Accept multiline input for allowed_tools and disallowed_tools

* feat: use GitHub display name in Co-authored-by trailers

- Add name field to GitHubAuthor type
- Update GraphQL queries to fetch user display names
- Add triggerDisplayName to CommonFields type
- Extract display name from fetched GitHub data in prepareContext
- Update Co-authored-by trailer generation to use display name when available

This ensures consistency with GitHub's web interface behavior where
Co-authored-by trailers use the user's display name rather than username.

Co-authored-by: ashwin-ant <ashwin-ant@users.noreply.github.com>

* fix: update GraphQL queries to handle Actor type correctly

The name field is only available on the User subtype of Actor in GitHub's
GraphQL API. This commit updates the queries to use inline fragments
(... on User) to conditionally access the name field when the actor is
a User type.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor: clarify Co-authored-by instructions in prompt

Replace interpolated values with clear references to XML tags and add
explicit formatting instructions. This makes it clearer how to use the
GitHub display name when available while maintaining the username for
the email portion.

Changes:
- Use explicit references to <trigger_display_name> and <trigger_username> tags
- Add clear formatting instructions and example
- Explain fallback behavior when display name is not available

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: fetch trigger user display name via dedicated GraphQL query

Instead of trying to extract the display name from existing data (which
was incomplete due to Actor type limitations), we now:

- Add a dedicated USER_QUERY to fetch user display names
- Pass the trigger username to fetchGitHubData
- Fetch the display name during data collection phase
- Simplify prepareContext to use the pre-fetched display name

This ensures we always get the correct display name for Co-authored-by
trailers, regardless of where the trigger came from.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com>
Co-authored-by: ashwin-ant <ashwin-ant@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

README.md

@@ -347,8 +347,15 @@ Claude does **not** have access to execute arbitrary Bash commands by default. I
 ```yaml
 - uses: anthropics/claude-code-action@beta
   with:
-    allowed_tools: "Bash(npm install),Bash(npm run test),Edit,Replace,NotebookEditCell"
-    disallowed_tools: "TaskOutput,KillTask"
+    allowed_tools: |
+      Bash(npm install)
+      Bash(npm run test)
+      Edit
+      Replace
+      NotebookEditCell
+    disallowed_tools: |
+      TaskOutput
+      KillTask
     # ... other inputs
 ```
 

ROADMAP.md

@@ -0,0 +1,20 @@
+# Claude Code GitHub Action Roadmap
+
+Thank you for trying out the beta of our GitHub Action! This document outlines our path to `v1.0`. Items are not necessarily in priority order.
+
+## Path to 1.0
+
+- **Ability to see GitHub Action CI results** - This will enable Claude to look at CI failures and make updates to PRs to fix test failures, lint errors, and the like.
+- **Cross-repo support** - Enable Claude to work across multiple repositories in a single session
+- **Ability to modify workflow files** - Let Claude update GitHub Actions workflows and other CI configuration files
+- **Support for workflow_dispatch and repository_dispatch events** - Dispatch Claude on events triggered via API from other workflows or from other services
+- **Ability to disable commit signing** - Option to turn off GPG signing for environments where it's not required. This will enable Claude to use normal `git` bash commands for committing. This will likely become the default behavior once added.
+- **Better code review behavior** - Support inline comments on specific lines, provide higher quality reviews with more actionable feedback
+- **Support triggering @claude from bot users** - Allow automation and bot accounts to invoke Claude
+- **Customizable base prompts** - Full control over Claude's initial context with template variables like `$PR_COMMENTS`, `$PR_FILES`, etc. Users can replace our default prompt entirely while still accessing key contextual data
+
+---
+
+**Note:** This roadmap represents our current vision for reaching `v1.0` and is subject to change based on user feedback and development priorities.
+
+We welcome feedback on these planned features! If you're interested in contributing to any of these features, please open an issue to discuss implementation details with us. We're also open to suggestions for new features not listed here.

action.yml

@@ -100,6 +100,7 @@ runs:
         ASSIGNEE_TRIGGER: ${{ inputs.assignee_trigger }}
         BASE_BRANCH: ${{ inputs.base_branch }}
         ALLOWED_TOOLS: ${{ inputs.allowed_tools }}
+        DISALLOWED_TOOLS: ${{ inputs.disallowed_tools }}
         CUSTOM_INSTRUCTIONS: ${{ inputs.custom_instructions }}
         DIRECT_PROMPT: ${{ inputs.direct_prompt }}
         MCP_CONFIG: ${{ inputs.mcp_config }}
@@ -109,7 +110,7 @@ runs:
     - name: Run Claude Code
       id: claude-code
       if: steps.prepare.outputs.contains_trigger == 'true'
-      uses: anthropics/claude-code-base-action@79b8cfc932eb13806c23905842145e6f05c89e2e # v0.0.13
+      uses: anthropics/claude-code-base-action@ebd8558e902b3db132e89863de49565fcb9aec46 # v0.0.19
       with:
         prompt_file: ${{ runner.temp }}/claude-prompts/claude-prompt.txt
         allowed_tools: ${{ env.ALLOWED_TOOLS }}

