress: true` input parameter.
-
 ## Supported GitHub Events
 
 This action supports the following GitHub events ([learn more GitHub event triggers](https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows)):
@@ -21,7 +12,7 @@ This action supports the following GitHub events ([learn more GitHub event trigg
 - `issues` - When issues are opened or assigned
 - `pull_request_review` - When PR reviews are submitted
 - `pull_request_review_comment` - When comments are made on PR reviews
-- `repository_dispatch` - Custom events triggered via API
+- `repository_dispatch` - Custom events triggered via API (coming soon)
 - `workflow_dispatch` - Manual workflow triggers (coming soon)
 
 ## Automated Documentation Updates

docs/faq.md

@@ -28,33 +28,6 @@ permissions:
 
 The OIDC token is required in order for the Claude GitHub app to function. If you wish to not use the GitHub app, you can instead provide a `github_token` input to the action for Claude to operate with. See the [Claude Code permissions documentation][perms] for more.
 
-### Why am I getting '403 Resource not accessible by integration' errors?
-
-This error occurs when the action tries to fetch the authenticated user information using a GitHub App installation token. GitHub App tokens have limited access and cannot access the `/user` endpoint, which causes this 403 error.
-
-**Solution**: The action now includes `bot_id` and `bot_name` inputs that default to Claude's bot credentials. This avoids the need to fetch user information from the API.
-
-For the default claude[bot]:
-
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-    # bot_id and bot_name have sensible defaults, no need to specify
-```
-
-For custom bots, specify both:
-
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-    bot_id: "12345678" # Your bot's GitHub user ID
-    bot_name: "my-bot" # Your bot's username
-```
-
-This issue typically only affects agent/automation mode workflows. Interactive workflows (with @claude mentions) don't encounter this issue as they use the comment author's information.
-
 ## Claude's Capabilities and Limitations
 
 ### Why won't Claude update workflow files when I ask it to?

docs/migration-guide.md

@@ -14,19 +14,18 @@ This guide helps you migrate from Claude Code Action v0.x to v1.0. The new versi
 
 The following inputs have been deprecated and replaced:
 
-| Deprecated Input      | Replacement                          | Notes                                         |
+| Deprecated Input      | Replacement                      | Notes                                         |
-| --------------------- | ------------------------------------ | --------------------------------------------- |
+| --------------------- | -------------------------------- | --------------------------------------------- |
-| `mode`                | Auto-detected                        | Action automatically chooses based on context |
+| `mode`                | Auto-detected                    | Action automatically chooses based on context |
-| `direct_prompt`       | `prompt`                             | Direct drop-in replacement                    |
+| `direct_prompt`       | `prompt`                         | Direct drop-in replacement                    |
-| `override_prompt`     | `prompt`                             | Use GitHub context variables instead          |
+| `override_prompt`     | `prompt`                         | Use GitHub context variables instead          |
-| `custom_instructions` | `claude_args: --system-prompt`       | Move to CLI arguments                         |
+| `custom_instructions` | `claude_args: --system-prompt`   | Move to CLI arguments                         |
-| `max_turns`           | `claude_args: --max-turns`           | Use CLI format                                |
+| `max_turns`           | `claude_args: --max-turns`       | Use CLI format                                |
-| `model`               | `claude_args: --model`               | Specify via CLI                               |
+| `model`               | `claude_args: --model`           | Specify via CLI                               |
-| `allowed_tools`       | `claude_args: --allowedTools`        | Use CLI format                                |
+| `allowed_tools`       | `claude_args: --allowedTools`    | Use CLI format                                |
-| `disallowed_tools`    | `claude_args: --disallowedTools`     | Use CLI format                                |
+| `disallowed_tools`    | `claude_args: --disallowedTools` | Use CLI format                                |
-| `claude_env`          | `settings` with env object           | Use settings JSON                             |
+| `claude_env`          | `settings` with env object       | Use settings JSON                             |
-| `mcp_config`          | `claude_args: --mcp-config`          | Pass MCP config via CLI arguments             |
+| `mcp_config`          | `claude_args: --mcp-config`      | Pass MCP config via CLI arguments             |
-| `timeout_minutes`     | Use GitHub Actions `timeout-minutes` | Configure at job level instead of input level |
 
 ## Migration Examples
 
@@ -75,75 +74,13 @@ The following inputs have been deprecated and replaced:
 ```yaml
 - uses: anthropics/claude-code-action@v1
   with:
-    prompt: |
+    prompt: "Review this PR for security issues"
-      REPO: ${{ github.repository }}
-      PR NUMBER: ${{ github.event.pull_request.number }}
-
-      Review this PR for security issues
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
     claude_args: |
       --model claude-4-0-sonnet-20250805
       --allowedTools Edit,Read,Write
 ```
 
-> **⚠️ Important**: For PR reviews, always include the repository and PR context in your prompt. This ensures Claude knows which PR to review.
-
-### Automation with Progress Tracking (New in v1.0)
-
-**Missing the tracking comments from v0.x agent mode?** The new `track_progress` input brings them back!
-
-In v1.0, automation mode (with `prompt` input) doesn't create tracking comments by default to reduce noise. However, if you need progress visibility, you can use the `track_progress` feature:
-
-**Before (v0.x with tracking):**
-
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    mode: "agent"
-    direct_prompt: "Review this PR for security issues"
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-```
-
-**After (v1.0 with tracking):**
-
-```yaml
-- uses: anthropics/claude-code-action@v1
-  with:
-    track_progress: true # Forces tag mode with tracking comments
-    prompt: |
-      REPO: ${{ github.repository }}
-      PR NUMBER: ${{ github.event.pull_request.number }}
-
-      Review this PR for security issues
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-```
-
-#### Benefits of `track_progress`
-
-1. **Preserves GitHub Context**: Automatically includes all PR/issue details, comments, and attachments
-2. **Brings Back Tracking Comments**: Creates progress indicators just like v0.x agent mode
-3. **Works with Custom Prompts**: Your `prompt` is injected as custom instructions while maintaining context
-
-#### Supported Events for `track_progress`
-
-The `track_progress` input only works with these GitHub events:
-
-**Pull Request Events:**
-
-- `opened` - New PR created
-- `synchronize` - PR updated with new commits
-- `ready_for_review` - Draft PR marked as ready
-- `reopened` - Previously closed PR reopened
-
-**Issue Events:**
-
-- `opened` - New issue created
-- `edited` - Issue title or body modified
-- `labeled` - Label added to issue
-- `assigned` - Issue assigned to user
-
-> **Note**: Using `track_progress: true` with unsupported events will cause an error.
-
 ### Custom Template with Variables
 
 **Before (v0.x):**
@@ -163,16 +100,10 @@ The `track_progress` input only works with these GitHub events:
 - uses: anthropics/claude-code-action@v1
   with:
     prompt: |
-      REPO: ${{ github.repository }}
+      Analyze PR #${{ github.event.pull_request.number }} in ${{ github.repository }}
-      PR NUMBER: ${{ github.event.pull_request.number }}
+      Focus on security vulnerabilities in the changed files
-
-      Analyze this pull request focusing on security vulnerabilities in the changed files.
-
-      Note: The PR branch is already checked out in the current working directory.
 ```
 
-> **💡 Tip**: While you can access GitHub context variables in your prompt, it's recommended to use the standard `REPO:` and `PR NUMBER:` format for consistency.
-
 ### Environment Variables
 
 **Before (v0.x):**
@@ -199,30 +130,6 @@ The `track_progress` input only works with these GitHub events:
       }
 ```
 
-### Timeout Configuration
-
-**Before (v0.x):**
-
-```yaml
-- uses: anthropics/claude-code-action@beta
-  with:
-    timeout_minutes: 30
-    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-```
-
-**After (v1.0):**
-
-```yaml
-jobs:
-  claude-task:
-    runs-on: ubuntu-latest
-    timeout-minutes: 30 # Moved to job level
-    steps:
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-```
-
 ## How Mode Detection Works
 
 The action now automatically detects the appropriate mode:
@@ -337,8 +244,6 @@ You can also pass MCP configuration from a file:
 - [ ] Convert `disallowed_tools` to `claude_args` with `--disallowedTools`
 - [ ] Move `claude_env` to `settings` JSON format
 - [ ] Move `mcp_config` to `claude_args` with `--mcp-config`
-- [ ] Replace `timeout_minutes` with GitHub Actions `timeout-minutes` at job level
-- [ ] **Optional**: Add `track_progress: true` if you need tracking comments in automation mode
 - [ ] Test workflow in a non-production environment
 
 ## Getting Help

docs/security.md

@@ -4,11 +4,6 @@
 
 - **Repository Access**: The action can only be triggered by users with write access to the repository
 - **Bot User Control**: By default, GitHub Apps and bots cannot trigger this action for security reasons. Use the `allowed_bots` parameter to enable specific bots or all bots
-- **⚠️ Non-Write User Access (RISKY)**: The `allowed_non_write_users` parameter allows bypassing the write permission requirement. **This is a significant security risk and should only be used for workflows with extremely limited permissions** (e.g., issue labeling workflows that only have `issues: write` permission). This feature:
-  - Only works when `github_token` is provided as input (not with GitHub App authentication)
-  - Accepts either a comma-separated list of specific usernames or `*` to allow all users
-  - **Should be used with extreme caution** as it bypasses the primary security mechanism of this action
-  - Is designed for automation workflows where user permissions are already restricted by the workflow's permission scope
 - **Token Permissions**: The GitHub app receives only a short-lived token scoped specifically to the repository it's operating in
 - **No Cross-Repository Access**: Each action invocation is limited to the repository where it was triggered
 - **Limited Scope**: The token cannot access other repositories or perform actions beyond the configured permissions

