Skip to content

fix: use --bare and --tools in health probe CLI check #489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
andreatgretel merged 1 commit into from
Apr 2, 2026
Merged

fix: use --bare and --tools in health probe CLI check #489

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/agentic-ci-health-probe.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -87,11 +87,13 @@ jobs:

echo "Claude CLI version: $(claude --version 2>&1 || true)"

# Run a minimal prompt to verify auth + model + tool usage work end-to-end
# Run a minimal prompt to verify auth + model work end-to-end
RESULT=$(claude \
--bare \
Copy link
Copy Markdown
Contributor

@greptile-apps greptile-apps Bot Apr 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 --bare breaks OAuth auth mode

The --bare flag forces ANTHROPIC_API_KEY-based authentication and disables keychain/OAuth reads (as stated in the PR description). However, the "Verify Claude CLI" step runs unconditionally in both auth modes (custom and oauth). In oauth mode, AGENTIC_CI_API_KEY is not set, so ANTHROPIC_API_KEY resolves to an empty string — meaning --bare will force API-key auth but with no key available, causing the health check to fail for all OAuth-mode runners.

The --bare flag should only be applied when in custom auth mode, or the step should be gated with if: steps.auth.outputs.mode == 'custom' (matching the Ping inference API step's guard):

      - name: Verify Claude CLI
        if: steps.auth.outputs.mode == 'custom'
        env:

Or, if OAuth mode should remain supported without --bare, conditionally apply the flag:

BARE_FLAG=""
[ -n "$ANTHROPIC_API_KEY" ] && BARE_FLAG="--bare"

RESULT=$(claude \
  $BARE_FLAG \
  --model "$MODEL" \
  ...
Prompt To Fix With AI 
This is a comment left during a code review.
Path: .github/workflows/agentic-ci-health-probe.yml
Line: 92

Comment:
**`--bare` breaks OAuth auth mode**

The `--bare` flag forces `ANTHROPIC_API_KEY`-based authentication and disables keychain/OAuth reads (as stated in the PR description). However, the "Verify Claude CLI" step runs unconditionally in **both** auth modes (`custom` and `oauth`). In `oauth` mode, `AGENTIC_CI_API_KEY` is not set, so `ANTHROPIC_API_KEY` resolves to an empty string — meaning `--bare` will force API-key auth but with no key available, causing the health check to fail for all OAuth-mode runners.

The `--bare` flag should only be applied when in `custom` auth mode, or the step should be gated with `if: steps.auth.outputs.mode == 'custom'` (matching the `Ping inference API` step's guard):

```yaml
      - name: Verify Claude CLI
        if: steps.auth.outputs.mode == 'custom'
        env:
```

Or, if OAuth mode should remain supported without `--bare`, conditionally apply the flag:

```bash
BARE_FLAG=""
[ -n "$ANTHROPIC_API_KEY" ] && BARE_FLAG="--bare"

RESULT=$(claude \
  $BARE_FLAG \
  --model "$MODEL" \
  ...
```

How can I resolve this? If you propose a fix, please make it concise.

--model "$MODEL" \
-p "Reply with exactly: HEALTH_CHECK_OK" \
--max-turns 1 \
--tools "" \
--output-format text \
2>&1) || {
echo "::error::Claude CLI failed"
Expand Down
Loading