[Bug]: Claude Code GitHub Workflow permissions issue

[cameroncooke]

Bug Description

There is a problem with the Claude Code workflow that was generated by Claude Codes /install-github-app slash command.

While Claude Code appears to work of issues it fails to create a PR and ultimately pushes a branch to origin. This means when the action working is compete all the code is lost. Claude Code workflow doesn't seem to know this and reports back that everything is complete as evidenced by this issue: #78

Workflow lots:
https://github.com/cameroncooke/XcodeBuildMCP/actions/runs/16463008395/job/46534016868#step:3:1

Claude Codes in the original issue mentions a permissions issue so this might be helpful: https://docs.anthropic.com/en/docs/claude-code/settings

Docs on the Claude Code actions: https://docs.anthropic.com/en/docs/claude-code/github-actions

We need to you

We need tl investigate? I don't see any issues on the repo for the GitHub action that are the same which indicates it might be an issue on our end.

Debug Output

Na

Editor/Client

Claude Code 1.0.54

MCP Server Version

1.10.4

LLM

Na

MCP Configuration

Steps to Reproduce

Na

Expected Behavior

Na

Actual Behavior

Na

Error Messages

[cameroncooke]

@claude please investigate.

[claude]

Claude finished @cameroncooke's task —— View job

---

Claude Code Workflow Permissions Issue - SOLUTION FOUND ✅

I've identified and can fix the Claude Code workflow permissions issue that's preventing PR creation and causing code loss.

Todo List:

• Read repository CLAUDE.md for context
• Examine GitHub workflows for Claude Code configuration
• Analyze workflow permissions and settings
• Check repository settings and permissions
• Review Claude Code documentation requirements
• Provide specific recommendations to fix the issue

---

🚨 Root Cause: Insufficient Workflow Permissions

The Claude Code workflow in .github/workflows/claude.yml has read-only permissions that prevent PR creation.

Current Permissions (BROKEN):

permissions:
  contents: read         # ❌ Only read - cannot push code
  pull-requests: read    # ❌ Only read - cannot create PRs  
  issues: read          # ✅ Sufficient for issue comments
  id-token: write       # ✅ Required for authentication
  actions: read         # ✅ Required for CI results

💡 Complete Solution

Step 1: Update Workflow Permissions

Replace the permissions section in .github/workflows/claude.yml with:

permissions:
  contents: write        # ✅ Required to push branches/commits
  pull-requests: write   # ✅ Required to create pull requests
  issues: write          # ✅ Required to update issue comments
  id-token: write        # ✅ Required for authentication
  actions: read          # ✅ Required for CI results

Step 2: Verify Token Permissions

Ensure your CLAUDE_CODE_OAUTH_TOKEN secret has matching permissions:

• Repository access with write permissions
• Pull requests: write access
• Issues: write access
• Contents: write access

Step 3: Test the Fix

After updating permissions, create a test issue with @claude to verify PR creation works.

---

📋 What Was Happening:

1. Claude Code processes issues and makes code changes ✅
2. Claude Code tries to push changes to a branch ❌ BLOCKED - needs contents: write
3. Claude Code tries to create a PR ❌ BLOCKED - needs pull-requests: write
4. Code gets "lost" because no PR was created to make changes visible 📉

🎯 Expected Result After Fix:

1. Claude Code processes issues and makes code changes ✅
2. Claude Code pushes changes to a new branch ✅
3. Claude Code creates a pull request ✅
4. Code changes are preserved and visible via PR ✅

---

This is a common configuration issue with Claude Code workflows - the fix should resolve the problem immediately.

---

[cameroncooke]

@claude what about the bash permissions issue you reported in the referenced issue?

[claude]

Claude finished @cameroncooke's task —— View job

---

Todo List:

• Read repository context and current workflow configuration
• Investigate the bash permissions issue mentioned in issue [Feature]: Identify how we can utilise the broader Model Context Protocol #78
• Analyze how bash permissions relate to the Claude Code workflow
• Provide explanation and recommendations

---

🔍 The Bash Permissions Issue Explained

You're absolutely right to ask about this! I found the specific bash permissions issue that was mentioned in issue #78.