docs/solutions.md

@@ -1,591 +0,0 @@
-# Solutions & Use Cases
-
-This guide provides complete, ready-to-use solutions for common automation scenarios with Claude Code Action. Each solution includes working examples, configuration details, and expected outcomes.
-
-## 📋 Table of Contents
-
-- [Automatic PR Code Review](#automatic-pr-code-review)
-- [Review Only Specific File Paths](#review-only-specific-file-paths)
-- [Review PRs from External Contributors](#review-prs-from-external-contributors)
-- [Custom PR Review Checklist](#custom-pr-review-checklist)
-- [Scheduled Repository Maintenance](#scheduled-repository-maintenance)
-- [Issue Auto-Triage and Labeling](#issue-auto-triage-and-labeling)
-- [Documentation Sync on API Changes](#documentation-sync-on-api-changes)
-- [Security-Focused PR Reviews](#security-focused-pr-reviews)
-
----
-
-## Automatic PR Code Review
-
-**When to use:** Automatically review every PR opened or updated in your repository.
-
-### Basic Example (No Tracking)
-
-```yaml
-name: Claude Auto Review
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Please review this pull request with a focus on:
-            - Code quality and best practices
-            - Potential bugs or issues
-            - Security implications
-            - Performance considerations
-
-            Note: The PR branch is already checked out in the current working directory.
-
-            Use `gh pr comment` for top-level feedback.
-            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific code issues.
-            Only post GitHub comments - don't submit review text as messages.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
-```
-
-**Key Configuration:**
-
-- Triggers on `opened` and `synchronize` (new commits)
-- Always include `REPO` and `PR NUMBER` for context
-- Specify tools for commenting and reviewing
-- PR branch is pre-checked out
-
-**Expected Output:** Claude posts review comments directly to the PR with inline annotations where appropriate.
-
-### Enhanced Example (With Progress Tracking)
-
-Want visual progress tracking for PR reviews? Use `track_progress: true` to get tracking comments like in v0.x:
-
-```yaml
-name: Claude Auto Review with Tracking
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-
-jobs:
-  review:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          track_progress: true # ✨ Enables tracking comments
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Please review this pull request with a focus on:
-            - Code quality and best practices
-            - Potential bugs or issues
-            - Security implications
-            - Performance considerations
-
-            Provide detailed feedback using inline comments for specific issues.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
-```
-
-**Benefits of Progress Tracking:**
-
-- **Visual Progress Indicators**: Shows "In progress" status with checkboxes
-- **Preserves Full Context**: Automatically includes all PR details, comments, and attachments
-- **Migration-Friendly**: Perfect for teams moving from v0.x who miss tracking comments
-- **Works with Custom Prompts**: Your prompt becomes custom instructions while maintaining GitHub context
-
-**Expected Output:**
-
-1. Claude creates a tracking comment: "Claude Code is reviewing this pull request..."
-2. Updates the comment with progress checkboxes as it works
-3. Posts detailed review feedback with inline annotations
-4. Updates tracking comment to "Completed" when done
-
----
-
-## Review Only Specific File Paths
-
-**When to use:** Review PRs only when specific critical files change.
-
-**Complete Example:**
-
-```yaml
-name: Review Critical Files
-on:
-  pull_request:
-    types: [opened, synchronize]
-    paths:
-      - "src/auth/**"
-      - "src/api/**"
-      - "config/security.yml"
-
-jobs:
-  security-review:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            This PR modifies critical authentication or API files.
-
-            Please provide a security-focused review with emphasis on:
-            - Authentication and authorization flows
-            - Input validation and sanitization
-            - SQL injection or XSS vulnerabilities
-            - API security best practices
-
-            Note: The PR branch is already checked out.
-
-            Post detailed security findings as PR comments.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*)"
-```
-
-**Key Configuration:**
-
-- `paths:` filter triggers only for specific file changes
-- Custom prompt emphasizes security for sensitive areas
-- Useful for compliance or security reviews
-
-**Expected Output:** Security-focused review when critical files are modified.
-
----
-
-## Review PRs from External Contributors
-
-**When to use:** Apply stricter review criteria for external or new contributors.
-
-**Complete Example:**
-
-```yaml
-name: External Contributor Review
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  external-review:
-    if: github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-            CONTRIBUTOR: ${{ github.event.pull_request.user.login }}
-
-            This is a first-time contribution from @${{ github.event.pull_request.user.login }}.
-
-            Please provide a comprehensive review focusing on:
-            - Compliance with project coding standards
-            - Proper test coverage (unit and integration)
-            - Documentation for new features
-            - Potential breaking changes
-            - License header requirements
-
-            Be welcoming but thorough in your review. Use inline comments for code-specific feedback.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr view:*)"
-```
-
-**Key Configuration:**
-
-- `if:` condition targets specific contributor types
-- Includes contributor username in context
-- Emphasis on onboarding and standards
-
-**Expected Output:** Detailed review helping new contributors understand project standards.
-
----
-
-## Custom PR Review Checklist
-
-**When to use:** Enforce specific review criteria for your team's workflow.
-
-**Complete Example:**
-
-```yaml
-name: PR Review Checklist
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  checklist-review:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Review this PR against our team checklist:
-
-            ## Code Quality
-            - [ ] Code follows our style guide
-            - [ ] No commented-out code
-            - [ ] Meaningful variable names
-            - [ ] DRY principle followed
-
-            ## Testing
-            - [ ] Unit tests for new functions
-            - [ ] Integration tests for new endpoints
-            - [ ] Edge cases covered
-            - [ ] Test coverage > 80%
-
-            ## Documentation
-            - [ ] README updated if needed
-            - [ ] API docs updated
-            - [ ] Inline comments for complex logic
-            - [ ] CHANGELOG.md updated
-
-            ## Security
-            - [ ] No hardcoded credentials
-            - [ ] Input validation implemented
-            - [ ] Proper error handling
-            - [ ] No sensitive data in logs
-
-            For each item, check if it's satisfied and comment on any that need attention.
-            Post a summary comment with checklist results.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*)"
-```
-
-**Key Configuration:**
-
-- Structured checklist in prompt
-- Systematic review approach
-- Team-specific criteria
-
-**Expected Output:** Systematic review with checklist results and specific feedback.
-
----
-
-## Scheduled Repository Maintenance
-
-**When to use:** Regular automated maintenance tasks.
-
-**Complete Example:**
-
-```yaml
-name: Weekly Maintenance
-on:
-  schedule:
-    - cron: "0 0 * * 0" # Every Sunday at midnight
-  workflow_dispatch: # Manual trigger option
-
-jobs:
-  maintenance:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      issues: write
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-
-            Perform weekly repository maintenance:
-
-            1. Check for outdated dependencies in package.json
-            2. Scan for security vulnerabilities using `npm audit`
-            3. Review open issues older than 90 days
-            4. Check for TODO comments in recent commits
-            5. Verify README.md examples still work
-
-            Create a single issue summarizing any findings.
-            If critical security issues are found, also comment on open PRs.
-
-          claude_args: |
-            --allowedTools "Read,Bash(npm:*),Bash(gh issue:*),Bash(git:*)"
-```
-
-**Key Configuration:**
-
-- `schedule:` for automated runs
-- `workflow_dispatch:` for manual triggering
-- Comprehensive tool permissions for analysis
-
-**Expected Output:** Weekly maintenance report as GitHub issue.
-
----
-
-## Issue Auto-Triage and Labeling
-
-**When to use:** Automatically categorize and prioritize new issues.
-
-**Complete Example:**
-
-```yaml
-name: Issue Triage
-on:
-  issues:
-    types: [opened]
-
-jobs:
-  triage:
-    runs-on: ubuntu-latest
-    permissions:
-      issues: write
-      id-token: write
-    steps:
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            ISSUE NUMBER: ${{ github.event.issue.number }}
-            TITLE: ${{ github.event.issue.title }}
-            BODY: ${{ github.event.issue.body }}
-            AUTHOR: ${{ github.event.issue.user.login }}
-
-            Analyze this new issue and:
-            1. Determine if it's a bug report, feature request, or question
-            2. Assess priority (critical, high, medium, low)
-            3. Suggest appropriate labels
-            4. Check if it duplicates existing issues
-
-            Based on your analysis, add the appropriate labels using:
-            `gh issue edit [number] --add-label "label1,label2"`
-
-            If it appears to be a duplicate, post a comment mentioning the original issue.
-
-          claude_args: |
-            --allowedTools "Bash(gh issue:*),Bash(gh search:*)"
-```
-
-**Key Configuration:**
-
-- Triggered on new issues
-- Issue context in prompt
-- Label management capabilities
-
-**Expected Output:** Automatically labeled and categorized issues.
-
----
-
-## Documentation Sync on API Changes
-
-**When to use:** Keep docs up-to-date when API code changes.
-
-**Complete Example:**
-
-```yaml
-name: Sync API Documentation
-on:
-  pull_request:
-    types: [opened, synchronize]
-    paths:
-      - "src/api/**/*.ts"
-      - "src/routes/**/*.ts"
-
-jobs:
-  doc-sync:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          fetch-depth: 0
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            This PR modifies API endpoints. Please:
-
-            1. Review the API changes in src/api and src/routes
-            2. Update API.md to document any new or changed endpoints
-            3. Ensure OpenAPI spec is updated if needed
-            4. Update example requests/responses
-
-            Use standard REST API documentation format.
-            Commit any documentation updates to this PR branch.
-
-          claude_args: |
-            --allowedTools "Read,Write,Edit,Bash(git:*)"
-```
-
-**Key Configuration:**
-
-- Path-specific trigger
-- Write permissions for doc updates
-- Git tools for committing
-
-**Expected Output:** API documentation automatically updated with code changes.
-
----
-
-## Security-Focused PR Reviews
-
-**When to use:** Deep security analysis for sensitive repositories.
-
-**Complete Example:**
-
-```yaml
-name: Security Review
-on:
-  pull_request:
-    types: [opened, synchronize]
-
-jobs:
-  security:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      security-events: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          # Optional: Add track_progress: true for visual progress tracking during security reviews
-          # track_progress: true
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Perform a comprehensive security review:
-
-            ## OWASP Top 10 Analysis
-            - SQL Injection vulnerabilities
-            - Cross-Site Scripting (XSS)
-            - Broken Authentication
-            - Sensitive Data Exposure
-            - XML External Entities (XXE)
-            - Broken Access Control
-            - Security Misconfiguration
-            - Cross-Site Request Forgery (CSRF)
-            - Using Components with Known Vulnerabilities
-            - Insufficient Logging & Monitoring
-
-            ## Additional Security Checks
-            - Hardcoded secrets or credentials
-            - Insecure cryptographic practices
-            - Unsafe deserialization
-            - Server-Side Request Forgery (SSRF)
-            - Race conditions or TOCTOU issues
-
-            Rate severity as: CRITICAL, HIGH, MEDIUM, LOW, or NONE.
-            Post detailed findings with recommendations.
-
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*)"
-```
-
-**Key Configuration:**
-
-- Security-focused prompt structure
-- OWASP alignment
-- Severity rating system
-
-**Expected Output:** Detailed security analysis with prioritized findings.
-
----
-
-## Tips for All Solutions
-
-### Always Include GitHub Context
-
-```yaml
-prompt: |
-  REPO: ${{ github.repository }}
-  PR NUMBER: ${{ github.event.pull_request.number }}
-  [Your specific instructions]
-```
-
-### Common Tool Permissions
-
-- **PR Comments**: `Bash(gh pr comment:*)`
-- **Inline Comments**: `mcp__github_inline_comment__create_inline_comment`
-- **File Operations**: `Read,Write,Edit`
-- **Git Operations**: `Bash(git:*)`
-
-### Best Practices
-
-- Be specific in your prompts
-- Include expected output format
-- Set clear success criteria
-- Provide context about the repository
-- Use inline comments for code-specific feedback

docs/usage.md

@@ -47,31 +47,27 @@ jobs:
 
 ## Inputs
 
-| Input                          | Description                                                                                                                                                                    | Required | Default       |
+| Input                          | Description                                                                                                          | Required | Default   |
-| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------- | ------------- |
+| ------------------------------ | -------------------------------------------------------------------------------------------------------------------- | -------- | --------- |
-| `anthropic_api_key`            | Anthropic API key (required for direct API, not needed for Bedrock/Vertex)                                                                                                     | No\*     | -             |
+| `anthropic_api_key`            | Anthropic API key (required for direct API, not needed for Bedrock/Vertex)                                           | No\*     | -         |
-| `claude_code_oauth_token`      | Claude Code OAuth token (alternative to anthropic_api_key)                                                                                                                     | No\*     | -             |
+| `claude_code_oauth_token`      | Claude Code OAuth token (alternative to anthropic_api_key)                                                           | No\*     | -         |
-| `prompt`                       | Instructions for Claude. Can be a direct prompt or custom template for automation workflows                                                                                    | No       | -             |
+| `prompt`                       | Instructions for Claude. Can be a direct prompt or custom template for automation workflows                          | No       | -         |
-| `track_progress`               | Force tag mode with tracking comments. Only works with specific PR/issue events. Preserves GitHub context                                                                      | No       | `false`       |
+| `claude_args`                  | Additional arguments to pass directly to Claude CLI (e.g., `--max-turns 10 --model claude-4-0-sonnet-20250805`)      | No       | ""        |
-| `claude_args`                  | Additional arguments to pass directly to Claude CLI (e.g., `--max-turns 10 --model claude-4-0-sonnet-20250805`)                                                                | No       | ""            |
+| `base_branch`                  | The base branch to use for creating new branches (e.g., 'main', 'develop')                                           | No       | -         |
-| `base_branch`                  | The base branch to use for creating new branches (e.g., 'main', 'develop')                                                                                                     | No       | -             |
+| `use_sticky_comment`           | Use just one comment to deliver PR comments (only applies for pull_request event workflows)                          | No       | `false`   |
-| `use_sticky_comment`           | Use just one comment to deliver PR comments (only applies for pull_request event workflows)                                                                                    | No       | `false`       |
+| `github_token`                 | GitHub token for Claude to operate with. **Only include this if you're connecting a custom GitHub app of your own!** | No       | -         |
-| `github_token`                 | GitHub token for Claude to operate with. **Only include this if you're connecting a custom GitHub app of your own!**                                                           | No       | -             |
+| `use_bedrock`                  | Use Amazon Bedrock with OIDC authentication instead of direct Anthropic API                                          | No       | `false`   |
-| `use_bedrock`                  | Use Amazon Bedrock with OIDC authentication instead of direct Anthropic API                                                                                                    | No       | `false`       |
+| `use_vertex`                   | Use Google Vertex AI with OIDC authentication instead of direct Anthropic API                                        | No       | `false`   |
-| `use_vertex`                   | Use Google Vertex AI with OIDC authentication instead of direct Anthropic API                                                                                                  | No       | `false`       |
+| `mcp_config`                   | Additional MCP configuration (JSON string) that merges with the built-in GitHub MCP servers                          | No       | ""        |
-| `mcp_config`                   | Additional MCP configuration (JSON string) that merges with the built-in GitHub MCP servers                                                                                    | No       | ""            |
+| `assignee_trigger`             | The assignee username that triggers the action (e.g. @claude). Only used for issue assignment                        | No       | -         |
-| `assignee_trigger`             | The assignee username that triggers the action (e.g. @claude). Only used for issue assignment                                                                                  | No       | -             |
+| `label_trigger`                | The label name that triggers the action when applied to an issue (e.g. "claude")                                     | No       | -         |
-| `label_trigger`                | The label name that triggers the action when applied to an issue (e.g. "claude")                                                                                               | No       | -             |
+| `trigger_phrase`               | The trigger phrase to look for in comments, issue/PR bodies, and issue titles                                        | No       | `@claude` |
-| `trigger_phrase`               | The trigger phrase to look for in comments, issue/PR bodies, and issue titles                                                                                                  | No       | `@claude`     |
+| `branch_prefix`                | The prefix to use for Claude branches (defaults to 'claude/', use 'claude-' for dash format)                         | No       | `claude/` |
-| `branch_prefix`                | The prefix to use for Claude branches (defaults to 'claude/', use 'claude-' for dash format)                                                                                   | No       | `claude/`     |
+| `settings`                     | Claude Code settings as JSON string or path to settings JSON file                                                    | No       | ""        |
-| `settings`                     | Claude Code settings as JSON string or path to settings JSON file                                                                                                              | No       | ""            |
+| `additional_permissions`       | Additional permissions to enable. Currently supports 'actions: read' for viewing workflow results                    | No       | ""        |
-| `additional_permissions`       | Additional permissions to enable. Currently supports 'actions: read' for viewing workflow results                                                                              | No       | ""            |
+| `experimental_allowed_domains` | Restrict network access to these domains only (newline-separated).                                                   | No       | ""        |
-| `experimental_allowed_domains` | Restrict network access to these domains only (newline-separated).                                                                                                             | No       | ""            |
+| `use_commit_signing`           | Enable commit signing using GitHub's commit signature verification. When false, Claude uses standard git commands    | No       | `false`   |
-| `use_commit_signing`           | Enable commit signing using GitHub's commit signature verification. When false, Claude uses standard git commands                                                              | No       | `false`       |
+| `allowed_bots`                 | Comma-separated list of allowed bot usernames, or '\*' to allow all bots. Empty string (default) allows no bots      | No       | ""        |
-| `bot_id`                       | GitHub user ID to use for git operations (defaults to Claude's bot ID)                                                                                                         | No       | `41898282`    |
-| `bot_name`                     | GitHub username to use for git operations (defaults to Claude's bot name)                                                                                                      | No       | `claude[bot]` |
-| `allowed_bots`                 | Comma-separated list of allowed bot usernames, or '\*' to allow all bots. Empty string (default) allows no bots                                                                | No       | ""            |
-| `allowed_non_write_users`      | **⚠️ RISKY**: Comma-separated list of usernames to allow without write permissions, or '\*' for all users. Only works with `github_token` input. See [Security](./security.md) | No       | ""            |
 
