From f06294d435ec230d4502430a974d5b0d9f261589 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 28 Jul 2026 13:44:32 +0000 Subject: [PATCH] fix(ci): drop ineffective/diagnostic claude.yml inputs, root cause found MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit show_full_output (added in #1366) revealed the real error on every @claude run: a 401 "OAuth access token is invalid" — the CLAUDE_CODE_OAUTH_TOKEN secret itself is stale. #1359 and #1366 both targeted project MCP auto-load, which was never the actual cause; the prior in-process SDK logs just hid the real API error. Drops claude_args (proved to have no effect) and show_full_output (no longer needed once root-caused). Keeps enableAllProjectMcpServers: false via settings — CI has no legitimate use for project MCP servers regardless. The secret still needs to be regenerated with `claude setup-token` and updated; no workflow change can fix an invalid token. --- .github/workflows/claude.yml | 21 +++++++++------------ 1 file changed, 9 insertions(+), 12 deletions(-) diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml index b0cfd3d394..5b5bd66ffe 100644 --- a/.github/workflows/claude.yml +++ b/.github/workflows/claude.yml @@ -69,16 +69,13 @@ jobs: # The action's default trigger phrase is "@claude"; it reads the # triggering comment/review and acts on the current PR head. claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - # DIAGNOSTIC (temporary): claude_args: --strict-mcp-config (added in - # #1359) had no observable effect on the crash — the run still fails - # in ~2s with $0 cost and zero turns, meaning no model call is ever - # made. This action runs the Agent SDK's query() in-process rather - # than spawning the `claude` CLI, so claude_args may not map to - # --strict-mcp-config at all. Setting `settings` directly targets - # the JSON key the action logs writing itself - # ("Updated settings with enableAllProjectMcpServers: true"). - # show_full_output is on to capture the real error since the prior - # two failures were both silent. Revert both once root-caused. - claude_args: --strict-mcp-config + # Every @claude run had been failing with a 401 + # ("OAuth access token is invalid") — a stale CLAUDE_CODE_OAUTH_TOKEN + # secret, root-caused via show_full_output after two earlier fix + # attempts (#1359, #1366) targeted the wrong thing (project MCP + # auto-load, which was never the actual cause). No workflow change + # fixes an invalid token; the secret itself needs regenerating with + # `claude setup-token`. This disables project MCP auto-load anyway, + # since a CI runner has no legitimate use for it (e.g. this repo's + # .mcp.json "railway" server, which has no session/auth in Actions). settings: '{"enableAllProjectMcpServers": false}' - show_full_output: true