fix: break SDK iterator after result message to prevent hang in pull_request runs by scobbe · Pull Request #1339 · anthropics/claude-code-action

scobbe · 2026-05-22T02:51:25Z

Problem

In some workflow contexts — reliably reproducible for us on pull_request-triggered runs — the SDK query() iterator does not close after the result message is emitted. The for await loop in runClaudeWithSdk (base-action/src/run-claude-sdk.ts) blocks indefinitely after Claude has finished its work, until the workflow's timeout-minutes cap kills the job.

Symptoms observed in production (4× in our scan-reviewer workflow over the past week):

Claude completes successfully: SDK emits { "type": "result", "subtype": "success", ... } with cost / turns / duration set.
Claude's verdict has already been posted to GitHub during its turns via tools.
The action then sits with zero log output for the remainder of timeout-minutes (we measured 18-19 min of dead time after the result).
Job is cancelled at timeout. writeExecutionFile is never called → no claude-execution-output.json → downstream cost-tracker / post-steps see nothing.
Run shows as cancelled, even though Claude did the work correctly.

Concrete example: scan-reviewer run 26263697343 on sonoma-security/sonoma#1519:

01:48:57  Claude init (Sonnet)
01:50:05  Claude result emitted (success, 13 turns, 68 s, $0.39)
[18 min 43 s of complete silence]
02:08:48  ##[error] The operation was canceled

Author-mode (workflow_dispatch) runs from the same codebase terminate cleanly the same day (we see Log saved to .../claude-execution-output.json within ~1 s of the result message), so the hang is specific to certain event triggers — not a global SDK issue.

Fix

By SDK contract, no further messages follow a result message — it's terminal. Break out of the loop immediately after capturing it, regardless of whether the iterator itself closes cleanly.

if (message.type === "result") {
  resultMessage = message as SDKResultMessage;
+ break;
}

Defensive: eliminates the hang regardless of why the upstream iterator stays open. If the SDK is later fixed to close cleanly in all contexts, the break becomes a no-op.

Test plan

Author-mode runs (workflow_dispatch) that previously terminated cleanly should still terminate cleanly — no behavior change.
Reviewer-mode runs (pull_request) that previously hung at 20-min timeout should now exit within ~1 s of the result message.

We're running the patched version against our scan-reviewer workflow this week via a sonoma-security fork pinned in our workflow YAML; happy to report back when we have data. Glad to add a regression test (mock SDK iterator that yields result then stays open) if the project has a convention for that.

In some workflow contexts — reliably reproducible for us on pull_request-triggered runs of this action — the Claude Agent SDK query() async iterator does not close after the terminal result message is emitted. The for-await loop in runClaudeWithSdk blocks indefinitely after Claude has finished its work, until the workflow's timeout-minutes cap kills the job. Symptoms observed in production (4× in our scan-reviewer workflow): - Claude completes successfully: SDK emits { type: "result", subtype: "success", ... } with the cost / turns / duration set. - The action then sits with zero log output for the rest of timeout-minutes (we measured 18-19 min of dead time after result). - The job is cancelled at timeout. writeExecutionFile is never called → no claude-execution-output.json → cost-tracker and other post-steps see nothing. - Run shows as cancelled, even though Claude did its work and any verdict it posted via gh tools already landed. Author-mode (workflow_dispatch) runs from the same codebase terminate cleanly the same day, so the hang is specific to certain event triggers. By SDK contract the result message is terminal — no further messages follow. Break out of the loop immediately after capturing it, regardless of whether the upstream iterator ever closes. If the SDK is later fixed to close cleanly in all contexts, this break becomes a no-op.