src/create-prompt/index.ts

@@ -24,6 +24,7 @@ export type { CommonFields, PreparedContext } from "./types";
 
 const BASE_ALLOWED_TOOLS = [
   "Edit",
+  "MultiEdit",
   "Glob",
   "Grep",
   "LS",
@@ -417,6 +418,7 @@ ${
 }
 <claude_comment_id>${context.claudeCommentId}</claude_comment_id>
 <trigger_username>${context.triggerUsername ?? "Unknown"}</trigger_username>
+<trigger_display_name>${githubData.triggerDisplayName ?? context.triggerUsername ?? "Unknown"}</trigger_display_name>
 <trigger_phrase>${context.triggerPhrase}</trigger_phrase>
 ${
   (eventData.eventName === "issue_comment" ||
@@ -502,12 +504,14 @@ ${context.directPrompt ? `   - DIRECT INSTRUCTION: A direct instruction was prov
           ? `
       - Push directly using mcp__github_file_ops__commit_files to the existing branch (works for both new and existing files).
       - Use mcp__github_file_ops__commit_files to commit files atomically in a single commit (supports single or multiple files).
-      - When pushing changes with this tool and TRIGGER_USERNAME is not "Unknown", include a "Co-authored-by: ${context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>" line in the commit message.`
+      - When pushing changes with this tool and the trigger user is not "Unknown", include a Co-authored-by trailer in the commit message.
+      - Use: "Co-authored-by: ${githubData.triggerDisplayName ?? context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>"`
           : `
       - You are already on the correct branch (${eventData.claudeBranch || "the PR branch"}). Do not create a new branch.
       - Push changes directly to the current branch using mcp__github_file_ops__commit_files (works for both new and existing files)
       - Use mcp__github_file_ops__commit_files to commit files atomically in a single commit (supports single or multiple files).
-      - When pushing changes and TRIGGER_USERNAME is not "Unknown", include a "Co-authored-by: ${context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>" line in the commit message.
+      - When pushing changes and the trigger user is not "Unknown", include a Co-authored-by trailer in the commit message.
+      - Use: "Co-authored-by: ${githubData.triggerDisplayName ?? context.triggerUsername} <${context.triggerUsername}@users.noreply.github.com>"
       ${
         eventData.claudeBranch
           ? `- Provide a URL to create a PR manually in this format:

src/entrypoints/prepare.ts

@@ -59,6 +59,7 @@ async function run() {
       repository: `${context.repository.owner}/${context.repository.repo}`,
       prNumber: context.entityNumber.toString(),
       isPR: context.isPR,
+      triggerUsername: context.actor,
     });
 
     // Step 8: Setup branch

src/github/api/queries/github.ts

@@ -104,3 +104,11 @@ export const ISSUE_QUERY = `
     }
   }
 `;
+
+export const USER_QUERY = `
+  query($login: String!) {
+    user(login: $login) {
+      name
+    }
+  }
+`;

src/github/context.ts

@@ -52,14 +52,8 @@ export function parseGitHubContext(): ParsedGitHubContext {
     inputs: {
       triggerPhrase: process.env.TRIGGER_PHRASE ?? "@claude",
       assigneeTrigger: process.env.ASSIGNEE_TRIGGER ?? "",
-      allowedTools: (process.env.ALLOWED_TOOLS ?? "")
-        .split(",")
-        .map((tool) => tool.trim())
-        .filter((tool) => tool.length > 0),
-      disallowedTools: (process.env.DISALLOWED_TOOLS ?? "")
-        .split(",")
-        .map((tool) => tool.trim())
-        .filter((tool) => tool.length > 0),
+      allowedTools: parseMultilineInput(process.env.ALLOWED_TOOLS ?? ""),
+      disallowedTools: parseMultilineInput(process.env.DISALLOWED_TOOLS ?? ""),
       customInstructions: process.env.CUSTOM_INSTRUCTIONS ?? "",
       directPrompt: process.env.DIRECT_PROMPT ?? "",
       baseBranch: process.env.BASE_BRANCH,
@@ -116,6 +110,14 @@ export function parseGitHubContext(): ParsedGitHubContext {
   }
 }
 