 ### Deprecated Inputs
 
@@ -143,11 +139,7 @@ For a comprehensive guide on migrating from v0.x to v1.0, including step-by-step
 ```yaml
 - uses: anthropics/claude-code-action@v1
   with:
-    prompt: |
+    prompt: "Update the API documentation"
-      REPO: ${{ github.repository }}
-      PR NUMBER: ${{ github.event.pull_request.number }}
-
-      Update the API documentation to reflect changes in this PR
     anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
     claude_args: |
       --model claude-4-0-sonnet-20250805

examples/auto-fix-ci-signed/auto-fix-ci-signed.yml

@@ -0,0 +1,97 @@
+name: Auto Fix CI Failures (Signed Commits)
+
+on:
+  workflow_run:
+    workflows: ["CI"]
+    types:
+      - completed
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: read
+  issues: write
+  id-token: write # Required for OIDC token exchange
+
+jobs:
+  auto-fix-signed:
+    if: |
+      github.event.workflow_run.conclusion == 'failure' &&
+      github.event.workflow_run.pull_requests[0] &&
+      !startsWith(github.event.workflow_run.head_branch, 'claude-auto-fix-ci-signed-')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_branch }}
+          fetch-depth: 0
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Generate fix branch name
+        id: branch
+        run: |
+          BRANCH_NAME="claude-auto-fix-ci-signed-${{ github.event.workflow_run.head_branch }}-${{ github.run_id }}"
+          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          # Don't create branch locally - MCP tools will create it via API
+          echo "Generated branch name: $BRANCH_NAME (will be created by MCP tools)"
+
+      - name: Get CI failure details
+        id: failure_details
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const run = await github.rest.actions.getWorkflowRun({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: ${{ github.event.workflow_run.id }}
+            });
+
+            const jobs = await github.rest.actions.listJobsForWorkflowRun({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              run_id: ${{ github.event.workflow_run.id }}
+            });
+
+            const failedJobs = jobs.data.jobs.filter(job => job.conclusion === 'failure');
+
+            let errorLogs = [];
+            for (const job of failedJobs) {
+              const logs = await github.rest.actions.downloadJobLogsForWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                job_id: job.id
+              });
+              errorLogs.push({
+                jobName: job.name,
+                logs: logs.data
+              });
+            }
+
+            return {
+              runUrl: run.data.html_url,
+              failedJobs: failedJobs.map(j => j.name),
+              errorLogs: errorLogs
+            };
+
+      - name: Fix CI failures with Claude (Signed Commits)
+        id: claude
+        uses: anthropics/claude-code-action@v1-dev
+        env:
+          CLAUDE_BRANCH: ${{ steps.branch.outputs.branch_name }}
+          BASE_BRANCH: ${{ github.event.workflow_run.head_branch }}
+        with:
+          prompt: |
+            /fix-ci-signed 
+            Failed CI Run: ${{ fromJSON(steps.failure_details.outputs.result).runUrl }}
+            Failed Jobs: ${{ join(fromJSON(steps.failure_details.outputs.result).failedJobs, ', ') }}
+            PR Number: ${{ github.event.workflow_run.pull_requests[0].number }}
+            Branch Name: ${{ steps.branch.outputs.branch_name }}
+            Base Branch: ${{ github.event.workflow_run.head_branch }}
+            Repository: ${{ github.repository }}
+
+            Error logs:
+            ${{ toJSON(fromJSON(steps.failure_details.outputs.result).errorLogs) }}
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          use_commit_signing: true
+          claude_args: "--allowedTools 'Edit,MultiEdit,Write,Read,Glob,Grep,LS,Bash(bun:*),Bash(npm:*),Bash(npx:*),Bash(gh:*),mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files'"

examples/auto-fix-ci-signed/commands/fix-ci-signed.md

@@ -0,0 +1,148 @@
+---
+description: Analyze and fix CI failures with signed commits using MCP tools
+allowed_tools: Edit,MultiEdit,Write,Read,Glob,Grep,LS,Bash(bun:*),Bash(npm:*),Bash(npx:*),Bash(gh:*),mcp__github_file_ops__commit_files,mcp__github_file_ops__delete_files
+---
+
+# Fix CI Failures with Signed Commits
+
+You are tasked with analyzing CI failure logs and fixing the issues using MCP tools for signed commits. Follow these steps:
+
+## Context Provided
+
+$ARGUMENTS
+
+## Important Context Information
+
+Look for these key pieces of information in the arguments:
+
+- **Failed CI Run URL**: Link to the failed CI run
+- **Failed Jobs**: List of jobs that failed
+- **PR Number**: The PR number to comment on
+- **Branch Name**: The fix branch you're working on
+- **Base Branch**: The original PR branch
+- **Error logs**: Detailed logs from failed jobs
+
+## CRITICAL: Use MCP Tools for Git Operations
+
+**IMPORTANT**: You MUST use MCP tools for all git operations to ensure commits are properly signed. DO NOT use `git` commands directly via Bash.
+
+- Use `mcp__github_file_ops__commit_files` to commit and push changes
+- Use `mcp__github_file_ops__delete_files` to delete files
+
+## Step 1: Analyze the Failure
+
+Parse the provided CI failure information to understand:
+
+- Which jobs failed and why
+- The specific error messages and stack traces
+- Whether failures are test-related, build-related, or linting issues
+
+## Step 2: Search and Understand the Codebase
+
+Use MCP search tools to locate the failing code:
+
+- Use `mcp_github_file_ops_server__search_files` or `mcp_github_file_ops_server__file_search` to find failing test names or functions
+- Use `mcp_github_file_ops_server__read_file` to read source files mentioned in error messages
+- Review related configuration files (package.json, tsconfig.json, etc.)
+
+## Step 3: Apply Targeted Fixes
+
+Make minimal, focused changes:
+
+- **For test failures**: Determine if the test or implementation needs fixing
+- **For type errors**: Fix type definitions or correct the code logic
+- **For linting issues**: Apply formatting using the project's tools
+- **For build errors**: Resolve dependency or configuration issues
+- **For missing imports**: Add the necessary imports or install packages
+
+Requirements:
+
+- Only fix the actual CI failures, avoid unrelated changes
+- Follow existing code patterns and conventions
+- Ensure changes are production-ready, not temporary hacks
+- Preserve existing functionality while fixing issues
+
+## Step 4: Verify Fixes Locally
+
+Run available verification commands using Bash:
+
+- Execute the failing tests locally to confirm they pass
+- Run the project's lint command (check package.json for scripts)
+- Run type checking if available
+- Execute any build commands to ensure compilation succeeds
+
+## Step 5: Commit and Push Changes Using MCP
+
+**CRITICAL**: You MUST use MCP tools for committing and pushing:
+
+1. Prepare all your file changes (using Edit/MultiEdit/Write tools as needed)
+2. **Use `mcp__github_file_ops__commit_files` to commit and push all changes**
+   - Pass the file paths you've edited in the `files` array
+   - Set `message` to describe the specific fixes (e.g., "Fix CI failures: remove syntax errors and format code")
+   - The MCP tool will automatically create the branch specified in "Branch Name:" from the context and push signed commits
+
+**IMPORTANT**: The MCP tool will create the branch from the context automatically. The branch name from "Branch Name:" in the context will be used.
+
+Example usage:
+
+```
+mcp__github_file_ops__commit_files with:
+- files: ["src/utils/retry.ts", "src/other/file.ts"]  // List of file paths you edited
+- message: "Fix CI failures: [describe specific fixes]"
+```
+
+Note: The branch will be created from the Base Branch specified in the context.
+
+## Step 6: Create PR Comment (REQUIRED - DO NOT SKIP)
+
+**CRITICAL: You MUST create a PR comment after pushing. This step is MANDATORY.**
+
+After successfully pushing the fixes, you MUST create a comment on the original PR to notify about the auto-fix. DO NOT end the task without completing this step.
+
+1. Extract the PR number from the context provided in arguments (look for "PR Number:" in the context)
+2. **MANDATORY**: Execute the gh CLI command below to create the comment
+3. Verify the comment was created successfully
+
+**YOU MUST RUN THIS COMMAND** (replace placeholders with actual values from context):
+
+```bash
+gh pr comment PR_NUMBER --body "## 🤖 CI Auto-Fix Available (Signed Commits)
+
+Claude has analyzed the CI failures and prepared fixes with signed commits.
+
+[**→ Create pull request to fix CI**](https://github.com/OWNER/REPO/compare/BASE_BRANCH...FIX_BRANCH?quick_pull=1)
+
+_This fix was generated automatically based on the [failed CI run](FAILED_CI_RUN_URL)._"
+```
+
+**IMPORTANT REPLACEMENTS YOU MUST MAKE:**
+
+- Replace `PR_NUMBER` with the actual PR number from "PR Number:" in context
+- Replace `OWNER/REPO` with the repository from "Repository:" in context
+- Replace `BASE_BRANCH` with the branch from "Base Branch:" in context
+- Replace `FIX_BRANCH` with the branch from "Branch Name:" in context
+- Replace `FAILED_CI_RUN_URL` with the URL from "Failed CI Run:" in context
+
+**DO NOT SKIP THIS STEP. The task is NOT complete until the PR comment is created.**
+
+## Step 7: Final Verification
+
+**BEFORE CONSIDERING THE TASK COMPLETE**, verify you have:
+
+1. ✅ Fixed all CI failures
+2. ✅ Committed the changes using `mcp_github_file_ops_server__push_files`
+3. ✅ Verified the branch was pushed successfully
+4. ✅ **CREATED THE PR COMMENT using `gh pr comment` command from Step 6**
+
+If you have NOT created the PR comment, go back to Step 6 and execute the command.
+
+## Important Guidelines
+
+- Always use MCP tools for git operations to ensure proper commit signing
+- Focus exclusively on fixing the reported CI failures
+- Maintain code quality and follow the project's established patterns
+- If a fix requires significant refactoring, document why it's necessary
+- When multiple solutions exist, choose the simplest one that maintains code quality
+- **THE TASK IS NOT COMPLETE WITHOUT THE PR COMMENT**
+
+Begin by analyzing the failure details provided above.

examples/auto-fix-ci/auto-fix-ci.yml

@@ -80,7 +80,7 @@ jobs:
 
       - name: Fix CI failures with Claude
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           prompt: |
             /fix-ci 

examples/auto-fix-ci/commands/fix-ci.md

@@ -0,0 +1,127 @@
+---
+description: Analyze and fix CI failures by examining logs and making targeted fixes
+allowed_tools: Edit,MultiEdit,Write,Read,Glob,Grep,LS,Bash(git:*),Bash(bun:*),Bash(npm:*),Bash(npx:*),Bash(gh:*)
+---
+
+# Fix CI Failures
+
+You are tasked with analyzing CI failure logs and fixing the issues. Follow these steps:
+
+## Context Provided
+
+$ARGUMENTS
+
+## Important Context Information
+
+Look for these key pieces of information in the arguments:
+
+- **Failed CI Run URL**: Link to the failed CI run
+- **Failed Jobs**: List of jobs that failed
+- **PR Number**: The PR number to comment on
+- **Branch Name**: The fix branch you're working on
+- **Base Branch**: The original PR branch
+- **Error logs**: Detailed logs from failed jobs
+
+## Step 1: Analyze the Failure
+
+Parse the provided CI failure information to understand:
+
+- Which jobs failed and why
+- The specific error messages and stack traces
+- Whether failures are test-related, build-related, or linting issues
+
+## Step 2: Search and Understand the Codebase
+
+Use search tools to locate the failing code:
+
+- Search for the failing test names or functions
+- Find the source files mentioned in error messages
+- Review related configuration files (package.json, tsconfig.json, etc.)
+
+## Step 3: Apply Targeted Fixes
+
+Make minimal, focused changes:
+
+- **For test failures**: Determine if the test or implementation needs fixing
+- **For type errors**: Fix type definitions or correct the code logic
+- **For linting issues**: Apply formatting using the project's tools
+- **For build errors**: Resolve dependency or configuration issues
+- **For missing imports**: Add the necessary imports or install packages
+
+Requirements:
+
+- Only fix the actual CI failures, avoid unrelated changes
+- Follow existing code patterns and conventions
+- Ensure changes are production-ready, not temporary hacks
+- Preserve existing functionality while fixing issues
+
+## Step 4: Verify Fixes Locally
+
+Run available verification commands:
+
+- Execute the failing tests locally to confirm they pass
+- Run the project's lint command (check package.json for scripts)
+- Run type checking if available
+- Execute any build commands to ensure compilation succeeds
+
+## Step 5: Commit and Push Changes
+
+After applying ALL fixes:
+
+1. Stage all modified files with `git add -A`
+2. Commit with: `git commit -m "Fix CI failures: [describe specific fixes]"`
