feat: add allow_workflow_modifications input

action.yml

@@ -150,6 +150,10 @@ inputs:
     description: "Newline-separated list of Claude Code plugin marketplace Git URLs to install from (e.g., 'https://github.com/user/marketplace1.git\nhttps://github.com/user/marketplace2.git')"
     required: false
     default: ""
+  allow_workflow_modifications:
+    description: "Allow Claude to modify files in the .github/workflows directory. Only enable when using a github_token with workflows:write permission (e.g., a custom GitHub App token)."
+    required: false
+    default: "false"
 
 outputs:
   execution_file:
@@ -272,6 +276,7 @@ runs:
         BOT_NAME: ${{ inputs.bot_name }}
         TRACK_PROGRESS: ${{ inputs.track_progress }}
         INCLUDE_FIX_LINKS: ${{ inputs.include_fix_links }}
+        ALLOW_WORKFLOW_MODIFICATIONS: ${{ inputs.allow_workflow_modifications }}
         ADDITIONAL_PERMISSIONS: ${{ inputs.additional_permissions }}
         CLAUDE_ARGS: ${{ inputs.claude_args }}
         ALL_INPUTS: ${{ toJson(inputs) }}

src/create-prompt/index.ts

@@ -846,7 +846,7 @@ What You CANNOT Do:
 - Post multiple comments (you only update your initial comment)
 - Execute commands outside the repository context${useCommitSigning ? "\n- Run arbitrary Bash commands (unless explicitly allowed via allowed_tools configuration)" : ""}
 - Perform branch operations (cannot merge branches, rebase, or perform other git operations beyond creating and pushing commits)
-- Modify files in the .github/workflows directory (GitHub App permissions do not allow workflow modifications)
+${context.githubContext?.inputs?.allowWorkflowModifications ? "" : "- Modify files in the .github/workflows directory (GitHub App permissions do not allow workflow modifications)\n"}
 
 When users ask you to perform actions you cannot do, politely explain the limitation and, when applicable, direct them to the FAQ for more information and workarounds:
 "I'm unable to [specific action] due to [reason]. You can find more information and potential workarounds in the [FAQ](https://github.com/anthropics/claude-code-action/blob/main/docs/faq.md)."

src/github/context.ts

@@ -102,6 +102,7 @@ type BaseContext = {
     includeFixLinks: boolean;
     includeCommentsByActor: string;
     excludeCommentsByActor: string;
+    allowWorkflowModifications: boolean;
   };
 };
 
@@ -164,6 +165,8 @@ export function parseGitHubContext(): GitHubContext {
       includeFixLinks: process.env.INCLUDE_FIX_LINKS === "true",
       includeCommentsByActor: process.env.INCLUDE_COMMENTS_BY_ACTOR ?? "",
       excludeCommentsByActor: process.env.EXCLUDE_COMMENTS_BY_ACTOR ?? "",
+      allowWorkflowModifications:
+        process.env.ALLOW_WORKFLOW_MODIFICATIONS === "true",
     },
   };
 

test/install-mcp-server.test.ts

@@ -43,6 +43,7 @@ describe("prepareMcpConfig", () => {
       includeFixLinks: true,
       includeCommentsByActor: "",
       excludeCommentsByActor: "",
+      allowWorkflowModifications: false,
     },
   };
 

test/mockContext.ts

@@ -30,6 +30,7 @@ const defaultInputs = {
   includeFixLinks: true,
   includeCommentsByActor: "",
   excludeCommentsByActor: "",
+  allowWorkflowModifications: false,
 };
 
 const defaultRepository = {
@@ -64,6 +65,7 @@ export const createMockContext = (
         ...overrides.inputs,
         includeCommentsByActor: overrides.inputs.includeCommentsByActor ?? "",
         excludeCommentsByActor: overrides.inputs.excludeCommentsByActor ?? "",
+        allowWorkflowModifications: overrides.inputs.allowWorkflowModifications ?? false,
       }
     : defaultInputs;
 
@@ -93,6 +95,7 @@ export const createMockAutomationContext = (
         ...overrides.inputs,
         includeCommentsByActor: overrides.inputs.includeCommentsByActor ?? "",
         excludeCommentsByActor: overrides.inputs.excludeCommentsByActor ?? "",
+        allowWorkflowModifications: overrides.inputs.allowWorkflowModifications ?? false,
       }
     : { ...defaultInputs };
 

test/modes/detector.test.ts

@@ -30,6 +30,7 @@ describe("detectMode with enhanced routing", () => {
       includeFixLinks: true,
       includeCommentsByActor: "",
       excludeCommentsByActor: "",
+      allowWorkflowModifications: false,
     },
   };
 

test/permissions.test.ts

@@ -78,6 +78,7 @@ describe("checkWritePermissions", () => {
       includeFixLinks: true,
       includeCommentsByActor: "",
       excludeCommentsByActor: "",
+      allowWorkflowModifications: false,
     },
   });