[BUG] Claude Code 2.1.247 in GitHub Actions (claude-code-action v1.0.207) fails right after init: is_error:true, no model response, no error message; last known-good is v1.0.206 (2.1.246)

Summary

After the claude-code-action@v1 tag moved to v1.0.207 (2026-08-27T00:10:36Z, bundling Claude Code CLI 2.1.247 / Agent SDK 0.3.247), all observed executions of the action in our repository — two independent workflows, across two independent PRs, 10 run attempts total — fail immediately after CLI initialization with is_error: true, no model response recorded, and no error message. The last executions on v1.0.206 (CLI 2.1.246) the previous day succeeded. The action diff v1.0.206...v1.0.207 contains only the CLI/SDK version bump (no logic changes), so a regression in Claude Code 2.1.247 / Agent SDK 0.3.247 is our leading hypothesis — though we cannot fully rule out an external account/org-side state change, and we do not yet have a rollback A/B on the same runner (see "What we could NOT verify yet").

Regardless of the root cause, the diagnosability issue stands: an instant is_error: true with subtype: "success" and no error text gives operators nothing to debug.

Environment

• GitHub Actions; failures reproduced on two Ubuntu 24.04 runner images (20260816.277.1 and 20260823.283.1, runner 2.336.0 — the same image that succeeded the previous day, ruling out a runner-image update)
• anthropics/claude-code-action@v1 → resolved to v1.0.207 (SHA 70fec183852c4f82f3f1969faed7dd60c5149ca7), which installs Claude Code CLI 2.1.247 to /home/runner/.local/bin/claude
• Auth: ANTHROPIC_API_KEY (direct API). The repository secret was last modified 2026-03-13 and unchanged since (we cannot prove server-side key/org state from our end)
• claude_args: --model claude-sonnet-5 (repository variable unchanged since 2026-07-06; the same value appears in both the succeeding and failing runs' init events)
• SDK options logged by the action: systemPrompt: { type: "preset", preset: "claude_code" }, settingSources: ["user", "project", "local"]

Symptom

The stream emits the init event and then immediately a result envelope with is_error: true — no assistant message, no error event, no error text, ~300–465 ms after start:

{
  "type": "system",
  "subtype": "init",
  "message": "Claude Code initialized",
  "model": "claude-sonnet-5"
}
{
  "type": "result",
  "subtype": "success",
  "is_error": true,
  "duration_ms": 333,
  "num_turns": 1,
  "total_cost_usd": 0,
  "permission_denials_count": 0,
  "modelUsage": {}
}

The action then fails with:

##[error]Claude result reported subtype success with is_error:true (run did not complete successfully)
##[error]Action failed with error: Claude execution failed: result is_error:true

num_turns: 1 with total_cost_usd: 0 and empty modelUsage means no successful/billed model response is recorded; a request failing before usage accounting remains possible.

Evidence

• Last green on v1.0.206 / CLI 2.1.246 (2026-08-26): same two workflows, same model, same stored API-key secret — is_error: false, 3 turns / 10 turns, non-zero cost.
• First runs after the tag move (no runs of these workflows occurred between 00:10 and 03:52 UTC): every attempt fails identically — workflow A: 6/6 attempts (duration_ms 297–361), workflow B: 3/3 attempts (370–375), plus workflow B on an independent PR (464 ms).
• Action diff v1.0.206...v1.0.207 (compare): one commit, only the CLI 2.1.246→2.1.247 and SDK 0.3.246→0.3.247 bumps (action.yml, run.ts, package.json, lockfiles). CLI and SDK move together, so we cannot separate them.
• Repo-side caveat: an unrelated PR (docs / lint tooling only; no changes to .claude settings, auth, or the affected workflows) merged into our default branch 44 minutes before the v1.0.207 release, and no Claude runs happened in between — so repository state is a theoretically concurrent variable, though content-wise unlikely to matter.

What we could NOT verify yet (correction over an earlier version of this report)

We attempted to bisect by pinning @v1.0.206 inside the affected PR branch. The checks turned green, but on inspection those runs were gracefully skipped by the action's workflow-validation guard (Workflow validation failed. The workflow file must exist and have identical content to the version on the repository's default branch) — Claude never executed. So we do not yet have a rollback A/B on the same runner/key. We will have one once the pin lands on our default branch and the workflows execute for real; we will update this issue with the result.

Possibly related change in 2.1.247

The 2.1.247 release notes mention changing organization sign-in enforcement to exit at startup when managed settings cannot be read. We have not confirmed any causal link, but it matches the shape of the failure (startup-time, auth/org-path, immediate silent exit in an API-key CI environment).

Counterpoint

On the same repository checkout, Claude Code CLI 2.1.247 on macOS with subscription auth runs headless (claude -p ... --model claude-sonnet-5) without any problem. The failure is not reproduced there; Linux runner environment, the API-key auth path, the Agent SDK, or external org-side state remain candidate differentiators — we could not isolate among them.

Expected behavior

Either the run completes, or the result carries an actionable error message. An instant is_error: true with subtype: "success", zero recorded usage, and no error text is undiagnosable from the caller's side.

Workaround

Pin anthropics/claude-code-action@v1.0.206 on the default branch (note: pinning only inside a PR branch does not test anything — the action skips itself via workflow validation).