ci: temporarily enable show_full_output to diagnose agent permission denials#1048
Conversation
…denials Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR changes the scheduled “Fetch Claude Code Docs” workflow to expose the Claude Code agent’s full output in order to diagnose recent permission-denial issues during the agent step.
Changes:
- Enables
show_full_outputfor theanthropics/claude-code-actionstep to surface the full agent transcript/tool outputs for debugging.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # TEMPORARY: expose agent transcript to diagnose permission denials | ||
| show_full_output: true |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8072855032
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| github_token: ${{ steps.app-token.outputs.token }} | ||
| allowed_bots: "claude-yolo[bot]" | ||
| # TEMPORARY: expose agent transcript to diagnose permission denials | ||
| show_full_output: true |
There was a problem hiding this comment.
In this scheduled workflow, enabling show_full_output runs on the default branch with production secrets (CLAUDE_CODE_OAUTH_TOKEN, App token, and Bark MCP secrets) and writes the agent's full message/tool transcript to GitHub Actions logs. The upstream action input explicitly warns that this output includes tool execution results that may contain secrets or other sensitive information and that these logs are publicly visible, so leaving this committed means every scheduled/manual run can leak sensitive repo or credential-derived data rather than just a one-off debug run.
Useful? React with 👍 / 👎.
Diagnostic: agent step reports permission_denials_count 4-9 and leaves workspace dirty. Transcript is hidden by default; this exposes it for one run to enumerate the denied tool calls. Will be reverted in the real fix.
🤖 Generated with Claude Code