feat: update claude.yml example to use write permissions

Changed permissions in examples/claude.yml from read to write for:
- contents: read → write
- pull-requests: read → write
- issues: read → write

This allows the Claude Code Action to perform write operations on these resources.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

.github/workflows/sync-base-action.yml

@@ -56,6 +56,12 @@ jobs:
           # Copy all contents from base-action
           cp -r ../base-action/. .
 
+          # Prepend mirror disclaimer to README if both files exist
+          if [ -f "README.md" ] && [ -f "MIRROR_DISCLAIMER.md" ]; then
+            cat MIRROR_DISCLAIMER.md README.md > README.tmp
+            mv README.tmp README.md
+          fi
+
           # Check if there are any changes
           if git diff --quiet && git diff --staged --quiet; then
             echo "No changes to sync"

action.yml

@@ -188,12 +188,13 @@ runs:
       shell: bash
       run: |
         # Install Claude Code globally
-        npm install -g @anthropic-ai/claude-code@1.0.53
+        npm install -g @anthropic-ai/claude-code@1.0.56
 
         # Run the base-action
         cd ${GITHUB_ACTION_PATH}/base-action
         bun install
-        bun run src/index.ts
+        cd -
+        bun run ${GITHUB_ACTION_PATH}/base-action/src/index.ts
       env:
         # Base-action inputs
         CLAUDE_CODE_ACTION: "1"
@@ -226,7 +227,7 @@ runs:
         AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
         AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
         AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
-        ANTHROPIC_BEDROCK_BASE_URL: ${{ env.ANTHROPIC_BEDROCK_BASE_URL }}
+        ANTHROPIC_BEDROCK_BASE_URL: ${{ env.ANTHROPIC_BEDROCK_BASE_URL || (env.AWS_REGION && format('https://bedrock-runtime.{0}.amazonaws.com', env.AWS_REGION)) }}
 
         # GCP configuration
         ANTHROPIC_VERTEX_PROJECT_ID: ${{ env.ANTHROPIC_VERTEX_PROJECT_ID }}

base-action/MIRROR_DISCLAIMER.md

@@ -0,0 +1,11 @@
+# ⚠️ This is a Mirror Repository
+
+This repository is an automated mirror of the `base-action` directory from [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action).
+
+**Do not submit PRs or issues to this repository.** Instead, please contribute to the main repository:
+
+- 🐛 [Report issues](https://github.com/anthropics/claude-code-action/issues)
+- 🔧 [Submit pull requests](https://github.com/anthropics/claude-code-action/pulls)
+- 📖 [View documentation](https://github.com/anthropics/claude-code-action#readme)
+
+---

base-action/action.yml

@@ -115,7 +115,7 @@ runs:
 
     - name: Install Claude Code
       shell: bash
-      run: npm install -g @anthropic-ai/claude-code@1.0.53
+      run: npm install -g @anthropic-ai/claude-code@1.0.56
 
     - name: Run Claude Code Action
       shell: bash

base-action/src/index.ts

@@ -26,6 +26,7 @@ async function run() {
       appendSystemPrompt: process.env.INPUT_APPEND_SYSTEM_PROMPT,
       claudeEnv: process.env.INPUT_CLAUDE_ENV,
       fallbackModel: process.env.INPUT_FALLBACK_MODEL,
+      model: process.env.ANTHROPIC_MODEL,
     });
   } catch (error) {
     core.setFailed(`Action failed with error: ${error}`);

base-action/src/run-claude.ts

@@ -21,6 +21,7 @@ export type ClaudeOptions = {
   claudeEnv?: string;
   fallbackModel?: string;
   timeoutMinutes?: string;
+  model?: string;
 };
 
 type PreparedConfig = {
@@ -94,6 +95,9 @@ export function prepareRunConfig(
   if (options.fallbackModel) {
     claudeArgs.push("--fallback-model", options.fallbackModel);
   }
+  if (options.model) {
+    claudeArgs.push("--model", options.model);
+  }
   if (options.timeoutMinutes) {
     const timeoutMinutesNum = parseInt(options.timeoutMinutes, 10);
     if (isNaN(timeoutMinutesNum) || timeoutMinutesNum <= 0) {

examples/claude.yml

@@ -19,9 +19,9 @@ jobs:
       (github.event_name == 'issues' && contains(github.event.issue.body, '@claude'))
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: read
-      issues: read
+      contents: write
+      pull-requests: write
+      issues: write
       id-token: write
     steps:
       - name: Checkout repository

src/create-prompt/index.ts

@@ -694,8 +694,7 @@ What You CANNOT Do:
 - Submit formal GitHub PR reviews
 - Approve pull requests (for security reasons)
 - Post multiple comments (you only update your initial comment)
-- Execute commands outside the repository context
-- Run arbitrary Bash commands (unless explicitly allowed via allowed_tools configuration)
+- Execute commands outside the repository context${useCommitSigning ? "\n- Run arbitrary Bash commands (unless explicitly allowed via allowed_tools configuration)" : ""}
 - Perform branch operations (cannot merge branches, rebase, or perform other git operations beyond pushing commits)
 - Modify files in the .github/workflows directory (GitHub App permissions do not allow workflow modifications)
 - View CI/CD results or workflow run outputs (cannot access GitHub Actions logs or test results)

src/github/operations/branch.ts

@@ -116,6 +116,11 @@ export async function setupBranch(
         `Branch name generated: ${newBranch} (will be created by file ops server on first commit)`,
       );
 
+      // Ensure we're on the source branch
+      console.log(`Fetching and checking out source branch: ${sourceBranch}`);
+      await $`git fetch origin ${sourceBranch} --depth=1`;
+      await $`git checkout ${sourceBranch}`;
+
       // Set outputs for GitHub Actions
       core.setOutput("CLAUDE_BRANCH", newBranch);
       core.setOutput("BASE_BRANCH", sourceBranch);
@@ -131,7 +136,12 @@ export async function setupBranch(
       `Creating local branch ${newBranch} for ${entityType} #${entityNumber} from source branch: ${sourceBranch}...`,
     );
 
-    // Create and checkout the new branch locally
+    // Fetch and checkout the source branch first to ensure we branch from the correct base
+    console.log(`Fetching and checking out source branch: ${sourceBranch}`);
+    await $`git fetch origin ${sourceBranch} --depth=1`;
+    await $`git checkout ${sourceBranch}`;
+
+    // Create and checkout the new branch from the source branch
     await $`git checkout -b ${newBranch}`;
 
     console.log(