…48 in the github-actions group [skip ci] Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.140 to 1.0.148 Release notes *Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).* > v1.0.148 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.148> > > v1.0.147 > -------- > > What's Changed > -------------- > > * Add pr-stamp-sweep review workflow by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1409](https://redirect.github.com/anthropics/claude-code-action/pull/1409) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.147> > > v1.0.146 > -------- > > What's Changed > -------------- > > * test: add unit tests for parseGitHubContext and context type guards by [`@mateuscmtropical`](https://github.com/mateuscmtropical) in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404) > * docs(faq): correct rebase FAQ to match actual behavior by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370) > * fix: fall back to inherited env for auth when inputs are empty by [`@kirsanium`](https://github.com/kirsanium) in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342) > * fix: break SDK iterator after result message to prevent hang in pull\_request runs by [`@scobbe`](https://github.com/scobbe) in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339) > * Pin setup-bun binary for post-steps by [`@kiwigitops`](https://github.com/kiwigitops) in [anthropics/claude-code-action#1365](https://redirect.github.com/anthropics/claude-code-action/pull/1365) > * fix: clear stale claude-prompts dir before each write by [`@kyungilpark`](https://github.com/kyungilpark) in [anthropics/claude-code-action#1288](https://redirect.github.com/anthropics/claude-code-action/pull/1288) > * Include labels in formatContext() output for issues and PRs by [`@joshpayne-joby`](https://github.com/joshpayne-joby) in [anthropics/claude-code-action#1298](https://redirect.github.com/anthropics/claude-code-action/pull/1298) > * fix(sanitizer): match attribute quotes by type to avoid mangling content by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1371](https://redirect.github.com/anthropics/claude-code-action/pull/1371) > * docs: fix execution file parsing example by [`@looooown2006`](https://github.com/looooown2006) in [anthropics/claude-code-action#1297](https://redirect.github.com/anthropics/claude-code-action/pull/1297) > * fix(image-downloader): detect image type from magic bytes, not URL extension by [`@pmespresso`](https://github.com/pmespresso) in [anthropics/claude-code-action#1396](https://redirect.github.com/anthropics/claude-code-action/pull/1396) > > New Contributors > ---------------- > > * [`@mateuscmtropical`](https://github.com/mateuscmtropical) made their first contribution in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404) > * [`@bymle`](https://github.com/bymle) made their first contribution in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370) > * [`@kirsanium`](https://github.com/kirsanium) made their first contribution in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342) > * [`@scobbe`](https://github.com/scobbe) made their first contribution in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339) > * [`@kiwigitops`](https://github.com/kiwigitops) made their first contribution in [anthropics/claude-code-action#1365](https://redirect.github.com/anthropics/claude-code-action/pull/1365) > * [`@kyungilpark`](https://github.com/kyungilpark) made their first contribution in [anthropics/claude-code-action#1288](https://redirect.github.com/anthropics/claude-code-action/pull/1288) > * [`@joshpayne-joby`](https://github.com/joshpayne-joby) made their first contribution in [anthropics/claude-code-action#1298](https://redirect.github.com/anthropics/claude-code-action/pull/1298) > * [`@looooown2006`](https://github.com/looooown2006) made their first contribution in [anthropics/claude-code-action#1297](https://redirect.github.com/anthropics/claude-code-action/pull/1297) > * [`@pmespresso`](https://github.com/pmespresso) made their first contribution in [anthropics/claude-code-action#1396](https://redirect.github.com/anthropics/claude-code-action/pull/1396) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.146> > > v1.0.145 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.145> > > v1.0.144 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.144> > > v1.0.143 > -------- > > What's Changed > -------------- > > * Drop --tsconfig-override from Bun invocations to avoid runtime crash by [`@chsmc-ant`](https://github.com/chsmc-ant) in [anthropics/claude-code-action#1315](https://redirect.github.com/anthropics/claude-code-action/pull/1315) > > New Contributors > ---------------- > > * [`@chsmc-ant`](https://github.com/chsmc-ant) made their first contribution in [anthropics/claude-code-action#1315](https://redirect.github.com/anthropics/claude-code-action/pull/1315) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.143> ... (truncated) Commits * [`d5726de`](anthropics/claude-code-action@d5726de) chore: bump Claude Code to 2.1.177 and Agent SDK to 0.3.177 * [`56fa348`](anthropics/claude-code-action@56fa348) chore: bump Claude Code to 2.1.176 and Agent SDK to 0.3.176 * [`82d95d4`](anthropics/claude-code-action@82d95d4) Add pr-stamp-sweep review workflow ([#1409](https://redirect.github.com/anthropics/claude-code-action/issues/1409)) * [`0cb4f3e`](anthropics/claude-code-action@0cb4f3e) chore: bump Claude Code to 2.1.175 and Agent SDK to 0.3.175 * [`8551f4b`](anthropics/claude-code-action@8551f4b) fix(image-downloader): detect image type from magic bytes ([#1396](https://redirect.github.com/anthropics/claude-code-action/issues/1396)) * [`eba921f`](anthropics/claude-code-action@eba921f) docs: fix execution file parsing example ([#1297](https://redirect.github.com/anthropics/claude-code-action/issues/1297)) * [`36617bd`](anthropics/claude-code-action@36617bd) fix(sanitizer): match attribute quotes by type to avoid mangling content ([#1371](https://redirect.github.com/anthropics/claude-code-action/issues/1371)) * [`24b9156`](anthropics/claude-code-action@24b9156) Include labels in formatContext() output for issues and PRs ([#1298](https://redirect.github.com/anthropics/claude-code-action/issues/1298)) * [`9441a7f`](anthropics/claude-code-action@9441a7f) fix: clear stale claude-prompts dir before each write ([#1288](https://redirect.github.com/anthropics/claude-code-action/issues/1288)) * [`b371255`](anthropics/claude-code-action@b371255) pin setup-bun path for post steps ([#1365](https://redirect.github.com/anthropics/claude-code-action/issues/1365)) * Additional commits viewable in [compare view](anthropics/claude-code-action@fbda2eb...d5726de) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=anthropics/claude-code-action&package-manager=github\_actions&previous-version=1.0.140&new-version=1.0.148)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

