The explainer is written by Claude in one job and published by another
A pull request explainer, split across two jobs
Claude writes · a fresh runner publishes
This pull request lets the Claude Code Action write a pull request explainer, then hands the finished folder to a second job that narrates and publishes it. The action gains one new input, called presentation, that makes the publish possible without running any model. This repository's own workflow is the test of it.
Claude's session can't publish, so publishing moves to a second job
Claude's session can't publish
claude-code-action removes the GitHub identity before Claude starts
The reason for two jobs is that claude-code-action strips the variables that mint the run's GitHub identity before Claude starts. Publishing as the repository needs that identity. So the first job only writes and checks the explainer. The second job, on a fresh runner, is the only one allowed to request an identity token, the same split that trusted publishing uses between building and releasing.
Write job uploads a folder, publish job downloads it and runs the action
Two jobs, one folder
Here is the workflow. The write job checks out the repository and runs Claude Code Action with the presenter plugin. The prompt tells Claude to stop before publish, so it writes the slides and a context file, runs the plan and pronunciation checks, and uploads the folder as an artifact. The publish job downloads that artifact and calls the action from this repository, with source set to pull request and presentation pointing at the folder.
With presentation set, no key proxy and no agent run
The new input skips the model
take-presentation.ts copies the folder to where the agent output would be
Inside the action, a presentation input turns off the key proxy and the authoring step. A new script checks that the folder exists and holds the slides, then copies it to where the agent's output would have been. After that the structure check and the narrate and publish steps run unchanged. So no provider key is needed in the publish job, and nothing Claude touched runs with the publishing identity.
The same branch also carries several unrelated changes, one of them breaking
Also in this diff
Read these before approving
- when: judged
- missing-key setup note
- private, not unlisted
- retry once, best effort
- bisque-api-key removed
The diff is bigger than the feature, because the commit copies the whole action from another branch. It adds a when input that lets a model judge whether a pull request is worth explaining, and a setup note when the provider key is missing. Private repositories now publish as private rather than unlisted. Publishing retries once, and a warning about the slides no longer stops it. And the two inputs that took a Bisque API key and user id are gone, so every run now publishes through GitHub identity. Anyone passing those inputs will be affected.
Review the action.yml changes; the workflow only runs for same-repository branches
Review the action, not the copies
Fork pull requests run without secrets, so they are not explained
Start with the action's main definition file and the new script, which are the feature. The skill folders and the other action sources are copied in from another branch, so treat them as a sync. One limit: a pull request from a fork runs without secrets, so Claude cannot write anything for it. This pull request is a test, and it is closed after the run. That is the whole path: Claude writes, a second job publishes.
