Issues with Tool Authorization: Claude pauses for approval despite using --allowedTools

[Ranzaaroor]

Hi everyone,

I’m working on a workflow where a Claude Code Action audits PR diffs and, if necessary, checks out a branch to create a new PR to master.

I'm hitting a roadblock where Claude consistently pauses to ask for manual permission to run commands like gh pr view or gh issue close, even though I have explicitly added these to the --allowedTools configuration. Since this is running in a CI environment, the process just hangs or fails because there is no way to provide manual approval.

I’ve tried:

Adding Bash(gh *) and Bash(git *) to the allowed tools.

Explicitly listing subcommands like Bash(gh issue close*).

Passing the GH_TOKEN environment variable.

Has anyone successfully implemented a fully "hands-off" automation with the GitHub CLI tools? Am I missing a specific flag to force non-interactive mode for these authorized tools?

Thanks!

[Ejb503]

The Bash(gh *) pattern in --allowedTools matches the literal command prefix, but tools like gh pr view get expanded by the shell before the pattern matcher sees them. Try listing each command explicitly:

--allowedTools "Bash(gh pr *)" "Bash(gh issue *)" "Bash(git *)"

If you want to skip permission checks entirely in CI (where there is no interactive terminal to approve), pass --dangerously-skip-permissions. This is safe in CI because the action already runs in an isolated environment with scoped GitHub token permissions. The process hangs without it because Claude Code waits for interactive approval that never comes.

Alternatively, you can set permissions in settings.json under permissions.allow and pass the settings file via the settings input on the action. But note that --allowedTools via claude_args takes precedence over settings.json when both are present.

[mj-deving]

The real issue: Bash is disabled by default in Claude Code Action

Your glob patterns are fine -- the actual problem is that the Bash tool itself isn't available to Claude by default in Claude Code Action. From the configuration docs:

Claude does not have access to execute arbitrary Bash commands by default. If you want Claude to run specific commands (e.g., npm install, npm test), you must explicitly allow them using the claude_args configuration.

What's happening: --allowedTools "Bash(gh *)" tells Claude "don't ask permission for gh commands" -- but Bash isn't even in the tool set. You're granting permission for something that was never offered in the first place.

How to fix it

Option 1: Explicit allowedTools with correct syntax (recommended)

- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    claude_args: |
      --allowedTools "Bash(gh:*),Bash(git:*)"

Here's how the pattern syntax actually works:

Pattern	Matches	Does NOT match
Bash(gh *)	gh pr view, gh issue close 5	ghcr.io/pull
Bash(gh:*)	Same as above (:* is equivalent to *)	Same
Bash(gh pr *)	gh pr view, gh pr checkout 42	gh issue close
Bash(gh*)	gh pr view AND ghcr.io/pull (no word boundary!)	--

That space before * matters. Bash(gh *) enforces a word boundary -- it requires a space or end-of-string after gh. Drop the space with Bash(gh*) and it'll also match ghcr.io. The :* suffix is just shorthand for the same trailing wildcard, so Bash(gh:*) and Bash(gh *) behave identically.

One * spans multiple arguments. Bash(gh *) matches gh pr view --json url without any issues -- you don't need to list every subcommand separately.

Option 2: Use settings input with permissions block

For more granular control, pass a settings object instead:

- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    settings: |
      {
        "permissions": {
          "allow": [
            "Bash(gh:*)",
            "Bash(git:*)"
          ],
          "deny": [
            "Bash(git push:*)",
            "Bash(git rebase:*)"
          ]
        }
      }

This lets you allow git broadly while still blocking destructive operations.

Option 3: bypassPermissions mode (CI-safe alternative to --dangerously-skip-permissions)

If your workflow runs in an isolated CI environment and you want zero prompts:

claude_args: |
  --permission-mode bypassPermissions

This skips all permission prompts except writes to protected dirs (.git, .claude, .vscode). It replaces the deprecated --dangerously-skip-permissions flag and was built specifically for isolated environments like CI runners.

Correcting a misconception from the earlier reply

"tools like gh pr view get expanded by the shell before the pattern matcher sees them"

That's not how it works. Claude Code matches the pattern against the command string before shell execution. No shell expansion happens first. Bash(gh *) absolutely matches gh pr view -- a single * matches any character sequence including spaces.

The actual reason the OP's setup hangs: Bash isn't in Claude Code Action's default tool set. The --allowedTools flag adds tools to the allow list (skipping permission prompts), but the tool has to be available to begin with. The action ships with file operations, comment management, and GitHub MCP tools by default. Bash needs to be explicitly enabled.

Compound commands caveat

When Claude runs compound commands like gh pr view 42 && git checkout main, each subcommand gets checked independently against your rules. So you need both Bash(gh:*) and Bash(git:*) in your allow list. The permissions docs call this out:

A rule must match each subcommand independently.

MCP tools (bonus)

If you're using MCP servers (like the built-in GitHub MCP), those follow a different naming convention:

mcp__<server-name>__<tool-name>

For example: mcp__github__create_pull_request. You can wildcard an entire server with mcp__github__* or just mcp__github. These are completely separate from Bash permissions.

Precedence rules (important)

1. Deny always wins. If a tool is denied at any level, nothing else can override that.
2. Settings precedence: Managed settings > CLI args > .claude/settings.local.json > .claude/settings.json > ~/.claude/settings.json
3. --disallowedTools always overrides --allowedTools for the same pattern.