+3. Document which CI jobs/tests were addressed
+4. **CRITICAL**: Push the branch with `git push origin HEAD` - You MUST push the branch after committing
+
+## Step 6: Create PR Comment (REQUIRED - DO NOT SKIP)
+
+**CRITICAL: You MUST create a PR comment after pushing. This step is MANDATORY.**
+
+After successfully pushing the fixes, you MUST create a comment on the original PR to notify about the auto-fix. DO NOT end the task without completing this step.
+
+1. Extract the PR number from the context provided in arguments (look for "PR Number:" in the context)
+2. **MANDATORY**: Execute the gh CLI command below to create the comment
+3. Verify the comment was created successfully
+
+**YOU MUST RUN THIS COMMAND** (replace placeholders with actual values from context):
+
+```bash
+gh pr comment PR_NUMBER --body "## 🤖 CI Auto-Fix Available
+
+Claude has analyzed the CI failures and prepared fixes.
+
+[**→ Create pull request to fix CI**](https://github.com/OWNER/REPO/compare/BASE_BRANCH...FIX_BRANCH?quick_pull=1)
+
+_This fix was generated automatically based on the [failed CI run](FAILED_CI_RUN_URL)._"
+```
+
+**IMPORTANT REPLACEMENTS YOU MUST MAKE:**
+
+- Replace `PR_NUMBER` with the actual PR number from "PR Number:" in context
+- Replace `OWNER/REPO` with the repository from "Repository:" in context
+- Replace `BASE_BRANCH` with the branch from "Base Branch:" in context
+- Replace `FIX_BRANCH` with the branch from "Branch Name:" in context
+- Replace `FAILED_CI_RUN_URL` with the URL from "Failed CI Run:" in context
+
+**DO NOT SKIP THIS STEP. The task is NOT complete until the PR comment is created.**
+
+## Step 7: Final Verification
+
+**BEFORE CONSIDERING THE TASK COMPLETE**, verify you have:
+
+1. ✅ Fixed all CI failures
+2. ✅ Committed the changes
+3. ✅ Pushed the branch with `git push origin HEAD`
+4. ✅ **CREATED THE PR COMMENT using `gh pr comment` command from Step 6**
+
+If you have NOT created the PR comment, go back to Step 6 and execute the command.
+
+## Important Guidelines
+
+- Focus exclusively on fixing the reported CI failures
+- Maintain code quality and follow the project's established patterns
+- If a fix requires significant refactoring, document why it's necessary
+- When multiple solutions exist, choose the simplest one that maintains code quality
+- **THE TASK IS NOT COMPLETE WITHOUT THE PR COMMENT**
+
+Begin by analyzing the failure details provided above.

examples/claude-args-example.yml

@@ -0,0 +1,30 @@
+name: Claude Args Example
+
+on:
+  workflow_dispatch:
+    inputs:
+      prompt:
+        description: "Prompt for Claude"
+        required: true
+        type: string
+
+jobs:
+  claude-with-custom-args:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Run Claude with custom arguments
+        uses: anthropics/claude-code-action@v1-dev
+        with:
+          prompt: ${{ github.event.inputs.prompt }}
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+
+          # claude_args provides direct CLI argument control
+          # This allows full customization of Claude's behavior
+          claude_args: |
+            --max-turns 15
+            --model claude-opus-4-1-20250805
+            --allowedTools Edit,Read,Write,Bash
+            --disallowedTools WebSearch
+            --system-prompt "You are a senior engineer focused on code quality"

examples/claude-auto-review.yml

@@ -0,0 +1,48 @@
+name: Claude PR Auto Review
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+
+jobs:
+  auto-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      id-token: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+
+      - name: Automatic PR Review
+        uses: anthropics/claude-code-action@v1-dev
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          prompt: |
+            REPO: ${{ github.repository }}
+            PR NUMBER: ${{ github.event.pull_request.number }}
+
+            Please review this pull request.
+
+            Note: The PR branch is already checked out in the current working directory.
+
+            Focus on:
+            - Code quality and best practices
+            - Potential bugs or issues
+            - Performance considerations
+            - Security implications
+            - Test coverage
+            - Documentation updates if needed
+            - Verify that README.md and docs are updated for any new features or config changes
+
+            Provide constructive feedback with specific suggestions for improvement.
+            Use `gh pr comment:*` for top-level comments.
+            Use `mcp__github_inline_comment__create_inline_comment` to highlight specific areas of concern.
+            Only your GitHub comments that you post will be seen, so don't submit your review as a normal message, just as comments.
+            If the PR has already been reviewed, or there are no noteworthy changes, don't post anything.
+
+          claude_args: |
+            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*), Bash(gh pr diff:*), Bash(gh pr view:*)"

examples/claude-modes.yml

@@ -0,0 +1,54 @@
+name: Claude Automatic Mode Detection Examples
+
+on:
+  # Events for interactive mode (responds to @claude mentions)
+  issue_comment:
+    types: [created]
+  issues:
+    types: [opened, labeled]
+  pull_request:
+    types: [opened]
+  # Events for automation mode (runs with explicit prompt)
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * 0" # Weekly on Sunday
+
+jobs:
+  # Interactive Mode - Activated automatically when no prompt is provided
+  interactive-mode-example:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - uses: anthropics/claude-code-action@v1-dev
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          # Interactive mode (auto-detected when no prompt):
+          # - Scans for @claude mentions in comments, issues, and PRs
+          # - Only acts when trigger phrase is found
+          # - Creates tracking comments with progress checkboxes
+          # - Perfect for: Interactive Q&A, on-demand code changes
+
+  # Automation Mode - Activated automatically when prompt is provided
+  automation-mode-scheduled-task:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+      id-token: write
+    steps:
+      - uses: anthropics/claude-code-action@v1-dev
+        with:
+          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
+          prompt: |
+            Check for outdated dependencies and security vulnerabilities.
+            Create an issue if any critical problems are found.
+          # Automation mode (auto-detected when prompt provided):
+          # - Works with any GitHub event
+          # - Executes immediately without waiting for @claude mentions
+          # - No tracking comments created
+          # - Perfect for: scheduled maintenance, automated reviews, CI/CD tasks

examples/claude-pr-path-specific.yml

@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 1
 
       - name: Claude Code Review
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |

examples/claude-review-from-author.yml

@@ -23,7 +23,7 @@ jobs:
           fetch-depth: 1
 
       - name: Review PR from Specific Author
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |

examples/claude.yml

@@ -32,10 +32,14 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
+          # This is an optional setting that allows Claude to read CI results on PRs
+          additional_permissions: |
+            actions: read
+
           # Optional: Customize the trigger phrase (default: @claude)
           # trigger_phrase: "/claude"
 

examples/issue-deduplication.yml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 1
 
       - name: Check for duplicate issues
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           prompt: |
             Analyze this new issue and check if it's a duplicate of existing issues in the repository.

examples/issue-triage.yml

@@ -18,7 +18,7 @@ jobs:
           fetch-depth: 0
 
       - name: Triage issue with Claude
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           prompt: |
             You're an issue triage assistant for GitHub issues. Your task is to analyze the issue and select appropriate labels from the provided list.
@@ -71,6 +71,5 @@ jobs:
             - It's okay to not add any labels if none are clearly applicable
 
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-          github_token: ${{ secrets.GITHUB_TOKEN }}
           claude_args: |
             --allowedTools "Bash(gh label list),mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues"

examples/pr-review-comprehensive.yml

@@ -1,74 +0,0 @@
-name: PR Review with Progress Tracking
-
-# This example demonstrates how to use the track_progress feature to get
-# visual progress tracking for PR reviews, similar to v0.x agent mode.
-
-on:
-  pull_request:
-    types: [opened, synchronize, ready_for_review, reopened]
-
-jobs:
-  review-with-tracking:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      pull-requests: write
-      id-token: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-
-      - name: PR Review with Progress Tracking
-        uses: anthropics/claude-code-action@v1
-        with:
-          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
-
-          # Enable progress tracking
-          track_progress: true
-
-          # Your custom review instructions
-          prompt: |
-            REPO: ${{ github.repository }}
-            PR NUMBER: ${{ github.event.pull_request.number }}
-
-            Perform a comprehensive code review with the following focus areas:
-
-            1. **Code Quality**
-               - Clean code principles and best practices
-               - Proper error handling and edge cases
-               - Code readability and maintainability
-
-            2. **Security**
-               - Check for potential security vulnerabilities
-               - Validate input sanitization
-               - Review authentication/authorization logic
-
-            3. **Performance**
-               - Identify potential performance bottlenecks
-               - Review database queries for efficiency
-               - Check for memory leaks or resource issues
-
-            4. **Testing**
-               - Verify adequate test coverage
-               - Review test quality and edge cases
-               - Check for missing test scenarios
-
-            5. **Documentation**
-               - Ensure code is properly documented
-               - Verify README updates for new features
-               - Check API documentation accuracy
-
-            Provide detailed feedback using inline comments for specific issues.
-            Use top-level comments for general observations or praise.
-
-          # Tools for comprehensive PR review
-          claude_args: |
-            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"
-
-# When track_progress is enabled:
-# - Creates a tracking comment with progress checkboxes
-# - Includes all PR context (comments, attachments, images)
-# - Updates progress as the review proceeds
-# - Marks as completed when done

examples/workflow-dispatch-agent.yml

@@ -28,13 +28,10 @@ jobs:
           fetch-depth: 2 # Need at least 2 commits to analyze the latest
 
       - name: Run Claude Analysis
-        uses: anthropics/claude-code-action@v1
+        uses: anthropics/claude-code-action@v1-dev
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |
-            REPO: ${{ github.repository }}
-            BRANCH: ${{ github.ref_name }}
-
             Analyze the latest commit in this repository.
 
             ${{ github.event.inputs.analysis_type == 'summarize-commit' && 'Task: Provide a clear, concise summary of what changed in the latest commit. Include the commit message, files changed, and the purpose of the changes.' || '' }}

src/entrypoints/prepare.ts

@@ -30,13 +30,9 @@ async function run() {
 
     // Step 3: Check write permissions (only for entity contexts)
     if (isEntityContext(context)) {
-      // Check if github_token was provided as input (not from app)
-      const githubTokenProvided = !!process.env.OVERRIDE_GITHUB_TOKEN;
       const hasWritePermissions = await checkWritePermissions(
         octokit.rest,
         context,
-        context.inputs.allowedNonWriteUsers,
-        githubTokenProvided,
       );
       if (!hasWritePermissions) {
         throw new Error(

src/github/constants.ts

@@ -1,13 +0,0 @@
-/**
- * GitHub-related constants used throughout the application
- */
-
-/**
- * Claude App bot user ID
- */
-export const CLAUDE_APP_BOT_ID = 41898282;
-
-/**
- * Claude bot username
- */
-export const CLAUDE_BOT_LOGIN = "claude[bot]";

src/github/context.ts

@@ -8,7 +8,6 @@ import type {
   PullRequestReviewCommentEvent,
   WorkflowRunEvent,
 } from "@octokit/webhooks-types";
-import { CLAUDE_APP_BOT_ID, CLAUDE_BOT_LOGIN } from "./constants";
 // Custom types for GitHub Actions events that aren't webhooks
 export type WorkflowDispatchEvent = {
   action?: never;
@@ -26,20 +25,6 @@ export type WorkflowDispatchEvent = {
   workflow: string;
 };
 
-export type RepositoryDispatchEvent = {
-  action: string;
-  client_payload?: Record<string, any>;
-  repository: {
-    name: string;
-    owner: {
-      login: string;
-    };
-  };
-  sender: {
-    login: string;
-  };
-};
-
 export type ScheduleEvent = {
   action?: never;
   schedule?: string;
@@ -62,7 +47,6 @@ const ENTITY_EVENT_NAMES = [
 
 const AUTOMATION_EVENT_NAMES = [
   "workflow_dispatch",
-  "repository_dispatch",
   "schedule",
   "workflow_run",
 ] as const;
@@ -90,10 +74,7 @@ type BaseContext = {
     branchPrefix: string;
     useStickyComment: boolean;
     useCommitSigning: boolean;
-    botId: string;
-    botName: string;
     allowedBots: string;
-    allowedNonWriteUsers: string;
     trackProgress: boolean;
   };
 };
@@ -111,14 +92,10 @@ export type ParsedGitHubContext = BaseContext & {
   isPR: boolean;
 };
 
-// Context for automation events (workflow_dispatch, repository_dispatch, schedule, workflow_run)
+// Context for automation events (workflow_dispatch, schedule, workflow_run)
 export type AutomationContext = BaseContext & {
   eventName: AutomationEventName;
-  payload:
+  payload: WorkflowDispatchEvent | ScheduleEvent | WorkflowRunEvent;
-    | WorkflowDispatchEvent
-    | RepositoryDispatchEvent
-    | ScheduleEvent
-    | WorkflowRunEvent;
 };
 
 // Union type for all contexts
@@ -145,10 +122,7 @@ export function parseGitHubContext(): GitHubContext {
       branchPrefix: process.env.BRANCH_PREFIX ?? "claude/",
       useStickyComment: process.env.USE_STICKY_COMMENT === "true",
       useCommitSigning: process.env.USE_COMMIT_SIGNING === "true",
-      botId: process.env.BOT_ID ?? String(CLAUDE_APP_BOT_ID),
-      botName: process.env.BOT_NAME ?? CLAUDE_BOT_LOGIN,
       allowedBots: process.env.ALLOWED_BOTS ?? "",
-      allowedNonWriteUsers: process.env.ALLOWED_NON_WRITE_USERS ?? "",
       trackProgress: process.env.TRACK_PROGRESS === "true",
     },
   };
@@ -211,13 +185,6 @@ export function parseGitHubContext(): GitHubContext {
         payload: context.payload as unknown as WorkflowDispatchEvent,
       };
     }
-    case "repository_dispatch": {
-      return {
-        ...commonFields,
-        eventName: "repository_dispatch",
-        payload: context.payload as unknown as RepositoryDispatchEvent,
-      };
-    }
     case "schedule": {
       return {
         ...commonFields,

src/github/data/fetcher.ts

@@ -48,7 +48,7 @@ export function extractTriggerTimestamp(
  * @param triggerTime - ISO timestamp of when the trigger comment was created
  * @returns Filtered array of comments that were created and last edited before trigger time
  */
-export function filterCommentsToTriggerTime<
+function filterCommentsToTriggerTime<
   T extends { createdAt: string; updatedAt?: string; lastEditedAt?: string },
 >(comments: T[], triggerTime: string | undefined): T[] {
   if (!triggerTime) return comments;
@@ -56,9 +56,10 @@ export function filterCommentsToTriggerTime<
   const triggerTimestamp = new Date(triggerTime).getTime();
 
   return comments.filter((comment) => {
-    // Comment must have been created before trigger (not at or after)
+    // Comment must have been created before trigger
     const createdTimestamp = new Date(comment.createdAt).getTime();
-    if (createdTimestamp >= triggerTimestamp) {
+    if (createdTimestamp > triggerTimestamp) {
+      console.log("filtering for creation time", comment);
       return false;
     }
 
@@ -67,7 +68,8 @@ export function filterCommentsToTriggerTime<
     const lastEditTime = comment.lastEditedAt || comment.updatedAt;
     if (lastEditTime) {
       const lastEditTimestamp = new Date(lastEditTime).getTime();
-      if (lastEditTimestamp >= triggerTimestamp) {
+      if (lastEditTimestamp > triggerTimestamp) {
+        console.log("filtering for last edit time", comment);
         return false;
       }
     }
@@ -80,7 +82,7 @@ export function filterCommentsToTriggerTime<
  * Filters reviews to only include those that existed in their final state before the trigger time.
  * Similar to filterCommentsToTriggerTime but for GitHubReview objects which use submittedAt instead of createdAt.
  */
-export function filterReviewsToTriggerTime<
+function filterReviewsToTriggerTime<
   T extends { submittedAt: string; updatedAt?: string; lastEditedAt?: string },
 >(reviews: T[], triggerTime: string | undefined): T[] {
   if (!triggerTime) return reviews;
@@ -88,9 +90,9 @@ export function filterReviewsToTriggerTime<
   const triggerTimestamp = new Date(triggerTime).getTime();
 
   return reviews.filter((review) => {
-    // Review must have been submitted before trigger (not at or after)
+    // Review must have been submitted before trigger
     const submittedTimestamp = new Date(review.submittedAt).getTime();
-    if (submittedTimestamp >= triggerTimestamp) {
+    if (submittedTimestamp > triggerTimestamp) {
       return false;
     }
 
@@ -98,7 +100,7 @@ export function filterReviewsToTriggerTime<
     const lastEditTime = review.lastEditedAt || review.updatedAt;
     if (lastEditTime) {
       const lastEditTimestamp = new Date(lastEditTime).getTime();
-      if (lastEditTimestamp >= triggerTimestamp) {
+      if (lastEditTimestamp > triggerTimestamp) {
         return false;
       }
     }

src/github/operations/git-config.ts

@@ -17,7 +17,7 @@ type GitUser = {
 export async function configureGitAuth(
   githubToken: string,
   context: GitHubContext,
-  user: GitUser,
+  user: GitUser | null,
 ) {
   console.log("Configuring git authentication for non-signing mode");
 
@@ -28,14 +28,20 @@ export async function configureGitAuth(
       ? "users.noreply.github.com"
       : `users.noreply.${serverUrl.hostname}`;
 
-  // Configure git user
+  // Configure git user based on the comment creator
   console.log("Configuring git user...");
-  const botName = user.login;
+  if (user) {
-  const botId = user.id;
+    const botName = user.login;
-  console.log(`Setting git user as ${botName}...`);
+    const botId = user.id;
-  await $`git config user.name "${botName}"`;
+    console.log(`Setting git user as ${botName}...`);
-  await $`git config user.email "${botId}+${botName}@${noreplyDomain}"`;
+    await $`git config user.name "${botName}"`;
-  console.log(`✓ Set git user as ${botName}`);
+    await $`git config user.email "${botId}+${botName}@${noreplyDomain}"`;
+    console.log(`✓ Set git user as ${botName}`);
+  } else {
+    console.log("No user data in comment, using default bot user");
+    await $`git config user.name "github-actions[bot]"`;
+    await $`git config user.email "41898282+github-actions[bot]@${noreplyDomain}"`;
+  }
 
   // Remove the authorization header that actions/checkout sets
   console.log("Removing existing git authentication headers...");

src/github/validation/permissions.ts

@@ -6,43 +6,17 @@ import type { Octokit } from "@octokit/rest";
  * Check if the actor has write permissions to the repository
  * @param octokit - The Octokit REST client
  * @param context - The GitHub context
- * @param allowedNonWriteUsers - Comma-separated list of users allowed without write permissions, or '*' for all
- * @param githubTokenProvided - Whether github_token was provided as input (not from app)
  * @returns true if the actor has write permissions, false otherwise
  */
 export async function checkWritePermissions(
   octokit: Octokit,
   context: ParsedGitHubContext,
-  allowedNonWriteUsers?: string,
-  githubTokenProvided?: boolean,
 ): Promise<boolean> {
   const { repository, actor } = context;
 
   try {
     core.info(`Checking permissions for actor: ${actor}`);
 
-    // Check if we should bypass permission checks for this user
-    if (allowedNonWriteUsers && githubTokenProvided) {
-      const allowedUsers = allowedNonWriteUsers.trim();
-      if (allowedUsers === "*") {
-        core.warning(
-          `⚠️ SECURITY WARNING: Bypassing write permission check for ${actor} due to allowed_non_write_users='*'. This should only be used for workflows with very limited permissions.`,
-        );
-        return true;
-      } else if (allowedUsers) {
-        const allowedUserList = allowedUsers
-          .split(",")
-          .map((u) => u.trim())
-          .filter((u) => u.length > 0);
-        if (allowedUserList.includes(actor)) {
-          core.warning(
-            `⚠️ SECURITY WARNING: Bypassing write permission check for ${actor} due to allowed_non_write_users configuration. This should only be used for workflows with very limited permissions.`,
-          );
-          return true;
-        }
-      }
-    }
-
     // Check if the actor is a GitHub App (bot user)
     if (actor.endsWith("[bot]")) {
       core.info(`Actor is a GitHub App: ${actor}`);

src/mcp/install-mcp-server.ts

@@ -63,9 +63,6 @@ export async function prepareMcpConfig(
   try {
     const allowedToolsList = allowedTools || [];
 
-    // Detect if we're in agent mode (explicit prompt provided)
-    const isAgentMode = !!context.inputs?.prompt;
-
     const hasGitHubMcpTools = allowedToolsList.some((tool) =>
       tool.startsWith("mcp__github__"),
     );
@@ -74,36 +71,26 @@ export async function prepareMcpConfig(
       tool.startsWith("mcp__github_inline_comment__"),
     );
 
-    const hasGitHubCITools = allowedToolsList.some((tool) =>
-      tool.startsWith("mcp__github_ci__"),
-    );
-
     const baseMcpConfig: { mcpServers: Record<string, unknown> } = {
       mcpServers: {},
     };
 
-    // Include comment server:
+    // Always include comment server for updating Claude comments
-    // - Always in tag mode (for updating Claude comments)
+    baseMcpConfig.mcpServers.github_comment = {
-    // - Only with explicit tools in agent mode
+      command: "bun",
-    const shouldIncludeCommentServer = !isAgentMode;
+      args: [
-
+        "run",
-    if (shouldIncludeCommentServer) {
+        `${process.env.GITHUB_ACTION_PATH}/src/mcp/github-comment-server.ts`,
-      baseMcpConfig.mcpServers.github_comment = {
+      ],
-        command: "bun",
+      env: {
-        args: [
+        GITHUB_TOKEN: githubToken,
-          "run",
+        REPO_OWNER: owner,
-          `${process.env.GITHUB_ACTION_PATH}/src/mcp/github-comment-server.ts`,
+        REPO_NAME: repo,
-        ],
+        ...(claudeCommentId && { CLAUDE_COMMENT_ID: claudeCommentId }),
-        env: {
+        GITHUB_EVENT_NAME: process.env.GITHUB_EVENT_NAME || "",
-          GITHUB_TOKEN: githubToken,
+        GITHUB_API_URL: GITHUB_API_URL,
-          REPO_OWNER: owner,
+      },
-          REPO_NAME: repo,
+    };
-          ...(claudeCommentId && { CLAUDE_COMMENT_ID: claudeCommentId }),
-          GITHUB_EVENT_NAME: process.env.GITHUB_EVENT_NAME || "",
-          GITHUB_API_URL: GITHUB_API_URL,
-        },
-      };
-    }
 
     // Include file ops server when commit signing is enabled
     if (context.inputs.useCommitSigning) {
@@ -149,17 +136,10 @@ export async function prepareMcpConfig(
       };
     }
 
-    // CI server is included when:
+    // CI server is included when we have a workflow token and context is a PR
-    // - In tag mode: when we have a workflow token and context is a PR
-    // - In agent mode: same conditions PLUS explicit CI tools in allowedTools
     const hasWorkflowToken = !!process.env.DEFAULT_WORKFLOW_TOKEN;
-    const shouldIncludeCIServer =
-      (!isAgentMode || hasGitHubCITools) &&
-      isEntityContext(context) &&
-      context.isPR &&
-      hasWorkflowToken;
 
-    if (shouldIncludeCIServer) {
+    if (isEntityContext(context) && context.isPR && hasWorkflowToken) {
       // Verify the token actually has actions:read permission
       const actuallyHasPermission = await checkActionsReadPermission(
         process.env.DEFAULT_WORKFLOW_TOKEN || "",

src/modes/agent/index.ts

@@ -77,16 +77,22 @@ export const agentMode: Mode = {
     return false;
   },
 
-  async prepare({ context, githubToken }: ModeOptions): Promise<ModeResult> {
+  async prepare({
+    context,
+    githubToken,
+    octokit,
+  }: ModeOptions): Promise<ModeResult> {
     // Configure git authentication for agent mode (same as tag mode)
     if (!context.inputs.useCommitSigning) {
-      // Use bot_id and bot_name from inputs directly
-      const user = {
-        login: context.inputs.botName,
-        id: parseInt(context.inputs.botId),
-      };
-
       try {
+        // Get the authenticated user (will be claude[bot] when using Claude App token)
+        const { data: authenticatedUser } =
+          await octokit.rest.users.getAuthenticated();
+        const user = {
+          login: authenticatedUser.login,
+          id: authenticatedUser.id,
+        };
+
         // Use the shared git configuration function
         await configureGitAuth(githubToken, context, user);
       } catch (error) {

src/modes/detector.ts

@@ -44,10 +44,6 @@ export function detectMode(context: GitHubContext): AutoDetectedMode {
 
   // Issue events
   if (isEntityContext(context) && isIssuesEvent(context)) {
-    // If prompt is provided, use agent mode (same as PR events)
-    if (context.inputs.prompt) {
-      return "agent";
-    }
     // Check for @claude mentions or labels/assignees
     if (checkContainsTrigger(context)) {
       return "tag";

src/modes/tag/index.ts

@@ -89,14 +89,8 @@ export const tagMode: Mode = {
 
     // Configure git authentication if not using commit signing
     if (!context.inputs.useCommitSigning) {
-      // Use bot_id and bot_name from inputs directly
-      const user = {
-        login: context.inputs.botName,
-        id: parseInt(context.inputs.botId),
-      };
-
       try {
-        await configureGitAuth(githubToken, context, user);
+        await configureGitAuth(githubToken, context, commentData.user);
       } catch (error) {
         console.error("Failed to configure git authentication:", error);
         throw error;

test/data-fetcher.test.ts

@@ -1,699 +0,0 @@
-import { describe, expect, it, jest } from "bun:test";
-import {
-  extractTriggerTimestamp,
-  fetchGitHubData,
-  filterCommentsToTriggerTime,
-  filterReviewsToTriggerTime,
-} from "../src/github/data/fetcher";
-import {
-  createMockContext,
-  mockIssueCommentContext,
-  mockPullRequestReviewContext,
-  mockPullRequestReviewCommentContext,
-  mockPullRequestOpenedContext,
-  mockIssueOpenedContext,
-} from "./mockContext";
-import type { GitHubComment, GitHubReview } from "../src/github/types";
-
-describe("extractTriggerTimestamp", () => {
-  it("should extract timestamp from IssueCommentEvent", () => {
-    const context = mockIssueCommentContext;
-    const timestamp = extractTriggerTimestamp(context);
-    expect(timestamp).toBe("2024-01-15T12:30:00Z");
-  });
-
-  it("should extract timestamp from PullRequestReviewEvent", () => {
-    const context = mockPullRequestReviewContext;
-    const timestamp = extractTriggerTimestamp(context);
-    expect(timestamp).toBe("2024-01-15T15:30:00Z");
-  });
-
-  it("should extract timestamp from PullRequestReviewCommentEvent", () => {
-    const context = mockPullRequestReviewCommentContext;
-    const timestamp = extractTriggerTimestamp(context);
-    expect(timestamp).toBe("2024-01-15T16:45:00Z");
-  });
-
-  it("should return undefined for pull_request event", () => {
-    const context = mockPullRequestOpenedContext;
-    const timestamp = extractTriggerTimestamp(context);
-    expect(timestamp).toBeUndefined();
-  });
-
-  it("should return undefined for issues event", () => {
-    const context = mockIssueOpenedContext;
-    const timestamp = extractTriggerTimestamp(context);
-    expect(timestamp).toBeUndefined();
-  });
-
-  it("should handle missing timestamp fields gracefully", () => {
-    const context = createMockContext({
-      eventName: "issue_comment",
-      payload: {
-        comment: {
-          // No created_at field
-          id: 123,
-          body: "test",
-        },
-      } as any,
-    });
-    const timestamp = extractTriggerTimestamp(context);
-    expect(timestamp).toBeUndefined();
-  });
-});
-
-describe("filterCommentsToTriggerTime", () => {
-  const createMockComment = (
-    createdAt: string,
-    updatedAt?: string,
-    lastEditedAt?: string,
-  ): GitHubComment => ({
-    id: String(Math.random()),
-    databaseId: String(Math.random()),
-    body: "Test comment",
-    author: { login: "test-user" },
-    createdAt,
-    updatedAt,
-    lastEditedAt,
-    isMinimized: false,
-  });
-
-  const triggerTime = "2024-01-15T12:00:00Z";
-
-  describe("comment creation time filtering", () => {
-    it("should include comments created before trigger time", () => {
-      const comments = [
-        createMockComment("2024-01-15T11:00:00Z"),
-        createMockComment("2024-01-15T11:30:00Z"),
-        createMockComment("2024-01-15T11:59:59Z"),
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(3);
-      expect(filtered).toEqual(comments);
-    });
-
-    it("should exclude comments created after trigger time", () => {
-      const comments = [
-        createMockComment("2024-01-15T12:00:01Z"),
-        createMockComment("2024-01-15T13:00:00Z"),
-        createMockComment("2024-01-16T00:00:00Z"),
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(0);
-    });
-
-    it("should handle exact timestamp match (at trigger time)", () => {
-      const comment = createMockComment("2024-01-15T12:00:00Z");
-      const filtered = filterCommentsToTriggerTime([comment], triggerTime);
-      // Comments created exactly at trigger time should be excluded for security
-      expect(filtered.length).toBe(0);
-    });
-  });
-
-  describe("comment edit time filtering", () => {
-    it("should include comments edited before trigger time", () => {
-      const comments = [
-        createMockComment("2024-01-15T10:00:00Z", "2024-01-15T11:00:00Z"),
-        createMockComment(
-          "2024-01-15T10:00:00Z",
-          undefined,
-          "2024-01-15T11:30:00Z",
-        ),
-        createMockComment(
-          "2024-01-15T10:00:00Z",
-          "2024-01-15T11:00:00Z",
-          "2024-01-15T11:30:00Z",
-        ),
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(3);
-      expect(filtered).toEqual(comments);
-    });
-
-    it("should exclude comments edited after trigger time", () => {
-      const comments = [
-        createMockComment("2024-01-15T10:00:00Z", "2024-01-15T13:00:00Z"),
-        createMockComment(
-          "2024-01-15T10:00:00Z",
-          undefined,
-          "2024-01-15T13:00:00Z",
-        ),
-        createMockComment(
-          "2024-01-15T10:00:00Z",
-          "2024-01-15T11:00:00Z",
-          "2024-01-15T13:00:00Z",
-        ),
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(0);
-    });
-
-    it("should prioritize lastEditedAt over updatedAt", () => {
-      const comment = createMockComment(
-        "2024-01-15T10:00:00Z",
-        "2024-01-15T13:00:00Z", // updatedAt after trigger
-        "2024-01-15T11:00:00Z", // lastEditedAt before trigger
-      );
-
-      const filtered = filterCommentsToTriggerTime([comment], triggerTime);
-      // lastEditedAt takes precedence, so this should be included
-      expect(filtered.length).toBe(1);
-      expect(filtered[0]).toBe(comment);
-    });
-
-    it("should handle comments without edit timestamps", () => {
-      const comment = createMockComment("2024-01-15T10:00:00Z");
-      expect(comment.updatedAt).toBeUndefined();
-      expect(comment.lastEditedAt).toBeUndefined();
-
-      const filtered = filterCommentsToTriggerTime([comment], triggerTime);
-      expect(filtered.length).toBe(1);
-      expect(filtered[0]).toBe(comment);
-    });
-
-    it("should exclude comments edited exactly at trigger time", () => {
-      const comments = [
-        createMockComment("2024-01-15T10:00:00Z", "2024-01-15T12:00:00Z"), // updatedAt exactly at trigger
-        createMockComment(
-          "2024-01-15T10:00:00Z",
-          undefined,
-          "2024-01-15T12:00:00Z",
-        ), // lastEditedAt exactly at trigger
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(0);
-    });
-  });
-
-  describe("edge cases", () => {
-    it("should return all comments when no trigger time provided", () => {
-      const comments = [
-        createMockComment("2024-01-15T10:00:00Z"),
-        createMockComment("2024-01-15T13:00:00Z"),
-        createMockComment("2024-01-16T00:00:00Z"),
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, undefined);
-      expect(filtered.length).toBe(3);
-      expect(filtered).toEqual(comments);
-    });
-
-    it("should handle millisecond precision", () => {
-      const comments = [
-        createMockComment("2024-01-15T12:00:00.001Z"), // After trigger by 1ms
-        createMockComment("2024-01-15T11:59:59.999Z"), // Before trigger
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(1);
-      expect(filtered[0]?.createdAt).toBe("2024-01-15T11:59:59.999Z");
-    });
-
-    it("should handle various ISO timestamp formats", () => {
-      const comments = [
-        createMockComment("2024-01-15T11:00:00Z"),
-        createMockComment("2024-01-15T11:00:00.000Z"),
-        createMockComment("2024-01-15T11:00:00+00:00"),
-      ];
-
-      const filtered = filterCommentsToTriggerTime(comments, triggerTime);
-      expect(filtered.length).toBe(3);
-    });
-  });
-});
-
-describe("filterReviewsToTriggerTime", () => {
-  const createMockReview = (
-    submittedAt: string,
-    updatedAt?: string,
-    lastEditedAt?: string,
-  ): GitHubReview => ({
-    id: String(Math.random()),
-    databaseId: String(Math.random()),
-    author: { login: "reviewer" },
-    body: "Test review",
-    state: "APPROVED",
-    submittedAt,
-    updatedAt,
-    lastEditedAt,
-    comments: { nodes: [] },
-  });
-
-  const triggerTime = "2024-01-15T12:00:00Z";
-
-  describe("review submission time filtering", () => {
-    it("should include reviews submitted before trigger time", () => {
-      const reviews = [
-        createMockReview("2024-01-15T11:00:00Z"),
-        createMockReview("2024-01-15T11:30:00Z"),
-        createMockReview("2024-01-15T11:59:59Z"),
-      ];
-
-      const filtered = filterReviewsToTriggerTime(reviews, triggerTime);
-      expect(filtered.length).toBe(3);
-      expect(filtered).toEqual(reviews);
-    });
-
-    it("should exclude reviews submitted after trigger time", () => {
-      const reviews = [
-        createMockReview("2024-01-15T12:00:01Z"),
-        createMockReview("2024-01-15T13:00:00Z"),
-        createMockReview("2024-01-16T00:00:00Z"),
-      ];
-
-      const filtered = filterReviewsToTriggerTime(reviews, triggerTime);
-      expect(filtered.length).toBe(0);
-    });
-
-    it("should handle exact timestamp match", () => {
-      const review = createMockReview("2024-01-15T12:00:00Z");
-      const filtered = filterReviewsToTriggerTime([review], triggerTime);
-      // Reviews submitted exactly at trigger time should be excluded for security
-      expect(filtered.length).toBe(0);
-    });
-  });
-
-  describe("review edit time filtering", () => {
-    it("should include reviews edited before trigger time", () => {
-      const reviews = [
-        createMockReview("2024-01-15T10:00:00Z", "2024-01-15T11:00:00Z"),
-        createMockReview(
-          "2024-01-15T10:00:00Z",
-          undefined,
-          "2024-01-15T11:30:00Z",
-        ),
-        createMockReview(
-          "2024-01-15T10:00:00Z",
-          "2024-01-15T11:00:00Z",
-          "2024-01-15T11:30:00Z",
-        ),
-      ];
-
-      const filtered = filterReviewsToTriggerTime(reviews, triggerTime);
-      expect(filtered.length).toBe(3);
-      expect(filtered).toEqual(reviews);
-    });
-
-    it("should exclude reviews edited after trigger time", () => {
-      const reviews = [
-        createMockReview("2024-01-15T10:00:00Z", "2024-01-15T13:00:00Z"),
-        createMockReview(
-          "2024-01-15T10:00:00Z",
-          undefined,
-          "2024-01-15T13:00:00Z",
-        ),
-        createMockReview(
-          "2024-01-15T10:00:00Z",
-          "2024-01-15T11:00:00Z",
-          "2024-01-15T13:00:00Z",
-        ),
-      ];
-
-      const filtered = filterReviewsToTriggerTime(reviews, triggerTime);
-      expect(filtered.length).toBe(0);
-    });
-
-    it("should prioritize lastEditedAt over updatedAt", () => {
-      const review = createMockReview(
-        "2024-01-15T10:00:00Z",
-        "2024-01-15T13:00:00Z", // updatedAt after trigger
-        "2024-01-15T11:00:00Z", // lastEditedAt before trigger
-      );
-
-      const filtered = filterReviewsToTriggerTime([review], triggerTime);
-      // lastEditedAt takes precedence, so this should be included
-      expect(filtered.length).toBe(1);
-      expect(filtered[0]).toBe(review);
-    });
-
-    it("should handle reviews without edit timestamps", () => {
-      const review = createMockReview("2024-01-15T10:00:00Z");
-      expect(review.updatedAt).toBeUndefined();
-      expect(review.lastEditedAt).toBeUndefined();
-
-      const filtered = filterReviewsToTriggerTime([review], triggerTime);
-      expect(filtered.length).toBe(1);
-      expect(filtered[0]).toBe(review);
-    });
-
-    it("should exclude reviews edited exactly at trigger time", () => {
-      const reviews = [
-        createMockReview("2024-01-15T10:00:00Z", "2024-01-15T12:00:00Z"), // updatedAt exactly at trigger
-        createMockReview(
-          "2024-01-15T10:00:00Z",
-          undefined,
-          "2024-01-15T12:00:00Z",
-        ), // lastEditedAt exactly at trigger
-      ];
-
-      const filtered = filterReviewsToTriggerTime(reviews, triggerTime);
-      expect(filtered.length).toBe(0);
-    });
-  });
-
-  describe("edge cases", () => {
-    it("should return all reviews when no trigger time provided", () => {
-      const reviews = [
-        createMockReview("2024-01-15T10:00:00Z"),
-        createMockReview("2024-01-15T13:00:00Z"),
-        createMockReview("2024-01-16T00:00:00Z"),
-      ];
-
-      const filtered = filterReviewsToTriggerTime(reviews, undefined);
-      expect(filtered.length).toBe(3);
-      expect(filtered).toEqual(reviews);
-    });
-  });
-});
-
-describe("fetchGitHubData integration with time filtering", () => {
-  it("should filter comments based on trigger time when provided", async () => {
-    const mockOctokits = {
-      graphql: jest.fn().mockResolvedValue({
-        repository: {
-          issue: {
-            number: 123,
-            title: "Test Issue",
-            body: "Issue body",
-            author: { login: "author" },
-            comments: {
-              nodes: [
-                {
-                  id: "1",
-                  databaseId: "1",
-                  body: "Comment before trigger",
-                  author: { login: "user1" },
-                  createdAt: "2024-01-15T11:00:00Z",
-                  updatedAt: "2024-01-15T11:00:00Z",
-                },
-                {
-                  id: "2",
-                  databaseId: "2",
-                  body: "Comment after trigger",
-                  author: { login: "user2" },
-                  createdAt: "2024-01-15T13:00:00Z",
-                  updatedAt: "2024-01-15T13:00:00Z",
-                },
-                {
-                  id: "3",
-                  databaseId: "3",
-                  body: "Comment before but edited after",
-                  author: { login: "user3" },
-                  createdAt: "2024-01-15T11:00:00Z",
-                  updatedAt: "2024-01-15T13:00:00Z",
-                  lastEditedAt: "2024-01-15T13:00:00Z",
-                },
-              ],
-            },
-          },
-        },
-        user: { login: "trigger-user" },
-      }),
-      rest: jest.fn() as any,
-    };
-
-    const result = await fetchGitHubData({
-      octokits: mockOctokits as any,
-      repository: "test-owner/test-repo",
-      prNumber: "123",
-      isPR: false,
-      triggerUsername: "trigger-user",
-      triggerTime: "2024-01-15T12:00:00Z",
-    });
-
-    // Should only include the comment created before trigger time
-    expect(result.comments.length).toBe(1);
-    expect(result.comments[0]?.id).toBe("1");
-    expect(result.comments[0]?.body).toBe("Comment before trigger");
-  });
-
-  it("should filter PR reviews based on trigger time", async () => {
-    const mockOctokits = {
-      graphql: jest.fn().mockResolvedValue({
-        repository: {
-          pullRequest: {
-            number: 456,
-            title: "Test PR",
-            body: "PR body",
-            author: { login: "author" },
-            comments: { nodes: [] },
-            files: { nodes: [] },
-            reviews: {
-              nodes: [
-                {
-                  id: "1",
-                  databaseId: "1",
-                  author: { login: "reviewer1" },
-                  body: "Review before trigger",
-                  state: "APPROVED",
-                  submittedAt: "2024-01-15T11:00:00Z",
-                  comments: { nodes: [] },
-                },
-                {
-                  id: "2",
-                  databaseId: "2",
-                  author: { login: "reviewer2" },
-                  body: "Review after trigger",
-                  state: "CHANGES_REQUESTED",
-                  submittedAt: "2024-01-15T13:00:00Z",
-                  comments: { nodes: [] },
-                },
-                {
-                  id: "3",
-                  databaseId: "3",
-                  author: { login: "reviewer3" },
-                  body: "Review before but edited after",
-                  state: "COMMENTED",
-                  submittedAt: "2024-01-15T11:00:00Z",
-                  updatedAt: "2024-01-15T13:00:00Z",
-                  lastEditedAt: "2024-01-15T13:00:00Z",
-                  comments: { nodes: [] },
-                },
-              ],
-            },
-          },
-        },
-        user: { login: "trigger-user" },
-      }),
-      rest: {
-        pulls: {
-          listFiles: jest.fn().mockResolvedValue({ data: [] }),
-        },
-      },
-    };
-
-    const result = await fetchGitHubData({
-      octokits: mockOctokits as any,
-      repository: "test-owner/test-repo",
-      prNumber: "456",
-      isPR: true,
-      triggerUsername: "trigger-user",
-      triggerTime: "2024-01-15T12:00:00Z",
-    });
-
-    // The reviewData field returns all reviews (not filtered), but the filtering
-    // happens when processing review bodies for download
-    // We can check the image download map to verify filtering
-    expect(result.reviewData?.nodes?.length).toBe(3); // All reviews are returned
-
-    // Check that only the first review's body would be downloaded (filtered)
-    const reviewsInMap = Object.keys(result.imageUrlMap).filter((key) =>
-      key.startsWith("review_body"),
-    );
-    // Only review 1 should have its body processed (before trigger and not edited after)
-    expect(reviewsInMap.length).toBeLessThanOrEqual(1);
-  });
-
-  it("should filter review comments based on trigger time", async () => {
-    const mockOctokits = {
-      graphql: jest.fn().mockResolvedValue({
-        repository: {
-          pullRequest: {
-            number: 789,
-            title: "Test PR",
-            body: "PR body",
-            author: { login: "author" },
-            comments: { nodes: [] },
-            files: { nodes: [] },
-            reviews: {
-              nodes: [
-                {
-                  id: "1",
-                  databaseId: "1",
-                  author: { login: "reviewer" },
-                  body: "Review body",
-                  state: "COMMENTED",
-                  submittedAt: "2024-01-15T11:00:00Z",
-                  comments: {
-                    nodes: [
-                      {
-                        id: "10",
-                        databaseId: "10",
-                        body: "Review comment before",
-                        author: { login: "user1" },
-                        createdAt: "2024-01-15T11:30:00Z",
-                      },
-                      {
-                        id: "11",
-                        databaseId: "11",
-                        body: "Review comment after",
-                        author: { login: "user2" },
-                        createdAt: "2024-01-15T12:30:00Z",
-                      },
-                      {
-                        id: "12",
-                        databaseId: "12",
-                        body: "Review comment edited after",
-                        author: { login: "user3" },
-                        createdAt: "2024-01-15T11:30:00Z",
-                        lastEditedAt: "2024-01-15T12:30:00Z",
-                      },
-                    ],
-                  },
-                },
-              ],
-            },
-          },
-        },
-        user: { login: "trigger-user" },
-      }),
-      rest: {
-        pulls: {
-          listFiles: jest.fn().mockResolvedValue({ data: [] }),
-        },
-      },
-    };
-
-    const result = await fetchGitHubData({
-      octokits: mockOctokits as any,
-      repository: "test-owner/test-repo",
-      prNumber: "789",
-      isPR: true,
-      triggerUsername: "trigger-user",
-      triggerTime: "2024-01-15T12:00:00Z",
-    });
-
-    // The imageUrlMap contains processed comments for image downloading
-    // We should have processed review comments, but only those before trigger time
-    // The exact check depends on how imageUrlMap is structured, but we can verify
-    // that filtering occurred by checking the review data still has all nodes
-    expect(result.reviewData?.nodes?.length).toBe(1); // Original review is kept
-
-    // The actual filtering happens during processing for image download
-    // Since the mock doesn't actually download images, we verify the input was correct
-  });
-
-  it("should handle backward compatibility when no trigger time provided", async () => {
-    const mockOctokits = {
-      graphql: jest.fn().mockResolvedValue({
-        repository: {
-          issue: {
-            number: 999,
-            title: "Test Issue",
-            body: "Issue body",
-            author: { login: "author" },
-            comments: {
-              nodes: [
-                {
-                  id: "1",
-                  databaseId: "1",
-                  body: "Old comment",
-                  author: { login: "user1" },
-                  createdAt: "2024-01-15T11:00:00Z",
-                },
-                {
-                  id: "2",
-                  databaseId: "2",
-                  body: "New comment",
-                  author: { login: "user2" },
-                  createdAt: "2024-01-15T13:00:00Z",
-                },
-                {
-                  id: "3",
-                  databaseId: "3",
-                  body: "Edited comment",
-                  author: { login: "user3" },
-                  createdAt: "2024-01-15T11:00:00Z",
-                  lastEditedAt: "2024-01-15T13:00:00Z",
-                },
-              ],
-            },
-          },
-        },
-        user: { login: "trigger-user" },
-      }),
-      rest: jest.fn() as any,
-    };
-
-    const result = await fetchGitHubData({
-      octokits: mockOctokits as any,
-      repository: "test-owner/test-repo",
-      prNumber: "999",
-      isPR: false,
-      triggerUsername: "trigger-user",
-      // No triggerTime provided
-    });
-
-    // Without trigger time, all comments should be included
-    expect(result.comments.length).toBe(3);
-  });
-
-  it("should handle timezone variations in timestamps", async () => {
-    const mockOctokits = {
-      graphql: jest.fn().mockResolvedValue({
-        repository: {
-          issue: {
-            number: 321,
-            title: "Test Issue",
-            body: "Issue body",
-            author: { login: "author" },
-            comments: {
-              nodes: [
-                {
-                  id: "1",
-                  databaseId: "1",
-                  body: "Comment with UTC",
-                  author: { login: "user1" },
-                  createdAt: "2024-01-15T11:00:00Z",
-                },
-                {
-                  id: "2",
-                  databaseId: "2",
-                  body: "Comment with offset",
-                  author: { login: "user2" },
-                  createdAt: "2024-01-15T11:00:00+00:00",
-                },
-                {
-                  id: "3",
-                  databaseId: "3",
-                  body: "Comment with milliseconds",
-                  author: { login: "user3" },
-                  createdAt: "2024-01-15T11:00:00.000Z",
-                },
-              ],
-            },
-          },
-        },
-        user: { login: "trigger-user" },
-      }),
-      rest: jest.fn() as any,
-    };
-
-    const result = await fetchGitHubData({
-      octokits: mockOctokits as any,
-      repository: "test-owner/test-repo",
-      prNumber: "321",
-      isPR: false,
-      triggerUsername: "trigger-user",
-      triggerTime: "2024-01-15T12:00:00Z",
-    });
-
-    // All three comments should be included as they're all before trigger time
-    expect(result.comments.length).toBe(3);
-  });
-});

test/install-mcp-server.test.ts

@@ -2,7 +2,6 @@ import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
 import { prepareMcpConfig } from "../src/mcp/install-mcp-server";
 import * as core from "@actions/core";
 import type { ParsedGitHubContext } from "../src/github/context";
-import { CLAUDE_APP_BOT_ID, CLAUDE_BOT_LOGIN } from "../src/github/constants";
 
 describe("prepareMcpConfig", () => {
   let consoleInfoSpy: any;
@@ -32,10 +31,7 @@ describe("prepareMcpConfig", () => {
       branchPrefix: "",
       useStickyComment: false,
       useCommitSigning: false,
-      botId: String(CLAUDE_APP_BOT_ID),
-      botName: CLAUDE_BOT_LOGIN,
       allowedBots: "",
-      allowedNonWriteUsers: "",
       trackProgress: false,
     },
   };

test/mockContext.ts

@@ -1,7 +1,6 @@
 import type {
   ParsedGitHubContext,
   AutomationContext,
-  RepositoryDispatchEvent,
 } from "../src/github/context";
 import type {
   IssuesEvent,
@@ -10,7 +9,6 @@ import type {
   PullRequestReviewEvent,
   PullRequestReviewCommentEvent,
 } from "@octokit/webhooks-types";
-import { CLAUDE_APP_BOT_ID, CLAUDE_BOT_LOGIN } from "../src/github/constants";
 
 const defaultInputs = {
   prompt: "",
@@ -20,10 +18,7 @@ const defaultInputs = {
   branchPrefix: "claude/",
   useStickyComment: false,
   useCommitSigning: false,
-  botId: String(CLAUDE_APP_BOT_ID),
-  botName: CLAUDE_BOT_LOGIN,
   allowedBots: "",
-  allowedNonWriteUsers: "",
   trackProgress: false,
 };
 
@@ -83,33 +78,6 @@ export const createMockAutomationContext = (
