From 6f6b9c0489623e97cff4f10bde3283e8fb6ba856 Mon Sep 17 00:00:00 2001
From: Mark Wylde <mark@wylde.net>
Date: Fri, 7 Aug 2026 22:24:48 +0100
Subject: [PATCH] fix: support pinned local base action

---
 base-action/action.yml    | 14 ++++++++++++++
 test/github-token.test.ts | 37 +++++++++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+)
 create mode 100644 test/github-token.test.ts

diff --git a/base-action/action.yml b/base-action/action.yml
index 4cb8ae7..57f7e8f 100644
--- a/base-action/action.yml
+++ b/base-action/action.yml
@@ -61,6 +61,10 @@ inputs:
     description: "Timeout in minutes for Claude Code execution"
     required: false
     default: "10"
+  path_to_claude_code_executable:
+    description: "Path to a custom Claude Code executable to use instead of installing"
+    required: false
+    default: ""
 
   # Authentication settings
   anthropic_api_key:
@@ -114,11 +118,21 @@ runs:
         bun install
 
     - name: Install Claude Code
+      if: inputs.path_to_claude_code_executable == ''
       shell: bash
       run: |
         curl -fsSL https://claude.ai/install.sh | bash -s 2.1.173
         echo "$HOME/.local/bin" >> "$GITHUB_PATH"
 
+    - name: Use custom Claude Code executable
+      if: inputs.path_to_claude_code_executable != ''
+      shell: bash
+      env:
+        CLAUDE_CODE_EXECUTABLE: ${{ inputs.path_to_claude_code_executable }}
+      run: |
+        echo "Using custom Claude Code executable: $CLAUDE_CODE_EXECUTABLE"
+        echo "$(dirname "$CLAUDE_CODE_EXECUTABLE")" >> "$GITHUB_PATH"
+
     - name: Run Claude Code Action
       shell: bash
       id: run_claude
diff --git a/test/github-token.test.ts b/test/github-token.test.ts
new file mode 100644
index 0000000..75d40ea
--- /dev/null
+++ b/test/github-token.test.ts
@@ -0,0 +1,37 @@
+import { afterEach, beforeEach, describe, expect, spyOn, test } from "bun:test";
+import * as core from "@actions/core";
+import { setupGitHubToken } from "../src/github/token";
+
+describe("setupGitHubToken", () => {
+  const originalEnv = { ...process.env };
+  let setOutputSpy: ReturnType<typeof spyOn>;
+  let logSpy: ReturnType<typeof spyOn>;
+
+  beforeEach(() => {
+    delete process.env.OVERRIDE_GITHUB_TOKEN;
+    delete process.env.GITHUB_TOKEN;
+    setOutputSpy = spyOn(core, "setOutput").mockImplementation(() => {});
+    logSpy = spyOn(console, "log").mockImplementation(() => {});
+  });
+
+  afterEach(() => {
+    setOutputSpy.mockRestore();
+    logSpy.mockRestore();
+    process.env = { ...originalEnv };
+  });
+
+  test("prefers the explicit Gitea token", async () => {
+    process.env.OVERRIDE_GITHUB_TOKEN = "gitea-token";
+    process.env.GITHUB_TOKEN = "workflow-token";
+
+    expect(await setupGitHubToken()).toBe("gitea-token");
+    expect(setOutputSpy).toHaveBeenCalledWith("GITHUB_TOKEN", "gitea-token");
+  });
+
+  test("falls back to the workflow token without requesting OIDC", async () => {
+    process.env.GITHUB_TOKEN = "workflow-token";
+
+    expect(await setupGitHubToken()).toBe("workflow-token");
+    expect(setOutputSpy).toHaveBeenCalledWith("GITHUB_TOKEN", "workflow-token");
+  });
+});