Bumps the github-actions group with 4 updates: [actions/setup-java](https://github.com/actions/setup-java), [graalvm/setup-graalvm](https://github.com/graalvm/setup-graalvm), [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [ruby/setup-ruby](https://github.com/ruby/setup-ruby). Updates `actions/setup-java` from 5.2.0 to 5.3.0 Release notes *Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).* > v5.3.0 > ------ > > What's Changed > -------------- > > * chore: update Java version to 25 in setup examples by [`@alaahong`](https://github.com/alaahong) in [actions/setup-java#969](https://redirect.github.com/actions/setup-java/pull/969) > * Bump minimatch from 3.1.2 to 3.1.5 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#984](https://redirect.github.com/actions/setup-java/pull/984) > * Refactor error handling and improve test logging for installers by [`@chiranjib-swain`](https://github.com/chiranjib-swain) in [actions/setup-java#989](https://redirect.github.com/actions/setup-java/pull/989) > * chore: upgrade dependencies (`@actions/core`, cache, glob, http-client, tool-cache, xmlbuilder2) by [`@Copilot`](https://github.com/Copilot) in [actions/setup-java#999](https://redirect.github.com/actions/setup-java/pull/999) > * Add Oracle JDK 17 licensing limitation note by [`@mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-java#1001](https://redirect.github.com/actions/setup-java/pull/1001) > * Update readme for ubuntu sudo java\_home behavior by [`@mahabaleshwars`](https://github.com/mahabaleshwars) in [actions/setup-java#1013](https://redirect.github.com/actions/setup-java/pull/1013) > * temurin: add support for Alpine Linux by [`@gdams`](https://github.com/gdams) in [actions/setup-java#674](https://redirect.github.com/actions/setup-java/pull/674) > * fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser by [`@gdams`](https://github.com/gdams) in [actions/setup-java#1015](https://redirect.github.com/actions/setup-java/pull/1015) > * Bump `@typescript-eslint/eslint-plugin` from 8.35.1 to 8.48.0 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#952](https://redirect.github.com/actions/setup-java/pull/952) > * Bump eslint-config-prettier from 8.10.0 to 10.1.8 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#881](https://redirect.github.com/actions/setup-java/pull/881) > * Bump picomatch, `@types/jest`, jest, jest-circus and ts-jest by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1016](https://redirect.github.com/actions/setup-java/pull/1016) > * Bump `@types/node` from 24.1.0 to 25.9.3 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#950](https://redirect.github.com/actions/setup-java/pull/950) > * Implement pagination with link headers for Adoptium based apis by [`@johnoliver`](https://github.com/johnoliver) in [actions/setup-java#1014](https://redirect.github.com/actions/setup-java/pull/1014) > * Make the Adoptopenjdk package type look at the Temurin repo first for latest assets by [`@johnoliver`](https://github.com/johnoliver) in [actions/setup-java#522](https://redirect.github.com/actions/setup-java/pull/522) > * Bump `@vercel/ncc` from 0.38.1 to 0.44.0 by [`@dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1018](https://redirect.github.com/actions/setup-java/pull/1018) > > New Contributors > ---------------- > > * [`@alaahong`](https://github.com/alaahong) made their first contribution in [actions/setup-java#969](https://redirect.github.com/actions/setup-java/pull/969) > * [`@Copilot`](https://github.com/Copilot) made their first contribution in [actions/setup-java#999](https://redirect.github.com/actions/setup-java/pull/999) > * [`@johnoliver`](https://github.com/johnoliver) made their first contribution in [actions/setup-java#1014](https://redirect.github.com/actions/setup-java/pull/1014) > > **Full Changelog**: <actions/setup-java@v5...v5.3.0> Commits * [`ad2b381`](actions/setup-java@ad2b381) Bump `@vercel/ncc` from 0.38.1 to 0.44.0 ([#1018](https://redirect.github.com/actions/setup-java/issues/1018)) * [`b24df5b`](actions/setup-java@b24df5b) Make the Adoptopenjdk package type look at the Temurin repo first for latest ... * [`43120bc`](actions/setup-java@43120bc) Implement pagination with link headers for Adoptium based apis ([#1014](https://redirect.github.com/actions/setup-java/issues/1014)) * [`ad9d6a6`](actions/setup-java@ad9d6a6) Bump `@types/node` from 24.1.0 to 25.9.3 ([#950](https://redirect.github.com/actions/setup-java/issues/950)) * [`039af37`](actions/setup-java@039af37) Bump picomatch, `@types/jest`, jest, jest-circus