Repository navigation
feat: support the merge_group event for merge queue checks #1980
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test Settings Feature | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| workflow_call: | |
| # The Claude API is authenticated via workload identity federation: id-token | |
| # lets the action mint the GitHub OIDC token it exchanges for a short-lived | |
| # access token. See docs/setup.md. | |
| permissions: | |
| contents: read | |
| id-token: write | |
| # Pin the model so these tests don't depend on the CLI's default model, | |
| # which can change with each Claude Code release. | |
| env: | |
| ANTHROPIC_MODEL: claude-opus-5 | |
| jobs: | |
| test-settings-inline-allow: | |
| # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-24.04-firewall | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Test with inline settings JSON (echo allowed) | |
| id: inline-settings-test | |
| uses: ./base-action | |
| with: | |
| prompt: | | |
| Use Bash to echo "Hello from settings test" | |
| anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} | |
| anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} | |
| anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} | |
| claude_args: "--permission-mode auto" | |
| settings: | | |
| { | |
| "permissions": { | |
| "allow": ["Bash(echo:*)"] | |
| } | |
| } | |
| - name: Verify echo worked | |
| run: | | |
| OUTPUT_FILE="${{ steps.inline-settings-test.outputs.execution_file }}" | |
| CONCLUSION="${{ steps.inline-settings-test.outputs.conclusion }}" | |
| echo "Conclusion: $CONCLUSION" | |
| if [ "$CONCLUSION" = "success" ]; then | |
| echo "✅ Action completed successfully" | |
| else | |
| echo "❌ Action failed" | |
| exit 1 | |
| fi | |
| # Check that permission was NOT denied | |
| if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then | |
| echo "❌ Echo command was denied when it should have been allowed" | |
| cat "$OUTPUT_FILE" | |
| exit 1 | |
| fi | |
| # Check if the echo command worked | |
| if grep -q "Hello from settings test" "$OUTPUT_FILE"; then | |
| echo "✅ Bash echo command worked (allowed by permissions)" | |
| else | |
| echo "❌ Bash echo command didn't work" | |
| cat "$OUTPUT_FILE" | |
| exit 1 | |
| fi | |
| test-settings-inline-deny: | |
| # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-24.04-firewall | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Test with inline settings JSON (echo denied) | |
| id: inline-settings-test | |
| uses: ./base-action | |
| with: | |
| prompt: | | |
| Run the command `echo $HOME` to check the home directory path | |
| anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} | |
| anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} | |
| anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} | |
| claude_args: "--permission-mode auto" | |
| settings: | | |
| { | |
| "permissions": { | |
| "deny": ["Bash(echo:*)"] | |
| } | |
| } | |
| - name: Verify echo was denied | |
| run: | | |
| OUTPUT_FILE="${{ steps.inline-settings-test.outputs.execution_file }}" | |
| # Check that permission was denied in the tool_result | |
| if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then | |
| echo "✅ Echo command was correctly denied by permissions" | |
| else | |
| echo "❌ Expected permission denied message not found" | |
| cat "$OUTPUT_FILE" | |
| exit 1 | |
| fi | |
| test-settings-file-allow: | |
| # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-24.04-firewall | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Create settings file (echo allowed) | |
| run: | | |
| cat > test-settings.json << EOF | |
| { | |
| "permissions": { | |
| "allow": ["Bash(echo:*)"] | |
| } | |
| } | |
| EOF | |
| - name: Test with settings file | |
| id: file-settings-test | |
| uses: ./base-action | |
| with: | |
| prompt: | | |
| Use Bash to echo "Hello from settings file test" | |
| anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} | |
| anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} | |
| anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} | |
| claude_args: "--permission-mode auto" | |
| settings: "test-settings.json" | |
| - name: Verify echo worked | |
| run: | | |
| OUTPUT_FILE="${{ steps.file-settings-test.outputs.execution_file }}" | |
| CONCLUSION="${{ steps.file-settings-test.outputs.conclusion }}" | |
| echo "Conclusion: $CONCLUSION" | |
| if [ "$CONCLUSION" = "success" ]; then | |
| echo "✅ Action completed successfully" | |
| else | |
| echo "❌ Action failed" | |
| exit 1 | |
| fi | |
| # Check that permission was NOT denied | |
| if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then | |
| echo "❌ Echo command was denied when it should have been allowed" | |
| cat "$OUTPUT_FILE" | |
| exit 1 | |
| fi | |
| # Check if the echo command worked | |
| if grep -q "Hello from settings file test" "$OUTPUT_FILE"; then | |
| echo "✅ Bash echo command worked (allowed by permissions)" | |
| else | |
| echo "❌ Bash echo command didn't work" | |
| cat "$OUTPUT_FILE" | |
| exit 1 | |
| fi | |
| test-settings-file-deny: | |
| # Skip on fork PRs since they can't mint the OIDC token used for Claude API auth | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-24.04-firewall | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Create settings file (echo denied) | |
| run: | | |
| cat > test-settings.json << EOF | |
| { | |
| "permissions": { | |
| "deny": ["Bash(echo:*)"] | |
| } | |
| } | |
| EOF | |
| - name: Test with settings file | |
| id: file-settings-test | |
| uses: ./base-action | |
| with: | |
| prompt: | | |
| Run the command `echo $HOME` to check the home directory path | |
| anthropic_federation_rule_id: ${{ vars.ANTHROPIC_FEDERATION_RULE_ID }} | |
| anthropic_organization_id: ${{ vars.ANTHROPIC_ORGANIZATION_ID }} | |
| anthropic_service_account_id: ${{ vars.ANTHROPIC_SERVICE_ACCOUNT_ID }} | |
| claude_args: "--permission-mode auto" | |
| settings: "test-settings.json" | |
| - name: Verify echo was denied | |
| run: | | |
| OUTPUT_FILE="${{ steps.file-settings-test.outputs.execution_file }}" | |
| # Check that permission was denied in the tool_result | |
| if grep -q "Permission to use Bash with command echo.*has been denied" "$OUTPUT_FILE"; then | |
| echo "✅ Echo command was correctly denied by permissions" | |
| else | |
| echo "❌ Expected permission denied message not found" | |
| cat "$OUTPUT_FILE" | |
| exit 1 | |
| fi |