V1 broken - GET /user - 403 (HttpError: Resource not accessible by integration - https://docs.github.com/rest/users/users#get-the-authenticated-user)

[timherby]

Describe the bug
After upgrading from Beta to V1, I'm getting this error and no comments are being posted (though the code review still runs and takes minutes and spends tokens ).

Preparing with mode: agent for event: pull_request
GET /user - 403 with id XXXX:XXXX:XXXXX:XXXXXX:XXXXXXX in 58ms
Failed to configure git authentication: 11 |   /**
12 |    * Response object if a response was received
13 |    */
14 |   response;
15 |   constructor(message, statusCode, options) {
16 |     super(message);
         ^
HttpError: Resource not accessible by integration - https://docs.github.com/rest/users/users#get-the-authenticated-user
   status: 403,
  request: {
  method: "GET",
  url: "https://api.github.com/user",
  headers: [Object ...],
  request: [Object ...],
},
 response: {
  url: "https://api.github.com/user",
  status: 403,
  headers: [Object ...],
  data: [Object ...],
},
      at new RequestError (/home/runner/work/_actions/anthropics/claude-code-action/v1/node_modules/@octokit/rest/node_modules/@octokit/core/node_modules/@octokit/request-error/dist-src/index.js:16:5)
      at fetchWrapper (/home/runner/work/_actions/anthropics/claude-code-action/v1/node_modules/@octokit/rest/node_modules/@octokit/core/node_modules/@octokit/request/dist-bundle/index.js:122:11)
Run echo "Installing base-action dependencies..."
Installing base-action dependencies...

To Reproduce
Her is my .github/workflows/claude-code-review.yml

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize]
    # Optional: Only run on specific file changes
    # paths:
    #   - "src/**/*.ts"
    #   - "src/**/*.tsx"
    #   - "src/**/*.js"
    #   - "src/**/*.jsx"

jobs:
  claude-review:
    # Optional: Filter by PR author
    # if: |
    #   github.event.pull_request.user.login == 'external-contributor' ||
    #   github.event.pull_request.user.login == 'new-developer' ||
    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
      issues: read
      id-token: write
      actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

          # Direct prompt for automated review (no @claude mention needed)
          prompt: |
            REPO: ${{ github.repository }}
            PR NUMBER: ${{ github.event.pull_request.number }}
            AUTHOR: ${{ github.event.pull_request.user.login }}

            Please review this pull request and provide feedback on:
            - Code quality and best practices
            - Potential bugs or issues
            - Performance considerations
            - Security concerns
            - Test coverage
...

and it was previously

name: Claude Code Review

on:
  pull_request:
    types: [opened, synchronize]
    # Optional: Only run on specific file changes
    # paths:
    #   - "src/**/*.ts"
    #   - "src/**/*.tsx"
    #   - "src/**/*.js"
    #   - "src/**/*.jsx"

jobs:
  claude-review:
    # Optional: Filter by PR author
    # if: |
    #   github.event.pull_request.user.login == 'external-contributor' ||
    #   github.event.pull_request.user.login == 'new-developer' ||
    #   github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'

    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
      issues: read
      id-token: write
      actions: read

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          fetch-depth: 1

      - name: Run Claude Code Review
        id: claude-review
        uses: anthropics/claude-code-action@beta
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

          # Optional: Specify model (defaults to Claude Sonnet 4, uncomment for Claude Opus 4.1)
          # model: "claude-opus-4-1-20250805"

          # Direct prompt for automated review (no @claude mention needed)
          direct_prompt: |
            Please review this pull request and provide feedback on:
            - Code quality and best practices
            - Potential bugs or issues
            - Performance considerations
            - Security concerns
            - Test coverage
...

Expected behavior
The PR comments should be working and it should not be hitting GET /user, which fails for the GitHub App token (that endpoint is blocked for App/GITHUB_TOKEN auth).

Workflow yml file
Above

API Provider

[X] Anthropic First-Party API (default)
[ ] AWS Bedrock
[ ] GCP Vertex

Additional context
This may be the same as #9 but that was marked as "compelted" today with no indication of what happened. Is this in V1, in a future version? What is the workaround? Should I (and anyone facing this) return to the Beta? This seems like a major blocker.

Claude.ai suggested I change

    permissions:
      pull-requests: read

to

    permissions:
      pull-requests: write

but that didn't change anything, unsurprisingly since it's fetching GET /user

ChatGPT suggested this as a workaround:

    env:
      # Avoid the /user call by pre-setting a bot identity
      GIT_AUTHOR_NAME: github-actions[bot]
      GIT_AUTHOR_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com
      GIT_COMMITTER_NAME: github-actions[bot]
      GIT_COMMITTER_EMAIL: 41898282+github-actions[bot]@users.noreply.github.com

which I will try, but this seems very hacky.

Any workarounds from the Anthropic team?

[ashwin-ant]

#9 was for an unrelated issue. I think your issue is the same as #520, which should be addressed by #534.

[guidocelada]

I get the same issue while trying to setup Claude Code within Github Actions using LiteLLM (need to setup ANTHROPIC_BASE_URL with the url of LiteLLM, ANTHROPIC_MODEL with the model we have access in LiteLLM and ANTHROPIC_API_KEY with the key generated by LiteLLM).

I guess is related to restrictions in our Github organization settings?

[guidocelada]

@ashwin-ant is this fix released? I'm not able to use the new inputs bot_id and bot_name

[guidocelada]

I understand the release is not there as we need to run https://github.com/anthropics/claude-code-action/actions/workflows/release.yml, is that correct?

[guidocelada]

I was able to bypass the issue by using use_commit_signing 👍

      - name: Run Claude Code
        env:
          ANTHROPIC_BASE_URL: ${{ vars.ANTHROPIC_BASE_URL }}
          ANTHROPIC_MODEL: ${{ vars.ANTHROPIC_MODEL }}
          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        id: claude
        uses: anthropics/claude-code-action@v1
        with:
          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
          use_commit_signing: true
          claude_args: --model ${{ vars.ANTHROPIC_MODEL }}
          prompt: |
            REPO: ${{ github.repository }}
            BRANCH: ${{ github.ref_name }}
            
            Analyze the latest commit in this repository.
            
            Task: Provide a clear, concise summary of what changed in the latest commit. Include the commit message, files changed, and the purpose of the changes.

[ashwin-ant]

@guidocelada This is released in v1 as of yesterday. Please let me know if it works for you!