and ts-jest ([#1016](https://redirect.github.com/actions/setup-java/issues/1016)) * [`1756ab6`](actions/setup-java@1756ab6) Bump eslint-config-prettier from 8.10.0 to 10.1.8 ([#881](https://redirect.github.com/actions/setup-java/issues/881)) * [`662bb59`](actions/setup-java@662bb59) Bump `@typescript-eslint/eslint-plugin` from 8.35.1 to 8.46.2 ([#952](https://redirect.github.com/actions/setup-java/issues/952)) * [`1071fc1`](actions/setup-java@1071fc1) fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parse... * [`576b821`](actions/setup-java@576b821) Merge pull request [#674](https://redirect.github.com/actions/setup-java/issues/674) from gdams/alpine * [`307d3a2`](actions/setup-java@307d3a2) update readme for ubuntu sudo java\_home behavior ([#1013](https://redirect.github.com/actions/setup-java/issues/1013)) * Additional commits viewable in [compare view](actions/setup-java@be666c2...ad2b381) Updates `graalvm/setup-graalvm` from 1.5.4 to 1.5.6 Release notes *Sourced from [graalvm/setup-graalvm's releases](https://github.com/graalvm/setup-graalvm/releases).* > v1.5.6 > ------ > > What's Changed > -------------- > > * Always set up MSVC environment on Windows by [`@gastaldi`](https://github.com/gastaldi) in [graalvm/setup-graalvm#221](https://redirect.github.com/graalvm/setup-graalvm/pull/221) > > **Full Changelog**: <graalvm/setup-graalvm@v1.5.5...v1.5.6> > > v1.5.5 > ------ > > What's Changed > -------------- > > * Add Visual Studio 2026 to known installations by [`@gastaldi`](https://github.com/gastaldi) in [graalvm/setup-graalvm#219](https://redirect.github.com/graalvm/setup-graalvm/pull/219) > > New Contributors > ---------------- > > * [`@gastaldi`](https://github.com/gastaldi) made their first contribution in [graalvm/setup-graalvm#219](https://redirect.github.com/graalvm/setup-graalvm/pull/219) > > **Full Changelog**: <graalvm/setup-graalvm@v1.5.4...v1.5.5> Commits * [`6f3fa03`](graalvm/setup-graalvm@6f3fa03) Bump version to `1.5.6`. * [`74ee89f`](graalvm/setup-graalvm@74ee89f) Run `npm audit fix`. * [`0ad466a`](graalvm/setup-graalvm@0ad466a) Always set up MSVC environment on Windows * [`809afe6`](graalvm/setup-graalvm@809afe6) Bump version to `1.5.5`. * [`44ffb1c`](graalvm/setup-graalvm@44ffb1c) Fix VS 2026 installation path to use internal version number * [`e1d3380`](graalvm/setup-graalvm@e1d3380) Add Visual Studio 2026 to known installations * See full diff in [compare view](graalvm/setup-graalvm@329c42c...6f3fa03) Updates `anthropics/claude-code-action` from 1.0.144 to 1.0.151 Release notes *Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).* > v1.0.151 > -------- > > What's Changed > -------------- > > * fix: skip workflow validation token exchange failures by [`@Ryanoonan`](https://github.com/Ryanoonan) in [anthropics/claude-code-action#1417](https://redirect.github.com/anthropics/claude-code-action/pull/1417) > > New Contributors > ---------------- > > * [`@Ryanoonan`](https://github.com/Ryanoonan) made their first contribution in [anthropics/claude-code-action#1417](https://redirect.github.com/anthropics/claude-code-action/pull/1417) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.151> > > v1.0.150 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.150> > > v1.0.149 > -------- > > What's Changed > -------------- > > * fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*) rules to bare Bash by [`@alexglynn`](https://github.com/alexglynn) in [anthropics/claude-code-action#1350](https://redirect.github.com/anthropics/claude-code-action/pull/1350) > * fix(mcp): align allowed-tools parser with SDK option parser by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1373](https://redirect.github.com/anthropics/claude-code-action/pull/1373) > > New Contributors > ---------------- > > * [`@alexglynn`](https://github.com/alexglynn) made their first contribution in [anthropics/claude-code-action#1350](https://redirect.github.com/anthropics/claude-code-action/pull/1350) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.149> > > v1.0.148 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.148> > > v1.0.147 > -------- > > What's Changed > -------------- > > * Add pr-stamp-sweep review workflow by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1409](https://redirect.github.com/anthropics/claude-code-action/pull/1409) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.147> > > v1.0.146 > -------- > > What's Changed > -------------- > > * test: add unit tests for parseGitHubContext and context type guards by [`@mateuscmtropical`](https://github.com/mateuscmtropical) in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404) > * docs(faq): correct rebase FAQ to match actual behavior by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370) > * fix: fall back to inherited env for auth when inputs are empty by [`@kirsanium`](https://github.com/kirsanium) in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342) > * fix: break SDK iterator after result message to prevent hang in pull\_request runs by [`@scobbe`](https://github.com/scobbe) in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339) > * Pin setup-bun binary for post-steps by [`@kiwigitops`](https://github.com/kiwigitops) in [anthropics/claude-code-action#1365](https://redirect.github.com/anthropics/claude-code-action/pull/1365) > * fix: clear stale claude-prompts dir before each write by [`@kyungilpark`](https://github.com/kyungilpark) in [anthropics/claude-code-action#1288](https://redirect.github.com/anthropics/claude-code-action/pull/1288) > * Include labels in formatContext() output for issues and PRs by [`@joshpayne-joby`](https://github.com/joshpayne-joby) in [anthropics/claude-code-action#1298](https://redirect.github.com/anthropics/claude-code-action/pull/1298) > * fix(sanitizer): match attribute quotes by type to avoid mangling content by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1371](https://redirect.github.com/anthropics/claude-code-action/pull/1371) > * docs: fix execution file parsing example by [`@looooown2006`](https://github.com/looooown2006) in [anthropics/claude-code-action#1297](https://redirect.github.com/anthropics/claude-code-action/pull/1297) > * fix(image-downloader): detect image type from magic bytes, not URL extension by [`@pmespresso`](https://github.com/pmespresso) in [anthropics/claude-code-action#1396](https://redirect.github.com/anthropics/claude-code-action/pull/1396) > > New Contributors > ---------------- > > * [`@mateuscmtropical`](https://github.com/mateuscmtropical) made their first contribution in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404) > * [`@bymle`](https://github.com/bymle) made their first contribution in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370) > * [`@kirsanium`](https://github.com/kirsanium) made their first contribution in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342) > * [`@scobbe`](https://github.com/scobbe) made their first contribution in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339) ... (truncated) Commits * [`806af32`](anthropics/claude-code-action@806af32) chore: bump Claude Code to 2.1.181 and Agent SDK to 0.3.181 * [`0a08a86`](anthropics/claude-code-action@0a08a86) fix: skip workflow validation token exchange failures ([#1417](https://redirect.github.com/anthropics/claude-code-action/issues/1417)) * [`9dd8b95`](anthropics/claude-code-action@9dd8b95) chore: bump Claude Code to 2.1.179 and Agent SDK to 0.3.179 * [`4d7e1f0`](anthropics/claude-code-action@4d7e1f0) chore: bump Claude Code to 2.1.178 and Agent SDK to 0.3.178 * [`3d9f0dc`](anthropics/claude-code-action@3d9f0dc) fix(mcp): align allowed-tools parser with SDK option parser ([#1373](https://redirect.github.com/anthropics/claude-code-action/issues/1373)) * [`a5e5d3b`](anthropics/claude-code-action@a5e5d3b) fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:\*... * [`d5726de`](anthropics/claude-code-action@d5726de) chore: bump Claude Code to 2.1.177 and Agent SDK to 0.3.177 * [`56fa348`](anthropics/claude-code-action@56fa348) chore: bump Claude Code to 2.1.176 and Agent SDK to 0.3.176 * [`82d95d4`](anthropics/claude-code-action@82d95d4) Add pr-stamp-sweep review workflow ([#1409](https://redirect.github.com/anthropics/claude-code-action/issues/1409)) * [`0cb4f3e`](anthropics/claude-code-action@0cb4f3e) chore: bump Claude Code to 2.1.175 and Agent SDK to 0.3.175 * Additional commits viewable in [compare view](anthropics/claude-code-action@0f97b95...806af32) Updates `ruby/setup-ruby` from 1.312.0 to 1.313.0 Release notes *Sourced from [ruby/setup-ruby's releases](https://github.com/ruby/setup-ruby/releases).* > v1.313.0 > -------- > > What's Changed > -------------- > > * Add jruby-10.0.6.0 by [`@ruby-builder-bot`](https://github.com/ruby-builder-bot) in [ruby/setup-ruby#921](https://redirect.github.com/ruby/setup-ruby/pull/921) > > **Full Changelog**: <ruby/setup-ruby@v1.312.0...v1.313.0> Commits * [`89f9052`](ruby/setup-ruby@89f9052) Add jruby-10.0.6.0 * See full diff in [compare view](ruby/setup-ruby@12fd324...89f9052) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