🚨 Root Cause: Commented-Out allowed_tools Configuration

In .github/workflows/claude.yml lines 52-53, the essential bash permissions are commented out:

# Optional: Allow Claude to run specific commands
# allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"

📋 What This Prevents Claude Code From Doing

Without these bash permissions, Claude Code cannot execute essential development commands:

• ❌ npm install - Installing dependencies
• ❌ npm run build - Building the project (required by CLAUDE.md)
• ❌ npm test - Running tests (required by CLAUDE.md)
• ❌ npm run lint - Code quality checks (required by CLAUDE.md)

🎯 Why This Matters for XcodeBuildMCP

Based on the repository's CLAUDE.md requirements:

1. Build Requirement: "Run npm run build to regenerate the plugin registry"
2. Testing Requirement: "Before claiming any work is complete, you MUST run npm test"
3. Quality Requirement: "All linting and build warnings/errors must always be fixed"

Without bash permissions, Claude Code cannot follow the repository's own development standards!

💡 Complete Solution (Two-Part Fix)

The original workflow permissions issue AND the bash permissions issue need both parts:

Part 1: Workflow Permissions (Previously identified)

permissions:
  contents: write        # ✅ Push branches/commits
  pull-requests: write   # ✅ Create pull requests
  issues: write          # ✅ Update issue comments
  id-token: write        # ✅ Authentication
  actions: read          # ✅ CI results

Part 2: Bash Tool Permissions (The missing piece!)

Uncomment line 53 in .github/workflows/claude.yml:

# Change this:
# allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"

# To this:
allowed_tools: "Bash(npm install),Bash(npm run build),Bash(npm run test:*),Bash(npm run lint:*)"

🔄 How These Issues Connect

1. Workflow permissions → Enables PR creation and code pushing
2. Bash permissions → Enables Claude Code to follow repository development standards
3. Together → Complete functional Claude Code workflow

Both fixes are needed for Claude Code to work properly with this XcodeBuildMCP repository.

---

[cameroncooke]

I've made changes to the workflow can you review @claude

[claude]

Claude finished @cameroncooke's task —— View job

---

Reviewing Claude Code Workflow Changes

Todo List:

• Read the current workflow file to examine changes
• Compare permissions against previous recommendations
• Check bash tool permissions configuration
• Identify any remaining issues or improvements needed
• Provide comprehensive review feedback

---

✅ Excellent Work! Both Critical Issues Fixed

I've reviewed your changes to .github/workflows/claude.yml and can confirm that both major issues have been properly resolved.

🔧 What You Fixed:

1. Workflow Permissions (Lines 21-26) - ✅ RESOLVED

permissions:
  contents: write        # ✅ Was 'read' - now allows pushing branches/commits
  pull-requests: write   # ✅ Was 'read' - now allows creating PRs
  issues: write          # ✅ Was 'read' - now allows updating issue comments
  id-token: write        # ✅ Maintained - required for authentication
  actions: read          # ✅ Maintained - required for CI results

2. Bash Tool Permissions (Line 53) - ✅ RESOLVED

allowed_tools: "Bash(npm install),Bash(npm run build:*),Bash(npm run test:*),Bash(npm run lint:*),Bash(npm run format:*),Bash(npm run diagnostic)"

This is even better than my recommendation! You've expanded the allowed commands to include:

• build:* instead of just build - allows all build-related commands
• format:* - enables code formatting (great for maintaining code style)
• diagnostic - enables the diagnostic CLI mentioned in CLAUDE.md

🎯 Expected Results After These Changes:

1. PR Creation: ✅ Claude Code can now push branches and create pull requests
2. Development Commands: ✅ Claude Code can run all essential npm scripts per CLAUDE.md requirements
3. Code Quality: ✅ Claude Code can maintain build, test, lint, and format standards
4. No More Lost Code: ✅ Changes will be preserved in PRs instead of being lost

📋 Configuration Quality Assessment:

• Security: ✅ Permissions are appropriately scoped (write only where needed)
• Functionality: ✅ All identified issues addressed
• Future-Proofing: ✅ Wildcard patterns (build:*, test:*) accommodate script variations
• Repository Alignment: ✅ Matches CLAUDE.md development requirements perfectly

🚀 Ready for Testing

Your workflow configuration should now work correctly. The next time someone creates an issue with @claude, the workflow should be able to:

• Make code changes
• Run builds, tests, and linting
• Push changes to a branch
• Create a pull request
• Update issue comments with progress

Great job identifying and fixing both permission issues!

---