Summary

In a GitHub Actions workflow using agent mode (an issues trigger with a static prompt input, no @claude mention), passing --permission-mode bypassPermissions via the claude_args input has no effect. The resulting Claude Code session's system/init event reports "permissionMode": "default", and every Bash tool call not already covered by a matching allow-rule is auto-denied with Error: This command requires approval — with no human available to approve in a headless CI run.

Impact

Any automation workflow that relies on --permission-mode bypassPermissions in claude_args to let the agent run unattended (e.g. gh issue edit/gh issue comment for an issue-triage bot) silently fails: the job still exits with success (the SDK completes its turns and returns subtype: success), but every write action the agent attempted was denied, so nothing actually happens. There's no visible failure signal short of manually enabling show_full_output: true and inspecting the raw tool-result stream.

Evidence

Repo: johanzander/bess-manager (private-ish, but happy to share run links/logs on request).

• Before 2026-07-11: runs of our issue-triage workflow show permission_denials_count: 0 and correctly-applied issue labels/comments (e.g. run for issue refactor: update branch naming convention for Kubernetes compatibility #249, 2026-07-09).
• From 2026-07-11 onward: every triage run shows permission_denials_count: 2-3 and zero labels/comments land on the issue, despite the job reporting success.
• We initially suspected a claude-code-action@v1 floating-tag regression, since the compare between the CLI versions bundled around that date (v1.0.169→v1.0.171) shows a Claude Code CLI bump from 2.1.205→2.1.207. However, pinning back to v1.0.169 (CLI 2.1.205) does not fix it — the same run still shows "permissionMode": "default" at session init and denies gh issue view ... with This command requires approval, even though claude_args was --max-turns 12 --permission-mode bypassPermissions --model claude-haiku-4-5 (confirmed reaching the process via CLAUDE_ARGS env var in the action's own debug log).
• We also confirmed this isn't about our repo's own .claude/settings.json allow-list: adding explicit Bash(gh issue view:*)-style allow rules (both space-wildcard and colon-wildcard syntax) made no difference — the very first read-only gh issue view call is denied before any repo-side allow-list should even matter, given --permission-mode bypassPermissions should bypass permission checks entirely.

Workflow snippet (agent mode — prompt supplied directly on an issues event):

- uses: anthropics/claude-code-action@v1
  with:
    claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
    github_token: ${{ steps.app-token.outputs.token }}
    allowed_non_write_users: "*"
    claude_args: "--max-turns 12 --permission-mode bypassPermissions --model claude-haiku-4-5"
    prompt: |
      ...

Representative log excerpt (show_full_output: true):

"claude_args": "--max-turns 12 --permission-mode bypassPermissions --model claude-haiku-4-5",
...
"permissionMode": "default",
...
"claude_code_version": "2.1.205",
...
{
  "type": "assistant",
  "message": { "content": [{ "type": "tool_use", "name": "Bash", "input": { "command": "gh issue view 304 --json title,body,labels,comments" } }] }
}
{
  "type": "user",
  "message": { "content": [{ "type": "tool_result", "content": "This command requires approval", "is_error": true }] }
}

Expected behavior

--permission-mode bypassPermissions passed via claude_args should result in permissionMode: "bypassPermissions" in the session and should not require approval for any tool call, matching documented CLI behavior for that flag.

Actual behavior

Session reports permissionMode: "default" regardless of the requested mode, and every tool call outside a matching allow-rule is denied — with no error surfaced at the job level (subtype: success), making this fail silently.

Environment

• anthropics/claude-code-action — reproduced on both floating @v1 (CLI 2.1.209) and pinned @v1.0.169 (CLI 2.1.205)
• Mode: agent (auto-detected via a static prompt input on an issues: opened/edited/reopened event)
• Auth: claude_code_oauth_token
• Runner: ubuntu-latest (GitHub-hosted)