…48 in the github-actions group [skip ci] Bumps the github-actions group with 1 update: [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action). Updates `anthropics/claude-code-action` from 1.0.140 to 1.0.148 Release notes *Sourced from [anthropics/claude-code-action's releases](https://github.com/anthropics/claude-code-action/releases).* > v1.0.148 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.148> > > v1.0.147 > -------- > > What's Changed > -------------- > > * Add pr-stamp-sweep review workflow by [`@ashwin-ant`](https://github.com/ashwin-ant) in [anthropics/claude-code-action#1409](https://redirect.github.com/anthropics/claude-code-action/pull/1409) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.147> > > v1.0.146 > -------- > > What's Changed > -------------- > > * test: add unit tests for parseGitHubContext and context type guards by [`@mateuscmtropical`](https://github.com/mateuscmtropical) in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404) > * docs(faq): correct rebase FAQ to match actual behavior by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370) > * fix: fall back to inherited env for auth when inputs are empty by [`@kirsanium`](https://github.com/kirsanium) in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342) > * fix: break SDK iterator after result message to prevent hang in pull\_request runs by [`@scobbe`](https://github.com/scobbe) in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339) > * Pin setup-bun binary for post-steps by [`@kiwigitops`](https://github.com/kiwigitops) in [anthropics/claude-code-action#1365](https://redirect.github.com/anthropics/claude-code-action/pull/1365) > * fix: clear stale claude-prompts dir before each write by [`@kyungilpark`](https://github.com/kyungilpark) in [anthropics/claude-code-action#1288](https://redirect.github.com/anthropics/claude-code-action/pull/1288) > * Include labels in formatContext() output for issues and PRs by [`@joshpayne-joby`](https://github.com/joshpayne-joby) in [anthropics/claude-code-action#1298](https://redirect.github.com/anthropics/claude-code-action/pull/1298) > * fix(sanitizer): match attribute quotes by type to avoid mangling content by [`@bymle`](https://github.com/bymle) in [anthropics/claude-code-action#1371](https://redirect.github.com/anthropics/claude-code-action/pull/1371) > * docs: fix execution file parsing example by [`@looooown2006`](https://github.com/looooown2006) in [anthropics/claude-code-action#1297](https://redirect.github.com/anthropics/claude-code-action/pull/1297) > * fix(image-downloader): detect image type from magic bytes, not URL extension by [`@pmespresso`](https://github.com/pmespresso) in [anthropics/claude-code-action#1396](https://redirect.github.com/anthropics/claude-code-action/pull/1396) > > New Contributors > ---------------- > > * [`@mateuscmtropical`](https://github.com/mateuscmtropical) made their first contribution in [anthropics/claude-code-action#1404](https://redirect.github.com/anthropics/claude-code-action/pull/1404) > * [`@bymle`](https://github.com/bymle) made their first contribution in [anthropics/claude-code-action#1370](https://redirect.github.com/anthropics/claude-code-action/pull/1370) > * [`@kirsanium`](https://github.com/kirsanium) made their first contribution in [anthropics/claude-code-action#1342](https://redirect.github.com/anthropics/claude-code-action/pull/1342) > * [`@scobbe`](https://github.com/scobbe) made their first contribution in [anthropics/claude-code-action#1339](https://redirect.github.com/anthropics/claude-code-action/pull/1339) > * [`@kiwigitops`](https://github.com/kiwigitops) made their first contribution in [anthropics/claude-code-action#1365](https://redirect.github.com/anthropics/claude-code-action/pull/1365) > * [`@kyungilpark`](https://github.com/kyungilpark) made their first contribution in [anthropics/claude-code-action#1288](https://redirect.github.com/anthropics/claude-code-action/pull/1288) > * [`@joshpayne-joby`](https://github.com/joshpayne-joby) made their first contribution in [anthropics/claude-code-action#1298](https://redirect.github.com/anthropics/claude-code-action/pull/1298) > * [`@looooown2006`](https://github.com/looooown2006) made their first contribution in [anthropics/claude-code-action#1297](https://redirect.github.com/anthropics/claude-code-action/pull/1297) > * [`@pmespresso`](https://github.com/pmespresso) made their first contribution in [anthropics/claude-code-action#1396](https://redirect.github.com/anthropics/claude-code-action/pull/1396) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.146> > > v1.0.145 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.145> > > v1.0.144 > -------- > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.144> > > v1.0.143 > -------- > > What's Changed > -------------- > > * Drop --tsconfig-override from Bun invocations to avoid runtime crash by [`@chsmc-ant`](https://github.com/chsmc-ant) in [anthropics/claude-code-action#1315](https://redirect.github.com/anthropics/claude-code-action/pull/1315) > > New Contributors > ---------------- > > * [`@chsmc-ant`](https://github.com/chsmc-ant) made their first contribution in [anthropics/claude-code-action#1315](https://redirect.github.com/anthropics/claude-code-action/pull/1315) > > **Full Changelog**: <anthropics/claude-code-action@v1...v1.0.143> ... (truncated) Commits * [`d5726de`](anthropics/claude-code-action@d5726de) chore: bump Claude Code to 2.1.177 and Agent SDK to 0.3.177 * [`56fa348`](anthropics/claude-code-action@56fa348) chore: bump Claude Code to 2.1.176 and Agent SDK to 0.3.176 * [`82d95d4`](anthropics/claude-code-action@82d95d4) Add pr-stamp-sweep review workflow ([ArcadeData#1409](https://redirect.github.com/anthropics/claude-code-action/issues/1409)) * [`0cb4f3e`](anthropics/claude-code-action@0cb4f3e) chore: bump Claude Code to 2.1.175 and Agent SDK to 0.3.175 * [`8551f4b`](anthropics/claude-code-action@8551f4b) fix(image-downloader): detect image type from magic bytes ([ArcadeData#1396](https://redirect.github.com/anthropics/claude-code-action/issues/1396)) * [`eba921f`](anthropics/claude-code-action@eba921f) docs: fix execution file parsing example ([ArcadeData#1297](https://redirect.github.com/anthropics/claude-code-action/issues/1297)) * [`36617bd`](anthropics/claude-code-action@36617bd) fix(sanitizer): match attribute quotes by type to avoid mangling content ([ArcadeData#1371](https://redirect.github.com/anthropics/claude-code-action/issues/1371)) * [`24b9156`](anthropics/claude-code-action@24b9156) Include labels in formatContext() output for issues and PRs ([ArcadeData#1298](https://redirect.github.com/anthropics/claude-code-action/issues/1298)) * [`9441a7f`](anthropics/claude-code-action@9441a7f) fix: clear stale claude-prompts dir before each write ([ArcadeData#1288](https://redirect.github.com/anthropics/claude-code-action/issues/1288)) * [`b371255`](anthropics/claude-code-action@b371255) pin setup-bun path for post steps ([ArcadeData#1365](https://redirect.github.com/anthropics/claude-code-action/issues/1365)) * Additional commits viewable in [compare view](anthropics/claude-code-action@fbda2eb...d5726de) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=anthropics/claude-code-action&package-manager=github\_actions&previous-version=1.0.140&new-version=1.0.148)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