   return { ...baseContext, ...overrides, inputs: mergedInputs };
 };
 
-export const mockRepositoryDispatchContext: AutomationContext = {
-  runId: "1234567890",
-  eventName: "repository_dispatch",
-  eventAction: undefined,
-  repository: defaultRepository,
-  actor: "automation-user",
-  payload: {
-    action: "trigger-analysis",
-    client_payload: {
-      source: "issue-detective",
-      issue_number: 42,
-      repository_name: "test-owner/test-repo",
-      analysis_type: "bug-report",
-    },
-    repository: {
-      name: "test-repo",
-      owner: {
-        login: "test-owner",
-      },
-    },
-    sender: {
-      login: "automation-user",
-    },
-  } as RepositoryDispatchEvent,
-  inputs: defaultInputs,
-};
-
 export const mockIssueOpenedContext: ParsedGitHubContext = {
   runId: "1234567890",
   eventName: "issues",

test/modes/agent.test.ts

@@ -1,23 +1,13 @@
-import {
+import { describe, test, expect, beforeEach, afterEach, spyOn } from "bun:test";
-  describe,
-  test,
-  expect,
-  beforeEach,
-  afterEach,
-  spyOn,
-  mock,
-} from "bun:test";
 import { agentMode } from "../../src/modes/agent";
 import type { GitHubContext } from "../../src/github/context";
 import { createMockContext, createMockAutomationContext } from "../mockContext";
 import * as core from "@actions/core";
-import * as gitConfig from "../../src/github/operations/git-config";
 
 describe("Agent Mode", () => {
   let mockContext: GitHubContext;
   let exportVariableSpy: any;
   let setOutputSpy: any;
-  let configureGitAuthSpy: any;
 
   beforeEach(() => {
     mockContext = createMockAutomationContext({
@@ -27,22 +17,13 @@ describe("Agent Mode", () => {
       () => {},
     );
     setOutputSpy = spyOn(core, "setOutput").mockImplementation(() => {});
-    // Mock configureGitAuth to prevent actual git commands from running
-    configureGitAuthSpy = spyOn(
-      gitConfig,
-      "configureGitAuth",
-    ).mockImplementation(async () => {
-      // Do nothing - prevent actual git config modifications
-    });
   });
 
   afterEach(() => {
     exportVariableSpy?.mockClear();
     setOutputSpy?.mockClear();
-    configureGitAuthSpy?.mockClear();
     exportVariableSpy?.mockRestore();
     setOutputSpy?.mockRestore();
-    configureGitAuthSpy?.mockRestore();
   });
 
   test("agent mode has correct properties", () => {
@@ -76,11 +57,6 @@ describe("Agent Mode", () => {
     });
     expect(agentMode.shouldTrigger(scheduleContext)).toBe(false);
 
-    const repositoryDispatchContext = createMockAutomationContext({
-      eventName: "repository_dispatch",
-    });
-    expect(agentMode.shouldTrigger(repositoryDispatchContext)).toBe(false);
-
     // Should NOT trigger for entity events without prompt
     const entityEvents = [
       "issue_comment",
@@ -97,7 +73,6 @@ describe("Agent Mode", () => {
     // Should trigger for ANY event when prompt is provided
     const allEvents = [
       "workflow_dispatch",
-      "repository_dispatch",
       "schedule",
       "issue_comment",
       "pull_request",
@@ -107,9 +82,7 @@ describe("Agent Mode", () => {
 
     allEvents.forEach((eventName) => {
       const contextWithPrompt =
-        eventName === "workflow_dispatch" ||
+        eventName === "workflow_dispatch" || eventName === "schedule"
-        eventName === "repository_dispatch" ||
-        eventName === "schedule"
           ? createMockAutomationContext({
               eventName,
               inputs: { prompt: "Do something" },
@@ -140,22 +113,7 @@ describe("Agent Mode", () => {
     // Set CLAUDE_ARGS environment variable
     process.env.CLAUDE_ARGS = "--model claude-sonnet-4 --max-turns 10";
 
-    const mockOctokit = {
+    const mockOctokit = {} as any;
-      rest: {
-        users: {
-          getAuthenticated: mock(() =>
-            Promise.resolve({
-              data: { login: "test-user", id: 12345 },
-            }),
-          ),
-          getByUsername: mock(() =>
-            Promise.resolve({
-              data: { login: "test-user", id: 12345 },
-            }),
-          ),
-        },
-      },
-    } as any;
     const result = await agentMode.prepare({
       context: contextWithCustomArgs,
       octokit: mockOctokit,
@@ -194,22 +152,7 @@ describe("Agent Mode", () => {
     // In v1-dev, we only have the unified prompt field
     contextWithPrompts.inputs.prompt = "Custom prompt content";
 
-    const mockOctokit = {
+    const mockOctokit = {} as any;
-      rest: {
-        users: {
-          getAuthenticated: mock(() =>
-            Promise.resolve({
-              data: { login: "test-user", id: 12345 },
-            }),
-          ),
-          getByUsername: mock(() =>
-            Promise.resolve({
-              data: { login: "test-user", id: 12345 },
-            }),
-          ),
-        },
-      },
-    } as any;
     await agentMode.prepare({
       context: contextWithPrompts,
       octokit: mockOctokit,
@@ -218,11 +161,9 @@ describe("Agent Mode", () => {
 
     // Note: We can't easily test file creation in this unit test,
     // but we can verify the method completes without errors
-    // With our conditional MCP logic, agent mode with no allowed tools
+    // Agent mode now includes MCP config even with empty user args
-    // should not include any MCP config
     const callArgs = setOutputSpy.mock.calls[0];
     expect(callArgs[0]).toBe("claude_args");
-    // Should be empty or just whitespace when no MCP servers are included
+    expect(callArgs[1]).toContain("--mcp-config");
-    expect(callArgs[1]).not.toContain("--mcp-config");
   });
 });

test/modes/registry.test.ts

@@ -2,11 +2,7 @@ import { describe, test, expect } from "bun:test";
 import { getMode, isValidMode } from "../../src/modes/registry";
 import { agentMode } from "../../src/modes/agent";
 import { tagMode } from "../../src/modes/tag";
-import {
+import { createMockContext, createMockAutomationContext } from "../mockContext";
-  createMockContext,
-  createMockAutomationContext,
-  mockRepositoryDispatchContext,
-} from "../mockContext";
 
 describe("Mode Registry", () => {
   const mockContext = createMockContext({
@@ -54,34 +50,6 @@ describe("Mode Registry", () => {
     expect(mode.name).toBe("agent");
   });
 
-  test("getMode auto-detects agent for repository_dispatch event", () => {
-    const mode = getMode(mockRepositoryDispatchContext);
-    expect(mode).toBe(agentMode);
-    expect(mode.name).toBe("agent");
-  });
-
-  test("getMode auto-detects agent for repository_dispatch with client_payload", () => {
-    const contextWithPayload = createMockAutomationContext({
-      eventName: "repository_dispatch",
-      payload: {
-        action: "trigger-analysis",
-        client_payload: {
-          source: "external-system",
-          metadata: { priority: "high" },
-        },
-        repository: {
-          name: "test-repo",
-          owner: { login: "test-owner" },
-        },
-        sender: { login: "automation-user" },
-      },
-    });
-
-    const mode = getMode(contextWithPayload);
-    expect(mode).toBe(agentMode);
-    expect(mode.name).toBe("agent");
-  });
-
   // Removed test - legacy mode names no longer supported in v1.0
 
   test("getMode auto-detects agent mode for PR opened", () => {

test/permissions.test.ts

@@ -2,7 +2,6 @@ import { describe, expect, test, spyOn, beforeEach, afterEach } from "bun:test";
 import * as core from "@actions/core";
 import { checkWritePermissions } from "../src/github/validation/permissions";
 import type { ParsedGitHubContext } from "../src/github/context";
-import { CLAUDE_APP_BOT_ID, CLAUDE_BOT_LOGIN } from "../src/github/constants";
 
 describe("checkWritePermissions", () => {
   let coreInfoSpy: any;
@@ -68,10 +67,7 @@ describe("checkWritePermissions", () => {
       branchPrefix: "claude/",
       useStickyComment: false,
       useCommitSigning: false,
-      botId: String(CLAUDE_APP_BOT_ID),
-      botName: CLAUDE_BOT_LOGIN,
       allowedBots: "",
-      allowedNonWriteUsers: "",
       trackProgress: false,
     },
   });
@@ -176,126 +172,4 @@ describe("checkWritePermissions", () => {
       username: "test-user",
     });
   });
-
-  describe("allowed_non_write_users bypass", () => {
-    test("should bypass permission check for specific user when github_token provided", async () => {
-      const mockOctokit = createMockOctokit("read");
-      const context = createContext();
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        "test-user,other-user",
-        true,
-      );
-
-      expect(result).toBe(true);
-      expect(coreWarningSpy).toHaveBeenCalledWith(
-        "⚠️ SECURITY WARNING: Bypassing write permission check for test-user due to allowed_non_write_users configuration. This should only be used for workflows with very limited permissions.",
-      );
-    });
-
-    test("should bypass permission check for all users with wildcard", async () => {
-      const mockOctokit = createMockOctokit("read");
-      const context = createContext();
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        "*",
-        true,
-      );
-
-      expect(result).toBe(true);
-      expect(coreWarningSpy).toHaveBeenCalledWith(
-        "⚠️ SECURITY WARNING: Bypassing write permission check for test-user due to allowed_non_write_users='*'. This should only be used for workflows with very limited permissions.",
-      );
-    });
-
-    test("should NOT bypass permission check when user not in allowed list", async () => {
-      const mockOctokit = createMockOctokit("read");
-      const context = createContext();
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        "other-user,another-user",
-        true,
-      );
-
-      expect(result).toBe(false);
-      expect(coreWarningSpy).toHaveBeenCalledWith(
-        "Actor has insufficient permissions: read",
-      );
-    });
-
-    test("should NOT bypass permission check when github_token not provided", async () => {
-      const mockOctokit = createMockOctokit("read");
-      const context = createContext();
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        "test-user",
-        false,
-      );
-
-      expect(result).toBe(false);
-      expect(coreWarningSpy).toHaveBeenCalledWith(
-        "Actor has insufficient permissions: read",
-      );
-    });
-
-    test("should NOT bypass permission check when allowed_non_write_users is empty", async () => {
-      const mockOctokit = createMockOctokit("read");
-      const context = createContext();
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        "",
-        true,
-      );
-
-      expect(result).toBe(false);
-      expect(coreWarningSpy).toHaveBeenCalledWith(
-        "Actor has insufficient permissions: read",
-      );
-    });
-
-    test("should handle whitespace in allowed_non_write_users list", async () => {
-      const mockOctokit = createMockOctokit("read");
-      const context = createContext();
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        " test-user , other-user ",
-        true,
-      );
-
-      expect(result).toBe(true);
-      expect(coreWarningSpy).toHaveBeenCalledWith(
-        "⚠️ SECURITY WARNING: Bypassing write permission check for test-user due to allowed_non_write_users configuration. This should only be used for workflows with very limited permissions.",
-      );
-    });
-
-    test("should bypass for bot users even when allowed_non_write_users is set", async () => {
-      const mockOctokit = createMockOctokit("none");
-      const context = createContext();
-      context.actor = "test-bot[bot]";
-
-      const result = await checkWritePermissions(
-        mockOctokit,
-        context,
-        "some-user",
-        true,
-      );
-
-      expect(result).toBe(true);
-      expect(coreInfoSpy).toHaveBeenCalledWith(
-        "Actor is a GitHub App: test-bot[bot]",
-      );
-    });
-  });
 });

tests/modes/detector.test.ts

@@ -113,33 +113,6 @@ describe("detectMode with enhanced routing", () => {
 
       expect(detectMode(context)).toBe("agent");
     });
-
-    it("should use agent mode for issues with explicit prompt", () => {
-      const context: GitHubContext = {
-        ...baseContext,
-        eventName: "issues",
-        eventAction: "opened",
-        payload: { issue: { number: 1, body: "Test issue" } } as any,
-        entityNumber: 1,
-        isPR: false,
-        inputs: { ...baseContext.inputs, prompt: "Analyze this issue" },
-      };
-
-      expect(detectMode(context)).toBe("agent");
-    });
-
-    it("should use tag mode for issues with @claude mention and no prompt", () => {
-      const context: GitHubContext = {
-        ...baseContext,
-        eventName: "issues",
-        eventAction: "opened",
-        payload: { issue: { number: 1, body: "@claude help" } } as any,
-        entityNumber: 1,
-        isPR: false,
-      };
-
-      expect(detectMode(context)).toBe("tag");
-    });
   });
 
   describe("Comment Events (unchanged behavior)", () => {