+export function parseMultilineInput(s: string): string[] {
+  return s
+    .split(/,|[\n\r]+/)
+    .map((tool) => tool.replace(/#.+$/, ""))
+    .map((tool) => tool.trim())
+    .filter((tool) => tool.length > 0);
+}
+
 export function isIssuesEvent(
   context: ParsedGitHubContext,
 ): context is ParsedGitHubContext & { payload: IssuesEvent } {

src/github/data/fetcher.ts

@@ -1,6 +1,6 @@
 import { execSync } from "child_process";
 import type { Octokits } from "../api/client";
-import { ISSUE_QUERY, PR_QUERY } from "../api/queries/github";
+import { ISSUE_QUERY, PR_QUERY, USER_QUERY } from "../api/queries/github";
 import type {
   GitHubComment,
   GitHubFile,
@@ -18,6 +18,7 @@ type FetchDataParams = {
   repository: string;
   prNumber: string;
   isPR: boolean;
+  triggerUsername?: string;
 };
 
 export type GitHubFileWithSHA = GitHubFile & {
@@ -31,6 +32,7 @@ export type FetchDataResult = {
   changedFilesWithSHA: GitHubFileWithSHA[];
   reviewData: { nodes: GitHubReview[] } | null;
   imageUrlMap: Map<string, string>;
+  triggerDisplayName?: string | null;
 };
 
 export async function fetchGitHubData({
@@ -38,6 +40,7 @@ export async function fetchGitHubData({
   repository,
   prNumber,
   isPR,
+  triggerUsername,
 }: FetchDataParams): Promise<FetchDataResult> {
   const [owner, repo] = repository.split("/");
   if (!owner || !repo) {
@@ -191,6 +194,12 @@ export async function fetchGitHubData({
     allComments,
   );
 
+  // Fetch trigger user display name if username is provided
+  let triggerDisplayName: string | null | undefined;
+  if (triggerUsername) {
+    triggerDisplayName = await fetchUserDisplayName(octokits, triggerUsername);
+  }
+
   return {
     contextData,
     comments,
@@ -198,5 +207,27 @@ export async function fetchGitHubData({
     changedFilesWithSHA,
     reviewData,
     imageUrlMap,
+    triggerDisplayName,
   };
 }
+
+export type UserQueryResponse = {
+  user: {
+    name: string | null;
+  };
+};
+
+export async function fetchUserDisplayName(
+  octokits: Octokits,
+  login: string,
+): Promise<string | null> {
+  try {
+    const result = await octokits.graphql<UserQueryResponse>(USER_QUERY, {
+      login,
+    });
+    return result.user.name;
+  } catch (error) {
+    console.warn(`Failed to fetch user display name for ${login}:`, error);
+    return null;
+  }
+}

src/github/types.ts

@@ -1,6 +1,7 @@
 // Types for GitHub GraphQL query responses
 export type GitHubAuthor = {
   login: string;
+  name?: string;
 };
 
 export type GitHubComment = {

src/mcp/github-file-ops-server.ts

@@ -466,6 +466,7 @@ server.tool(
 
       const octokit = new Octokit({
         auth: githubToken,
+        baseUrl: GITHUB_API_URL,
       });
 
       const isPullRequestReviewComment =

src/mcp/install-mcp-server.ts

@@ -1,4 +1,5 @@
 import * as core from "@actions/core";
+import { GITHUB_API_URL } from "../github/api/config";
 
 type PrepareConfigParams = {
   githubToken: string;
@@ -46,6 +47,7 @@ export async function prepareMcpConfig(
             ...(claudeCommentId && { CLAUDE_COMMENT_ID: claudeCommentId }),
             GITHUB_EVENT_NAME: process.env.GITHUB_EVENT_NAME || "",
             IS_PR: process.env.IS_PR || "false",
+            GITHUB_API_URL: GITHUB_API_URL,
           },
         },
       },

test/create-prompt.test.ts

@@ -316,7 +316,7 @@ describe("generatePrompt", () => {
 
     expect(prompt).toContain("<trigger_username>johndoe</trigger_username>");
     expect(prompt).toContain(
-      "Co-authored-by: johndoe <johndoe@users.noreply.github.com>",
+      'Use: "Co-authored-by: johndoe <johndoe@users.noreply.github.com>"',
     );
   });
 

test/github/context.test.ts

@@ -0,0 +1,57 @@
+import { describe, it, expect } from "bun:test";
+import { parseMultilineInput } from "../../src/github/context";
+
+describe("parseMultilineInput", () => {
+  it("should parse a comma-separated string", () => {
+    const input = `Bash(bun install),Bash(bun test:*),Bash(bun typecheck)`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should parse multiline string", () => {
+    const input = `Bash(bun install)
+Bash(bun test:*)
+Bash(bun typecheck)`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should parse comma-separated multiline line", () => {
+    const input = `Bash(bun install),Bash(bun test:*)
+Bash(bun typecheck)`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should ignore comments", () => {
+    const input = `Bash(bun install),
+Bash(bun test:*) # For testing
+# For type checking
+Bash(bun typecheck)
+`;
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([
+      "Bash(bun install)",
+      "Bash(bun test:*)",
+      "Bash(bun typecheck)",
+    ]);
+  });
+
+  it("should parse an empty string", () => {
+    const input = "";
+    const result = parseMultilineInput(input);
+    expect(result).toEqual([]);
+  });
+});