scobbe mentioned this pull request May 28, 2026

fix: bypass triggering-actor permission check when PR author is in allowed_bots sonoma-security/claude-code-action#1

Closed

4 tasks

ashwin-ant approved these changes Jun 12, 2026

View reviewed changes

ashwin-ant merged commit 84d317e into anthropics:main Jun 12, 2026

claude Bot mentioned this pull request Jun 13, 2026

build(deps): update anthropics/claude-code-action action to v1.0.146 ncaq/kyosei-action#160

Merged

1 task

github-actions Bot mentioned this pull request Jun 17, 2026

chore(deps): update anthropics/claude-code-action action to v1.0.146 lacolaco/zenn#321

Merged

1 task

This was referenced Jun 22, 2026

chore(deps): update github actions to v1.0.148 lacolaco/discord-rotom-bot#128

Merged

fix(deps): update anthropics/claude-code-action action to v1.0.159 koki-develop/claude-renovate-review#47

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: break SDK iterator after result message to prevent hang in pull_request runs#1339

fix: break SDK iterator after result message to prevent hang in pull_request runs#1339
ashwin-ant merged 1 commit into
anthropics:mainfrom
sonoma-security:fix/sdk-iterator-hang-after-result-message

scobbe commented May 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

scobbe commented May 22, 2026

Problem

Fix

Test plan

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants