Fix Claude action pushing with the read-only workflow token

[cristianrgreco]

Summary

@claude could comment on PRs but not push to them. Pushes failed with:

remote: Permission to testcontainers/testcontainers-node.git denied to github-actions[bot].
fatal: unable to access 'https://github.com/testcontainers/testcontainers-node.git/': The requested URL returned error: 403

Example: #1486 (comment) (run).

Cause

• actions/checkout@v7 persists the GITHUB_TOKEN auth header in a separate credentials file, included through includeIf.gitdir: git config entries.
• claude-code-action@v1 only clears the header from local config and include.path, so it logs No existing authentication headers to remove and the header stays.
• That header takes precedence over the Claude app token in the remote URL, so git push authenticates as github-actions[bot] with contents: read.

This is anthropics/claude-code-action#1721, still open upstream.

Fix

Set persist-credentials: false on the checkout step, so the app token is the only git credential. This is the workaround reported in that issue and in anthropics/claude-code-action#1877.

The documented alternative is granting the workflow contents: write. I did not take it: the push would then go out as github-actions[bot], which does not trigger Checks on Claude's commits, and it widens the workflow token.

Known caveat

persist-credentials: false breaks this action on private repositories, because it fetches the PR branch before configuring its own auth (anthropics/claude-code-action#1711). This repository is public, so that fetch works anonymously.

Verification

• npm run format: no fixes applied
• npm run lint: no fixes applied

Not tested end to end. The workflow can only be exercised by an @claude change request on a PR once this change is in place.

Not breaking

Only .github/workflows/claude.yml changes. No package code, public API or published artefact is affected.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 22051ab8-cf1b-4786-9e47-5e60465edea4

---

📥 Commits

Reviewing files that changed from the base of the PR and between 73c03b4 and 304a382.

---

📒 Files selected for processing (1)

• .github/workflows/claude.yml

---

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 4 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The Claude workflow checkout step now sets persist-credentials to false. Comments state that this prevents the read-only GITHUB_TOKEN from overriding the Claude app token on git push.

---

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 304a3

Checkout retains read access and Claude retains separate write access for PR updates, so this change presents no actionable merge-blocking risk.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check		The title clearly identifies the main change: fixing Claude action pushes that use the read-only workflow token.
Description check		The description directly explains the credential conflict, the persist-credentials: false fix, its caveat, and verification status.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}